Season 3 Episode 3: Resources

3 Feb 2022

And that's a wrap for week 1! Thanks for being with us for the three sessions this week - we all really enjoyed delivering them and it was great to see so many of you active in the conversation.

Couple of resources we mentioned during the session

CyberChef https://gchq.github.io/CyberChef/
The CyberChef 'recipe' that Robert used - https://gchq.github.io/CyberChef/#recipe=URL_Decode()Find_/_Replace(%7B'option':'Regex','string':'%5E'%7D,'%5C%5Cn',true,false,true,false)Syntax_highlighter('auto%20detect')
VirusTotal https://www.virustotal.com/

Anything else you need, please let me know in the comments, and we're looking forward to seeing you all back on Tuesday for session 4.

Have a great weekend all!

Parents

Charlotte Blackmer over 2 years ago

Nick and team - is there a "how to"/"explain like I'm five" KB for how to import queries from the Github repo into our own Sophos Central? I have not personally used Github but could potentially pull in a couple of my developers who know it well - we also have a Git server in-house.

Per Benjamin's comment below, we might already have the RR queries on our account because we have MTR, so that would be great if they could just be visible on my account, but I'd like to know how to do this.
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel

Comment

Charlotte Blackmer over 2 years ago

Nick and team - is there a "how to"/"explain like I'm five" KB for how to import queries from the Github repo into our own Sophos Central? I have not personally used Github but could potentially pull in a couple of my developers who know it well - we also have a Git server in-house.

Per Benjamin's comment below, we might already have the RR queries on our account because we have MTR, so that would be great if they could just be visible on my account, but I'd like to know how to do this.
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel

Children

Nick Fisher over 2 years ago in reply to Charlotte Blackmer

Hi Charlotte, I'll pass this into one of the team and ask them to get back to you
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel
Nick Fisher over 2 years ago in reply to Charlotte Blackmer

Hi Charlotte, I've heard back from the team on this. The simple way to do this is to copy and past from Github into your Central instance. They'll need to be named differently from what you see in the Github repo but otherwise it should be a case of saving and then putting them to good use!
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel