DOCSEARCHbyAlgolia
Submit Docs

Python Programming Documentation

website·Indexed 30 days ago

https://blog.salucci.ch

Comprehensive guides and examples for Python programming, covering core concepts including strings, lists, tuples, sets, and dictionaries. Includes detailed sections on conditionals, loops, iterators, polymorphism, object-oriented programming (classes, inheritance), and variable scope.

Tokens
116.7K
Snippets
762
Records
1K
Agent score
50%

What's inside Python

  1. Overview of Sysmon (System Monitor)

    Sysmon is a Windows system service and device driver that monitors and logs system activity to the Windows event log. It provides deep visibility into activities that typically do not appear in standard Security Event logs, such as process creation, network connections, and changes to file creation times. It consists of a Windows service, a device driver for data capture, and an event log for data display.

  2. Overview of CrowdStrike Falcon Architecture and Capabilities

    CrowdStrike Falcon is a cloud-native security platform primarily used as an Endpoint Detection & Response (EDR) solution. It utilizes an AI-native SOC approach, leveraging machine learning and artificial intelligence for real-time threat detection.

    Key architectural components include:

    • Single Agent (Sensor): A lightweight agent installed on endpoints (workstations and servers) to collect telemetry.
    • Cloud-based Management Console: A centralized interface for administration and monitoring.
    • Cloud-native Backend: Analysis and storage of telemetry data occur within the CrowdStrike cloud rather than on-premises servers, enabling high scalability and centralized updates.

    This architecture is particularly suited for distributed or remote infrastructures due to the minimal footprint of the sensor and the centralized nature of the management plane.

  3. Overview of CrowdStrike Falcon Architecture

    CrowdStrike Falcon is a cloud-native security platform primarily used as an Endpoint Detection & Response (EDR) solution. It utilizes an AI-native SOC approach, leveraging machine learning and artificial intelligence for real-time threat detection. The architecture consists of a single lightweight agent (sensor) installed on endpoints (workstations and servers) which communicates with a cloud-based management console. Because telemetry data analysis and storage occur in the CrowdStrike cloud rather than on-premises, the system provides centralized updates, high scalability, and is particularly suited for distributed or remote infrastructures.

  4. Overview of TwoDots Horror challenge mechanics

    The challenge involves a web application where users can upload a .jpeg profile picture and submit 'two dot horror stories' via the /api/submit endpoint. A headless Chromium bot (admin) reviews these submissions by visiting the /review page. The goal is to execute XSS to steal the admin's flag cookie.

  5. Overview of CrowdStrike Falcon Platform

    CrowdStrike Falcon is a cloud-native security platform primarily utilized as an Endpoint Detection & Response (EDR) solution. It employs a 'Platform' approach, consolidating endpoint protection, threat intelligence, and IT security into a single solution. The system is designed as an AI-native SOC platform, leveraging artificial intelligence and machine learning for real-time threat detection. Key architectural advantages include a lightweight single-agent (sensor) installed on workstations and servers, with telemetry analysis and storage handled in the CrowdStrike cloud, ensuring scalability and centralized updates for remote or distributed infrastructures.

  6. Overview of Cribl Stream

    Cribl Stream is a vendor-agnostic data collection, reduction, enrichment, and routing system designed for observability data. It allows users to move large volumes of IT and security data from multiple sources to multiple destinations using a high-performance, real-time processing architecture. It is designed to reduce the cost and complexity of managing growing data volumes while providing a central control plane for all observability data.

  7. Overview of Coercing Attacks in Active Directory

    Coercing attacks allow any domain user to force a remote server (such as a Domain Controller) to authenticate to a machine of the attacker's choosing. This is achieved by exploiting various vulnerable RPC functions. Once a reverse connection is coerced, attackers typically pursue one of four high-impact follow-up actions:

    1. DCSync: Relay the connection to another DC (requires SMB Signing to be disabled).
    2. TGT Capture: Force the DC to connect to a machine with Unconstrained Delegation (UD), caching the DC's TGT in memory for extraction.
    3. ADCS Relay: Relay the connection to Active Directory Certificate Services to obtain a certificate for the DC.
    4. Resource-Based Constrained Delegation: Relay the connection to configure delegation for the relayed machine, allowing authentication as any Administrator.

  8. Overview of Event Tracing for Windows (ETW)

    Event Tracing for Windows (ETW) is a high-speed, general-purpose tracing facility embedded in the Windows kernel. It provides a buffering and logging mechanism that captures events from both user-mode applications and kernel-mode device drivers. ETW is designed to be lightweight with minimal performance impact, making it suitable for real-time monitoring and security assessment. It captures a wide range of telemetry, including system calls, process creation/termination, network activity, and file/registry modifications.

  9. Overview of CrowdStrike Falcon Architecture

    CrowdStrike Falcon is a cloud-native security platform primarily used as an Endpoint Detection and Response (EDR) solution. It utilizes an AI-native SOC approach, leveraging artificial intelligence and machine learning for real-time threat detection. The architecture consists of a single lightweight agent (sensor) installed on endpoints (workstations and servers) and a centralized cloud-based management console. Because analysis and telemetry data storage occur in the CrowdStrike cloud rather than on-premises, the system provides high scalability, centralized updates, and is particularly suited for distributed or remote infrastructures.

  11. Overview of the Elastic Stack components

    The Elastic Stack is a collection of open-source applications used for real-time search, analysis, and visualization of log data. The core components include:

    • Elasticsearch: A distributed, JSON-based search engine with RESTful APIs that handles indexing, storing, and querying data.
    • Logstash: A server-side data processing pipeline that collects, transforms (normalizes/enriches), and transports log records to Elasticsearch.
    • Kibana: A visualization tool used to explore Elasticsearch documents via tables, charts, and custom dashboards.
    • Beats: Lightweight, single-purpose data shippers installed on remote machines to forward logs and metrics to either Logstash or Elasticsearch.

  12. Overview of Plaso and Timesketch for Forensics

    Plaso is used to extract a large volume of events from a disk or file artifact. Because analyzing the resulting list of events (stored in a .plaso file, which is a sqlite3 database) can be slow, Timesketch is used as a web frontend. Timesketch allows multiple users to concurrently analyze an indexed database of these events.