Corey Thuen (@CoreyThuen) header
Corey Thuen (@CoreyThuen) profile picture

Corey Thuen

@CoreyThuen

Co-founder at @gravwell_io. Embedded systems, SCADA security researcher. Acme Pharm CTFer. Plays well with others.

Joined November 2012
  • Tweets610
  • Following300
  • Followers903
22Media
Photo by Corey Thuen (@CoreyThuen)Photo by Corey Thuen (@CoreyThuen)Photo by Corey Thuen (@CoreyThuen)Photo by Corey Thuen (@CoreyThuen)Photo by Corey Thuen (@CoreyThuen)
We didn't have an "explainer" video and run-of-the-mill animations are boring so we made this. I'd wager most of us got into this business because computers are fun and awesome. Keep the magic alive! youtube.com/watch?v=Zh76NUUm…
What is Gravwell? Give Data Omniscience to CyberSec and DevOps Teams

What is Gravwell? Give Data Omniscience to CyberSec and DevOps Teams

What is Gravwell? A truly unlimited enterprise-level data fusion an...

youtube.com
1
1
6
Replying to @sylv3on_
By learning how things worked first -- all the tedious boring bits rather than starting with the exciting stuff.
1
31
If you like hacking car ECUs, reverse-engineering software/firmware, tapping serial buses, fuzzing, or some combination of these things, DM me or email matt_at_grimm-co.com. Aerospace your thing? Medical devices? ICS and Power Grid? Endpoint-Dev? email me.
3
1
2
Corey Thuen retweeted
Gravwell (@gravwell_io) profile picture
Gravwell@gravwell_io21 Apr 2022
Continuing to unpack #Gravwell "Orion" v5.0.0 is a new kit for Palo Alto Networks Next-Generation Firewall. You'll see traffic logs similar to Netflow but containing more metadata. Read an in-depth overview and see the pre-built kit dashboards here: hubs.la/Q018ySvh0
Kit: Palo Alto Networks Next-Generation Firewall

Kit: Palo Alto Networks Next-Generation Firewall

Palo Alto's next-gen firewall devices can put out a truly impressive quantity of logs. The logs can be exported to Gravwell via syslog.

gravwell.io
1
5
3
So... our new flows feature adds automation capabilities to Gravwell, but it's *very* flexible. One of our devs was asked to write a basic "hello world" example but the jackass wrote a MIPS emulator to do it instead. Respect. gravwell.io/blog/hello-world…
Hello world! With Gravwell Flows

Hello world! With Gravwell Flows

It has a small memory, program counter, register file, and even a simple memory mapped terminal that outputs over HTTP to a terminal program.

gravwell.io
1
This is also why you should be streaming logs to a central repository.
John Hubbard (@SecHubb) profile pictureJohn Hubbard@SecHubb29 Mar 2022
For anyone that's ever wondered "If I have EDR, is that enough? Do I still need separate network visibility?", below is one clear reason the answer is "yes". Endpoints are highly unreliable observers once compromised.
1
Corey Thuen retweeted
Gravwell (@gravwell_io) profile picture
Gravwell@gravwell_io8 Mar 2022
Gravwell engineer John consistently gathered CPU temperature data from his machine and recently applied a BIOS update. Take a look at the clear-cut before-and-after results in this brief blog post (2-min read). hubs.la/Q015BZkd0 #Ryzen7 #AMD #CPUtemp #ASRock
Did that BIOS Update Do Anything?

Did that BIOS Update Do Anything?

Using Gravwell to analyze CPU temperature trends before and after a BIOS update.

gravwell.io
1
2
Stats are cool! John is monitoring his CPU temperature and shows the before&after of a BIOS update. The chart of the average temperature didn't do much, but the variance is hilarious. gravwell.io/blog/did-that-bi…
Did that BIOS Update Do Anything?

Did that BIOS Update Do Anything?

Using Gravwell to analyze CPU temperature trends before and after a BIOS update.

gravwell.io
New xkcd irritates my old "log centralization that bills on EPS" scars xkcd.com/2582/
Data Trap

Data Trap

xkcd.com
1
You should watch the video because it's awesome, but the tl;dr is Gravwell CE is now free for personal *and* commercial use at 1/10th of an Astronomical Unit in Bytes per day (~14gb). Embark on a Quest for Omniscience! Collect logs, create dashboards, reduce attacker dwell time.
Gravwell (@gravwell_io) profile pictureGravwell@gravwell_io15 Feb 2022
An exciting update from Gravwell! Watch and read more at: hubs.la/Q014b41J0 #SecOps #DevOps #ITOps #DevSecOps #Gravwell #CommunityEdition #CE
1
1
2
Corey Thuen retweeted
Gravwell (@gravwell_io) profile picture
Gravwell@gravwell_io15 Feb 2022
An exciting update from Gravwell! Watch and read more at: hubs.la/Q014b41J0 #SecOps #DevOps #ITOps #DevSecOps #Gravwell #CommunityEdition #CE
4
1
5
Corey Thuen retweeted
Gravwell (@gravwell_io) profile picture
Gravwell@gravwell_io22 Dec 2021
Season's greetings from @gravwell_io! We can't wait to show you what we have planned for 2022. Have a joyful + safe holiday season and a Happy New Year to all!
1
2
Corey Thuen retweeted
Gravwell (@gravwell_io) profile picture
Gravwell@gravwell_io2 Nov 2021
Want to know which applications are listening to you via your microphone? This post has you covered as we dive into Sysmon events 12-14. What's in a Sysmon Event - Windows Registry EventIDs 12, 13, 14 hubs.ly/H0-wj_J0
What's in a Sysmon Event - Windows Registry EventIDs 12, 13, 14

What's in a Sysmon Event - Windows Registry EventIDs 12, 13, 14

Three Sysmon EventIDs come from the Windows Registry when a registry key is created, updated, deleted, or renamed--valuable data from Sysmon for EDR.

gravwell.io
1
2
All data. No limits. #limitssuck
Nancy Liu (@Nancycliu) profile pictureNancy Liu@Nancycliu15 Oct 2021
Gravwell Guns for Splunk With Scalable Data Fusion CEO Corey Thuen:“What we're trying to do for our customers is commoditize data science, give them the opportunity to do data fusion, and ask any question they need.” sdxcentral.com/articles/news… #DataAnalytics #Splunk @gravwell_io
Corey Thuen retweeted
Gravwell (@gravwell_io) profile picture
Gravwell@gravwell_io5 Aug 2021
Unlimited ingestion of #data at the binary level...with no limits? Let's talk about some things that make Gravwell different. Come by our booth at #blackhat in the Innovation City to chat about it. #blackhat2021 #bhusa
1
2
Corey Thuen retweeted
Gravwell (@gravwell_io) profile picture
Gravwell@gravwell_io4 Aug 2021
#blackhat2021 is kicked off! Come by our booth and snag some sweet swag, such as our high-quality playing cards! #blackhat #bhUSA
3
7
Corey Thuen retweeted
Gravwell (@gravwell_io) profile picture
Gravwell@gravwell_io3 Aug 2021
Getting geared up for #blackhat2021 with a pile of swag you wont wanna miss out on. See you at booth IC22 in the Innovation City!
Image from Gravwell (@gravwell_io)
1
4
Corey Thuen retweeted
Ron Gula (@RonGula) profile picture
Ron Gula
@RonGula2 Aug 2021
Thank you @DanielMiessler for pointing out this great @Cloudflare blog on AWS bandwidth egress pricing mark ups. blog.cloudflare.com/aws-egre…
AWS’s Egregious Egress

AWS’s Egregious Egress

Amazon’s says: “We strive to offer our customers the lowest possible prices, the best available selection, and the utmost convenience.” When it comes to egress, their prices are far from the lowest.

blog.cloudflare.com
1
2
1
13
Corey Thuen retweeted
Gravwell (@gravwell_io) profile picture
Gravwell@gravwell_io29 Jul 2021
IBM/Ponemon breach cost report: On average, victims took 287 days to identify a breach and those that took longer to identify cost more. >200 days: $4.87m <200 days: $3.61m Check out this (oldie but goodie) After Action Report detailing a breach response. hubs.la/H0TlSbt0
1
2
Corey Thuen retweeted
Gravwell (@gravwell_io) profile picture
Gravwell@gravwell_io27 Jul 2021
This is a huge week for us as we release a major product update in version 4.2 as well as unveil the all new logo and website. Founder @CoreyThuen shares a bit about the journey to get here. hubs.la/H0Tcn150
1
4
Load more