corpus.blog
41554 blogs · [ { "id": "01a0c557-ad0d-72cf-8d04-69c7bb885833", "title": "Investigations and Prospective Data Collection", "url": "https://chrissanders.org/2015/06/investigations-prospective-data-collection/?utm_source=rss&utm_medium=rss&utm_campaign=investigations-prospective-data-collection", "published_at": "2015-06-29T19:37:46+00:00" }, { "id": "01a0c557-ad0d-72cf-8d04-69c7bbf57cbc", "title": "On the Importance of Questions in an Investigation", "url": "https://chrissanders.org/2015/05/questions-in-investigations/?utm_source=rss&utm_medium=rss&utm_campaign=questions-in-investigations", "published_at": "2015-05-17T15:25:53+00:00" }, { "id": "01a0c557-ad0d-72cf-8d04-69c7bc9f1a2f", "title": "Technical Book Purchases Making a Difference", "url": "https://chrissanders.org/2015/05/15-mid-year-donations/?utm_source=rss&utm_medium=rss&utm_campaign=15-mid-year-donations", "published_at": "2015-05-12T16:07:02+00:00" }, { "id": "01a0c557-ad0d-72cf-8d04-69c7bcee0f84", "title": "Working Memory and the Visual Investigative Hypothesis", "url": "https://chrissanders.org/2015/04/visual-investigative-hypothesis/?utm_source=rss&utm_medium=rss&utm_campaign=visual-investigative-hypothesis", "published_at": "2015-04-26T16:18:07+00:00" }, { "id": "01a0c557-ad0d-72cf-8d04-69c7bda6e28e", "title": "The Value of Watching Game Tape", "url": "https://chrissanders.org/2015/03/the-value-of-watching-game-tape/?utm_source=rss&utm_medium=rss&utm_campaign=the-value-of-watching-game-tape", "published_at": "2015-03-26T00:46:03+00:00" }, { "id": "01a0c557-ad0d-72cf-8d04-69c7be8c3814", "title": "Investigating Like a Chef", "url": "https://chrissanders.org/2015/01/investigating-like-a-chef/?utm_source=rss&utm_medium=rss&utm_campaign=investigating-like-a-chef", "published_at": "2015-01-07T18:38:47+00:00" }, { "id": "01a0c557-ad0d-72cf-8d04-69c7bee5be65", "title": "Teaching Good Investigation Habits Through Reinforcement", "url": "https://chrissanders.org/2015/01/teaching-good-investigation-habits-through-reinforcement/?utm_source=rss&utm_medium=rss&utm_campaign=teaching-good-investigation-habits-through-reinforcement", "published_at": "2015-01-06T17:25:29+00:00" }, { "id": "01a0c557-ad0d-72cf-8d04-69c7bf9efc6c", "title": "Theory of Multiple Intelligences for Security Analysts – Initial Thoughts", "url": "https://chrissanders.org/2014/12/initial-thoughts-theory-of-multiple-intelligences-for-analysts/?utm_source=rss&utm_medium=rss&utm_campaign=initial-thoughts-theory-of-multiple-intelligences-for-analysts", "published_at": "2014-12-17T21:19:37+00:00" }, { "id": "01a0c557-ad0d-72cf-8d04-69c7c055efae", "title": "Perception, Cognition, and the Notion of “Real Time” Detection and Analysis", "url": "https://chrissanders.org/2014/12/perception-cognition-and-real-time-detection-analysis/?utm_source=rss&utm_medium=rss&utm_campaign=perception-cognition-and-real-time-detection-analysis", "published_at": "2014-12-02T04:07:45+00:00" }, { "id": "01a0c557-ad0d-72cf-8d04-69c7c0bbf9f6", "title": "Charleston ISSA Slides: Using Canary Honeypots for NSM", "url": "https://chrissanders.org/2014/11/slides-using-canary-honeypots-for-nsm/?utm_source=rss&utm_medium=rss&utm_campaign=slides-using-canary-honeypots-for-nsm", "published_at": "2014-11-23T19:01:35+00:00" }, { "id": "01a0c560-0dc0-705d-b8d6-ad4f9b424c5e", "title": "Introducing FlowBAT, the Flow Analysis GUI", "url": "https://chrissanders.org/2014/10/introducing-flowbat/?utm_source=rss&utm_medium=rss&utm_campaign=introducing-flowbat", "published_at": "2014-10-14T00:44:07+00:00" }, { "id": "01a0c560-0dc0-705d-b8d6-ad4f9c0084ad", "title": "MIRCon 2014 Slides: Applied Detection and Analysis with Flow Data", "url": "https://chrissanders.org/2014/10/mircon-2014-slides/?utm_source=rss&utm_medium=rss&utm_campaign=mircon-2014-slides", "published_at": "2014-10-13T14:44:11+00:00" }, { "id": "01a0c560-0dc0-705d-b8d6-ad4f9c7f7404", "title": "BSides Augusta 2014 Slides and Video – Defeating Cognitive Bias and Developing Analytic Technique", "url": "https://chrissanders.org/2014/10/bsides-augusta-2014-slides-video/?utm_source=rss&utm_medium=rss&utm_campaign=bsides-augusta-2014-slides-video", "published_at": "2014-10-13T14:42:45+00:00" }, { "id": "01a0c560-0dc0-705d-b8d6-ad4f9d44f8ce", "title": "Evolving Towards an Era of Analysis", "url": "https://chrissanders.org/2014/09/era-of-analysis/?utm_source=rss&utm_medium=rss&utm_campaign=era-of-analysis", "published_at": "2014-09-17T17:47:17+00:00" }, { "id": "01a0c560-0dc0-705d-b8d6-ad4f9d4d455d", "title": "Practical Packet Analysis 3rd Edition Research", "url": "https://chrissanders.org/2014/08/practical-packet-analysis-3rd-edition-research/?utm_source=rss&utm_medium=rss&utm_campaign=practical-packet-analysis-3rd-edition-research", "published_at": "2014-08-11T17:21:06+00:00" }, { "id": "01a0c560-0dc0-705d-b8d6-ad4f9e3422ee", "title": "Applied NSM Blog Post: The NSM Analyst’s Notebook", "url": "https://chrissanders.org/2014/03/ansm-blog-post-the-nsm-analysts-notebook/?utm_source=rss&utm_medium=rss&utm_campaign=ansm-blog-post-the-nsm-analysts-notebook", "published_at": "2014-03-13T23:54:47+00:00" }, { "id": "01a0c560-0dc0-705d-b8d6-ad4f9eafc7a2", "title": "So You Want To Write an Infosec Book?", "url": "https://chrissanders.org/2014/02/so-you-want-to-write-infosec-book/?utm_source=rss&utm_medium=rss&utm_campaign=so-you-want-to-write-infosec-book", "published_at": "2014-02-06T21:25:53+00:00" }, { "id": "01a0c560-0dc0-705d-b8d6-ad4f9edd9025", "title": "Applied NSM Dedication and Acknowledgements", "url": "https://chrissanders.org/2013/12/applied-nsm-dedication-and-acknowledgements/?utm_source=rss&utm_medium=rss&utm_campaign=applied-nsm-dedication-and-acknowledgements", "published_at": "2013-12-11T15:52:52+00:00" }, { "id": "01a0c560-0dc0-705d-b8d6-ad4f9fc67ec7", "title": "Applied NSM Blog Post: Using Wireshark Host Files for Quicker Analysis", "url": "https://chrissanders.org/2013/12/ansm-blog-post-wireshark-host-files/?utm_source=rss&utm_medium=rss&utm_campaign=ansm-blog-post-wireshark-host-files", "published_at": "2013-12-11T15:42:36+00:00" }, { "id": "01a0c560-0dc0-705d-b8d6-ad4fa0a105f3", "title": "Charleston ISSA Chapter Forming", "url": "https://chrissanders.org/2013/07/charleston-issa-forming/?utm_source=rss&utm_medium=rss&utm_campaign=charleston-issa-forming", "published_at": "2013-07-05T14:19:00+00:00" }, { "id": "01a0c568-2a12-703b-adbf-e15ed0fe62a0", "title": "Raspberry Pi Donations for Public Schools", "url": "https://chrissanders.org/2013/06/raspberry-pi-donations/?utm_source=rss&utm_medium=rss&utm_campaign=raspberry-pi-donations", "published_at": "2013-06-07T15:51:05+00:00" }, { "id": "01a0c568-2a12-703b-adbf-e15ed18465ed", "title": "My Testimony", "url": "https://chrissanders.org/2013/04/my-testimony/?utm_source=rss&utm_medium=rss&utm_campaign=my-testimony", "published_at": "2013-04-17T17:52:02+00:00" }, { "id": "01a0c568-2a12-703b-adbf-e15ed24d6b4a", "title": "Applied Network Security Monitoring, the book!", "url": "https://chrissanders.org/2013/02/applied-nsm-the-book/?utm_source=rss&utm_medium=rss&utm_campaign=applied-nsm-the-book", "published_at": "2013-02-15T18:53:19+00:00" }, { "id": "01a0c568-2a12-703b-adbf-e15ed27a568f", "title": "Information Security Incident Morbidity and Mortality (M&M)", "url": "https://chrissanders.org/2012/08/information-security-incident-morbidity-and-mortality/?utm_source=rss&utm_medium=rss&utm_campaign=information-security-incident-morbidity-and-mortality", "published_at": "2012-08-28T15:56:31+00:00" }, { "id": "01a0c568-2a12-703b-adbf-e15ed31e9fbb", "title": "4 Ideas for Operationalizing Honeypots", "url": "https://chrissanders.org/2012/03/4-ideas-for-operationalizing-honeypots/?utm_source=rss&utm_medium=rss&utm_campaign=4-ideas-for-operationalizing-honeypots", "published_at": "2012-03-14T21:37:23+00:00" }, { "id": "01a0c568-2a12-703b-adbf-e15ed3ed6860", "title": "NSM Collection vs. Detection", "url": "https://chrissanders.org/2012/02/nsm-collection-vs-detection/?utm_source=rss&utm_medium=rss&utm_campaign=nsm-collection-vs-detection", "published_at": "2012-02-07T00:19:05+00:00" }, { "id": "01a0c568-2a12-703b-adbf-e15ed406633f", "title": "Differential Diagnosis of Network Security Monitoring Events", "url": "https://chrissanders.org/2012/01/differential-diagnosis-nsm/?utm_source=rss&utm_medium=rss&utm_campaign=differential-diagnosis-nsm", "published_at": "2012-01-08T16:38:14+00:00" }, { "id": "01a0c568-2a12-703b-adbf-e15ed4bc110e", "title": "Packet Carving with SMB and SMB2", "url": "https://chrissanders.org/2011/11/packet-carving-with-smb-and-smb2/?utm_source=rss&utm_medium=rss&utm_campaign=packet-carving-with-smb-and-smb2", "published_at": "2011-11-03T01:48:07+00:00" }, { "id": "01a0c568-2a12-703b-adbf-e15ed4ef9b57", "title": "Using Application Layer Metadata for Network Security Monitoring", "url": "https://chrissanders.org/2011/09/using-application-layer-metadata-for-network-security-monitoring/?utm_source=rss&utm_medium=rss&utm_campaign=using-application-layer-metadata-for-network-security-monitoring", "published_at": "2011-09-23T23:32:40+00:00" }, { "id": "01a0c568-2a12-703b-adbf-e15ed571f4c3", "title": "GFIRST 2011 Presentation Slides, Code, and Thoughts", "url": "https://chrissanders.org/2011/08/gfirst-2011-presentation-slides-code-and-thoughts/?utm_source=rss&utm_medium=rss&utm_campaign=gfirst-2011-presentation-slides-code-and-thoughts", "published_at": "2011-08-12T19:46:47+00:00" }, { "id": "01a0c56f-6405-700e-9360-614ec994303d", "title": "My Review of SANS FOR610: Reverse Engineering Malware", "url": "https://chrissanders.org/2011/04/my-review-of-sans-for610-reverse-engineering-malware/?utm_source=rss&utm_medium=rss&utm_campaign=my-review-of-sans-for610-reverse-engineering-malware", "published_at": "2011-04-09T12:55:36+00:00" }, { "id": "01a0c56f-6405-700e-9360-614eca8fe45d", "title": "Collecting Threat Intelligence", "url": "https://chrissanders.org/2011/02/collecting-threat-intelligence/?utm_source=rss&utm_medium=rss&utm_campaign=collecting-threat-intelligence", "published_at": "2011-02-05T13:30:32+00:00" }, { "id": "01a0c56f-6405-700e-9360-614ecb199e0d", "title": "The 10 Commandments of Intrusion Analysis", "url": "https://chrissanders.org/2011/01/the-10-commandments-of-intrusion-analysis/?utm_source=rss&utm_medium=rss&utm_campaign=the-10-commandments-of-intrusion-analysis", "published_at": "2011-01-17T13:21:07+00:00" }, { "id": "01a0c56f-6405-700e-9360-614ecbddc945", "title": "Sanitizing PCAP Files for Public Distrubution", "url": "https://chrissanders.org/2010/12/sanitizing-pcap-files-for-public-distrubution/?utm_source=rss&utm_medium=rss&utm_campaign=sanitizing-pcap-files-for-public-distrubution", "published_at": "2010-12-20T15:37:18+00:00" }, { "id": "01a0c56f-6405-700e-9360-614ecc7e980b", "title": "Understanding Man-In-The-Middle Attacks", "url": "https://chrissanders.org/2010/06/understanding-man-in-the-middle-attacks/?utm_source=rss&utm_medium=rss&utm_campaign=understanding-man-in-the-middle-attacks", "published_at": "2010-06-28T13:55:53+00:00" }, { "id": "01a0c56f-6405-700e-9360-614ecd3cf59c", "title": "Viewing Packet Captures Online with CloudShark", "url": "https://chrissanders.org/2010/06/viewing-packet-captures-online-with-cloudshark/?utm_source=rss&utm_medium=rss&utm_campaign=viewing-packet-captures-online-with-cloudshark", "published_at": "2010-06-22T14:40:56+00:00" }, { "id": "01a0c56f-6405-700e-9360-614ecda380ad", "title": "Announcing the Rural Technology Fund", "url": "https://chrissanders.org/2009/05/announcing-the-rural-technology-fund/?utm_source=rss&utm_medium=rss&utm_campaign=announcing-the-rural-technology-fund", "published_at": "2009-05-31T21:38:48+00:00" }, { "id": "01a0c56f-6405-700e-9360-614ece8d02fc", "title": "Keeping Capture Files Manageable", "url": "https://chrissanders.org/2009/04/keeping-capture-files-manageable/?utm_source=rss&utm_medium=rss&utm_campaign=keeping-capture-files-manageable", "published_at": "2009-04-21T01:58:32+00:00" }, { "id": "01a0c56f-6405-700e-9360-614ecee25f3e", "title": "Using a Tap for Packet Analysis", "url": "https://chrissanders.org/2009/04/using-a-tap-for-packet-analysis/?utm_source=rss&utm_medium=rss&utm_campaign=using-a-tap-for-packet-analysis", "published_at": "2009-04-09T00:50:12+00:00" }, { "id": "01a0c56f-6405-700e-9360-614ecee3eafb", "title": "Using ARP Cache Poisoning for Packet Analysis", "url": "https://chrissanders.org/2008/04/using-arp-cache-poisoning-for-packet-analysis/?utm_source=rss&utm_medium=rss&utm_campaign=using-arp-cache-poisoning-for-packet-analysis", "published_at": "2008-04-13T18:02:52+00:00" }, { "id": "01a0c57b-c718-71fc-9b39-7234f959b986", "title": "Packet School 201 – Part 1 (ARP)", "url": "https://chrissanders.org/2007/12/packet-school-201-part-1-arp/?utm_source=rss&utm_medium=rss&utm_campaign=packet-school-201-part-1-arp", "published_at": "2007-12-23T19:59:21+00:00" }, { "id": "01a0c57b-c718-71fc-9b39-7234f9bebc1a", "title": "Packet Analysis Interview by SearchNetworking.com", "url": "https://chrissanders.org/2007/08/packet-analysis-interview-by-searchnetworkingcom/?utm_source=rss&utm_medium=rss&utm_campaign=packet-analysis-interview-by-searchnetworkingcom", "published_at": "2007-08-03T23:15:23+00:00" }, { "id": "01a0c57b-c718-71fc-9b39-7234f9beff6f", "title": "PPA Book Acknowledgements", "url": "https://chrissanders.org/2007/05/ppa-book-acknowledgements/?utm_source=rss&utm_medium=rss&utm_campaign=ppa-book-acknowledgements", "published_at": "2007-05-21T15:42:09+00:00" }, { "id": "01a0c57b-c718-71fc-9b39-7234fa377b65", "title": "Packet School 101 – Part 5", "url": "https://chrissanders.org/2006/09/packet-school-101-part-5/?utm_source=rss&utm_medium=rss&utm_campaign=packet-school-101-part-5", "published_at": "2006-09-05T02:47:50+00:00" }, { "id": "01a0c57b-c718-71fc-9b39-7234fae25075", "title": "Packet School 101 – Part 4", "url": "https://chrissanders.org/2006/07/packet-school-101-part-4/?utm_source=rss&utm_medium=rss&utm_campaign=packet-school-101-part-4", "published_at": "2006-07-13T16:02:21+00:00" }, { "id": "01a0c57b-c718-71fc-9b39-7234fb96f605", "title": "Packet School 101 – Part 3.5", "url": "https://chrissanders.org/2006/07/packet-school-101-part-35/?utm_source=rss&utm_medium=rss&utm_campaign=packet-school-101-part-35", "published_at": "2006-07-11T02:19:21+00:00" }, { "id": "01a0c57b-c718-71fc-9b39-7234fc37c9f0", "title": "Packet School 101 – Part 3", "url": "https://chrissanders.org/2006/07/packet-school-101-part-3/?utm_source=rss&utm_medium=rss&utm_campaign=packet-school-101-part-3", "published_at": "2006-07-06T19:55:12+00:00" }, { "id": "01a0c57b-c718-71fc-9b39-7234fcdff807", "title": "Packet School 101 – Part 2", "url": "https://chrissanders.org/2006/06/packet-school-101-part-2/?utm_source=rss&utm_medium=rss&utm_campaign=packet-school-101-part-2", "published_at": "2006-06-28T18:23:37+00:00" }, { "id": "01a0c57b-c718-71fc-9b39-7234fcf6dd1f", "title": "Packet School 101 – Part 1", "url": "https://chrissanders.org/2006/06/packet-school-101-part-1/?utm_source=rss&utm_medium=rss&utm_campaign=packet-school-101-part-1", "published_at": "2006-06-22T15:16:28+00:00" } ] posts Claim your blog
Back to chrissanders.org
Blog · corpus.blog/blogs/chrissanders.org/posts

chrissanders.org

chrissanders.org

2015

Investigations and Prospective Data Collectionoriginal ↗
29 Jun 2015
On the Importance of Questions in an Investigationoriginal ↗
17 May 2015
Technical Book Purchases Making a Differenceoriginal ↗
12 May 2015
Working Memory and the Visual Investigative Hypothesisoriginal ↗
26 Apr 2015
The Value of Watching Game Tapeoriginal ↗
26 Mar 2015
Investigating Like a Cheforiginal ↗
7 Jan 2015
Teaching Good Investigation Habits Through Reinforcementoriginal ↗
6 Jan 2015

2014

Theory of Multiple Intelligences for Security Analysts – Initial Thoughtsoriginal ↗
17 Dec 2014
Perception, Cognition, and the Notion of “Real Time” Detection and Analysisoriginal ↗
2 Dec 2014
Charleston ISSA Slides: Using Canary Honeypots for NSMoriginal ↗
23 Nov 2014
Introducing FlowBAT, the Flow Analysis GUIoriginal ↗
14 Oct 2014
MIRCon 2014 Slides: Applied Detection and Analysis with Flow Dataoriginal ↗
13 Oct 2014
BSides Augusta 2014 Slides and Video – Defeating Cognitive Bias and Developing Analytic Techniqueoriginal ↗
13 Oct 2014
Evolving Towards an Era of Analysisoriginal ↗
17 Sept 2014
Practical Packet Analysis 3rd Edition Researchoriginal ↗
11 Aug 2014
Applied NSM Blog Post: The NSM Analyst’s Notebookoriginal ↗
13 Mar 2014
So You Want To Write an Infosec Book?original ↗
6 Feb 2014

2013

Applied NSM Dedication and Acknowledgementsoriginal ↗
11 Dec 2013
Applied NSM Blog Post: Using Wireshark Host Files for Quicker Analysisoriginal ↗
11 Dec 2013
Charleston ISSA Chapter Formingoriginal ↗
5 Jul 2013
Raspberry Pi Donations for Public Schoolsoriginal ↗
7 Jun 2013
My Testimonyoriginal ↗
17 Apr 2013
Applied Network Security Monitoring, the book!original ↗
15 Feb 2013

2012

Information Security Incident Morbidity and Mortality (M&M)original ↗
28 Aug 2012
4 Ideas for Operationalizing Honeypotsoriginal ↗
14 Mar 2012
NSM Collection vs. Detectionoriginal ↗
7 Feb 2012
Differential Diagnosis of Network Security Monitoring Eventsoriginal ↗
8 Jan 2012

2011

Packet Carving with SMB and SMB2original ↗
3 Nov 2011
Using Application Layer Metadata for Network Security Monitoringoriginal ↗
23 Sept 2011
GFIRST 2011 Presentation Slides, Code, and Thoughtsoriginal ↗
12 Aug 2011
My Review of SANS FOR610: Reverse Engineering Malwareoriginal ↗
9 Apr 2011
Collecting Threat Intelligenceoriginal ↗
5 Feb 2011
The 10 Commandments of Intrusion Analysisoriginal ↗
17 Jan 2011

2010

Sanitizing PCAP Files for Public Distrubutionoriginal ↗
20 Dec 2010
Understanding Man-In-The-Middle Attacksoriginal ↗
28 Jun 2010
Viewing Packet Captures Online with CloudSharkoriginal ↗
22 Jun 2010

2009

Announcing the Rural Technology Fundoriginal ↗
31 May 2009
Keeping Capture Files Manageableoriginal ↗
21 Apr 2009
Using a Tap for Packet Analysisoriginal ↗
9 Apr 2009

2008

Using ARP Cache Poisoning for Packet Analysisoriginal ↗
13 Apr 2008

2007

Packet School 201 – Part 1 (ARP)original ↗
23 Dec 2007
Packet Analysis Interview by SearchNetworking.comoriginal ↗
3 Aug 2007
PPA Book Acknowledgementsoriginal ↗
21 May 2007

2006

Packet School 101 – Part 5original ↗
5 Sept 2006
Packet School 101 – Part 4original ↗
13 Jul 2006
Packet School 101 – Part 3.5original ↗
11 Jul 2006
Packet School 101 – Part 3original ↗
6 Jul 2006
Packet School 101 – Part 2original ↗
28 Jun 2006
Packet School 101 – Part 1original ↗
22 Jun 2006
Previous