SIEM

DFIR Platform + Wazuh: Real-Time Alert Enrichment

Integrate DFIR Platform's IOC enrichment API with Wazuh for real-time alert enrichment. Includes integratord configuration, active response scripts, and example alert workflows for SOC teams.

DFIR Platform + Splunk: IOC Enrichment via Custom Search Commands

Build a Splunk custom search command that enriches IOCs via DFIR Platform API. Includes Python code, commands.conf configuration, packaging as a Splunk app, and example SPL queries.

IOC Enrichment Explained: Why Multi-Source Threat Intelligence Matters

Why Windows Event Logging Is Essential for Incident Response

Understanding the critical role of Windows event logs in DFIR work and why proper logging configuration is no longer optional in modern enterprise environments.