Comments for fifth.sentinel http://5thsentinel.wordpress.com Just another WordPress.com weblog Thu, 12 Nov 2009 20:22:07 +0000 http://wordpress.com/ hourly 1 Comment on Detailed look at using Circos for IT Investigation by Interesting Information Security Bits for 11/12/2009 | Infosec Ramblings http://5thsentinel.wordpress.com/2009/11/12/detailed-look-at-using-circos-for-it-investigation/#comment-74 Interesting Information Security Bits for 11/12/2009 | Infosec Ramblings Thu, 12 Nov 2009 20:22:07 +0000 http://5thsentinel.wordpress.com/2009/11/12/detailed-look-at-using-circos-for-it-investigation/#comment-74 [...] Detailed look at using Circos for IT Investigation << fifth.sentinel Tags: ( visualization ) [...] [...] Detailed look at using Circos for IT Investigation << fifth.sentinel Tags: ( visualization ) [...]

]]> Comment on Inappropriate Content Visualization – Mark II by Detailed look at using Circos for IT Investigation « fifth.sentinel http://5thsentinel.wordpress.com/2009/10/19/inappropriate-content-visualization-mark-ii/#comment-73 Detailed look at using Circos for IT Investigation « fifth.sentinel Thu, 12 Nov 2009 11:07:13 +0000 http://5thsentinel.wordpress.com/2009/10/19/inappropriate-content-visualization-mark-ii/#comment-73 [...] Detailed look at using Circos for IT Investigation November 12, 2009 Filed under: Uncategorized — 5thsentinel @ 11:06 am Tags: security enterprise investigation forensic visualization circos email HR incident "inappropropriate content" As promised, I am posting a detailed overview of the steps I undertook to create the my Email investigation visualization using Circos that I wrote about here. [...] [...] Detailed look at using Circos for IT Investigation November 12, 2009 Filed under: Uncategorized — 5thsentinel @ 11:06 am Tags: security enterprise investigation forensic visualization circos email HR incident "inappropropriate content" As promised, I am posting a detailed overview of the steps I undertook to create the my Email investigation visualization using Circos that I wrote about here. [...]

]]> Comment on Inappropriate Content Visualization – Mark II by bob_the_web http://5thsentinel.wordpress.com/2009/10/19/inappropriate-content-visualization-mark-ii/#comment-71 bob_the_web Wed, 11 Nov 2009 11:12:29 +0000 http://5thsentinel.wordpress.com/2009/10/19/inappropriate-content-visualization-mark-ii/#comment-71 Thanks for the reply. I have realised my issue. I have around 2,000 unique email addresses in my dataset and so this is not going to be the right approach. I can see how this will work if I get a much smaller set. I am almost at the 'data mining' stage not the forensic stage you are at. I still look forward to seeing the blog! Cheers Thanks for the reply. I have realised my issue. I have around 2,000 unique email addresses in my dataset and so this is not going to be the right approach. I can see how this will work if I get a much smaller set. I am almost at the ‘data mining’ stage not the forensic stage you are at. I still look forward to seeing the blog! Cheers

]]> Comment on Inappropriate Content Visualization – Mark II by 5thsentinel http://5thsentinel.wordpress.com/2009/10/19/inappropriate-content-visualization-mark-ii/#comment-70 5thsentinel Wed, 11 Nov 2009 07:07:32 +0000 http://5thsentinel.wordpress.com/2009/10/19/inappropriate-content-visualization-mark-ii/#comment-70 Hi, Sorry life has got in the way and I haven't been able to publish my next blog as quick as I wanted to. I am about 3/4 of the way through the draft and hope to have it up in the next 24 hours. If you wait for the blog it will give some background on how I started to pair things up for my visualization, however it sounds like you are after a table similar to one that I started with by testing the <a href="http://mkweb.bcgsc.ca/circos/tableviewer/" rel="nofollow">online circos ribbon utility</a> (which also allows you to download the auto-created config files used by Circos) . What I did there was did a matrix grid of User1 through to User27 in the rows and columns. I think I based the rows as the "Sender", so for each row I just added the total number of emails sent from User1 to User2, User3, User4 etc etc. The raw data I used was based on the first worksheet I created is explained in my upcoming posting. Using the output of something like the <a href="http://secviz.org/content/parser-exchange#comment-2" rel="nofollow">Sendmail parser</a> on secviz.org by <a href="http://raffy.ch/blog/" rel="nofollow">Raffey </a>might also allow you to create a similar inital table. Just keep an eye out over the next couple of days for my next post and let me know if it helps out or not. fifth.sentinel Hi,

Sorry life has got in the way and I haven’t been able to publish my next blog as quick as I wanted to. I am about 3/4 of the way through the draft and hope to have it up in the next 24 hours. If you wait for the blog it will give some background on how I started to pair things up for my visualization, however it sounds like you are after a table similar to one that I started with by testing the online circos ribbon utility (which also allows you to download the auto-created config files used by Circos) .

What I did there was did a matrix grid of User1 through to User27 in the rows and columns. I think I based the rows as the “Sender”, so for each row I just added the total number of emails sent from User1 to User2, User3, User4 etc etc. The raw data I used was based on the first worksheet I created is explained in my upcoming posting. Using the output of something like the Sendmail parser on secviz.org by Raffey might also allow you to create a similar inital table.

Just keep an eye out over the next couple of days for my next post and let me know if it helps out or not.

fifth.sentinel

]]> Comment on Inappropriate Content Visualization – Mark II by bob_the_web http://5thsentinel.wordpress.com/2009/10/19/inappropriate-content-visualization-mark-ii/#comment-69 bob_the_web Tue, 10 Nov 2009 18:29:46 +0000 http://5thsentinel.wordpress.com/2009/10/19/inappropriate-content-visualization-mark-ii/#comment-69 Hi, I am trying to start with simple email chart with 'To:' and 'From:' pairings - lots of them. You have done similar charts in Visio, but have you tried anything as simple as this with Circos? Not sure how to start with the 'table and column' concept...I am also looking at trying Circos with netflow so maybe we could share experiences with that one! Cheers Hi, I am trying to start with simple email chart with ‘To:’ and ‘From:’ pairings – lots of them. You have done similar charts in Visio, but have you tried anything as simple as this with Circos? Not sure how to start with the ‘table and column’ concept…I am also looking at trying Circos with netflow so maybe we could share experiences with that one! Cheers

]]> Comment on Inappropriate Content Visualization – Mark II by IT Rosetta Stone for using Circos « fifth.sentinel http://5thsentinel.wordpress.com/2009/10/19/inappropriate-content-visualization-mark-ii/#comment-66 IT Rosetta Stone for using Circos « fifth.sentinel Tue, 27 Oct 2009 09:29:17 +0000 http://5thsentinel.wordpress.com/2009/10/19/inappropriate-content-visualization-mark-ii/#comment-66 [...] — 5thsentinel @ 9:28 am Tags: security visualization circos configuration In my last blog I introduce the genome visualization tool called Circos created by Martin Krzywinski. In this post [...] [...] — 5thsentinel @ 9:28 am Tags: security visualization circos configuration In my last blog I introduce the genome visualization tool called Circos created by Martin Krzywinski. In this post [...]

]]> Comment on Inappropriate Content Visualization – Mark II by 5thsentinel http://5thsentinel.wordpress.com/2009/10/19/inappropriate-content-visualization-mark-ii/#comment-65 5thsentinel Wed, 21 Oct 2009 10:29:01 +0000 http://5thsentinel.wordpress.com/2009/10/19/inappropriate-content-visualization-mark-ii/#comment-65 Thanks Alec, I will follow up with a step-by-step outline of how I created it soon, but if you are keen to play, I started by playing with the online version of <a href="http://mkweb.bcgsc.ca/circos/tableviewer/" rel="nofollow">Circos </a>which will generate a ribbon based visualisation for a table of up to 15x15 cells. Not only will you get a copy of the graphic, but you are also provided with the automatically generated config files that were used to create it. This makes it a bit easier to reverse engineer the config options to you are after. Thanks Alec,

I will follow up with a step-by-step outline of how I created it soon, but if you are keen to play, I started by playing with the online version of Circos which will generate a ribbon based visualisation for a table of up to 15×15 cells. Not only will you get a copy of the graphic, but you are also provided with the automatically generated config files that were used to create it. This makes it a bit easier to reverse engineer the config options to you are after.

]]> Comment on Inappropriate Content Visualization – Mark II by Alec Waters http://5thsentinel.wordpress.com/2009/10/19/inappropriate-content-visualization-mark-ii/#comment-64 Alec Waters Tue, 20 Oct 2009 19:05:05 +0000 http://5thsentinel.wordpress.com/2009/10/19/inappropriate-content-visualization-mark-ii/#comment-64 That's a seriously impressive visualisation! Are the data and configuration files for Circos available for download anywhere? I'd love to experiment. That’s a seriously impressive visualisation! Are the data and configuration files for Circos available for download anywhere? I’d love to experiment.

]]> Comment on Nifty USB port block solution by Becka http://5thsentinel.wordpress.com/2008/05/10/nifty-usb-port-block-solution/#comment-23 Becka Tue, 11 Nov 2008 01:27:25 +0000 http://5thsentinel.wordpress.com/?p=7#comment-23 Good post. Good post.

]]> Comment on Is ERM a Better Investment for DLP in an Virtualised Future by » Is ERM a Better Investment for DLP in an Virtualised Future Citrix terminal servers and thin clients - Secure Citrix Systems http://5thsentinel.wordpress.com/2008/10/08/is-erm-a-better-investment-for-dlp-in-an-virtualised-future/#comment-22 » Is ERM a Better Investment for DLP in an Virtualised Future Citrix terminal servers and thin clients - Secure Citrix Systems Wed, 08 Oct 2008 23:15:42 +0000 http://5thsentinel.wordpress.com/?p=29#comment-22 [...] news by 5thsentinel document.write(""); This entry is filed under Citrix terminal servers. You can follow any [...] [...] news by 5thsentinel document.write(“”); This entry is filed under Citrix terminal servers. You can follow any [...]

]]>