🔨 SOC Tools

SaaS tools

tip

Full list of SaaS tools, URLs and credentials can be found in 1Password.

Defender

• https://security.microsoft.com/

Sentinel

• https://portal.azure.com/

Entra

• https://entra.microsoft.com/

Intune

• https://intune.microsoft.com/

Purview

• https://purview.microsoft.com/

Proofpoint Essentials (NOT TAP)

• https://eu1.proofpointessentials.com/app/login.php

Filescan

• https://www.filescan.io/

ServiceNow

• https://ven08053.service-now.com/
• https://ven08054.service-now.com/
• https://ven08055.service-now.com/

Jira

• https://legionsecurity.atlassian.net/jira/servicedesk/projects/CS/queues/custom/1

SentinelOne

• https://euce1-spike-it.sentinelone.net/

Crowdstrike

• https://falcon.us-2.crowdstrike.com/login/

Self hosted tools

The Hive

• http://ec2-44-204-63-61.compute-1.amazonaws.com/

Static pages

• Url: https://static.tools.legionsecurity.ai/
• AWS account: legionsecurity-lab
• S3 bucket: static.tools.legionsecurity.ai

How to upload pages

• Login to the account above (through the main loging page: https://d-9067ff8475.awsapps.com/start/)
• Go to the bucket and upload to the relevant folder
• Alternatively you can use the AWS CLI : aws s3 cp /path/to/your-page.html s3://static.tools.legionsecurity.ai/path/to/desired/location/your-page.html --profile lab-account --region il-central-1

Tool VMs

• Full list here: https://docs.google.com/spreadsheets/d/1wYquGBm1ApAhEyATaY_Lowmsgi0A2mg2j4SxOZ1I3eM