Domus Digitalis
Components
Domus Digitalis (Hub) Work Chronicles
Infrastructure Ops ISE Operations ISE Linux 802.1X ISE Windows 802.1X Identity & SSO
Linux Operations Windows Operations Python Operations netapi CLI Automation Ops
Secrets Infrastructure SIEM Operations Observability
Runbooks
PKI & Certificates PKI Strategy DOMUS PKI Ceremony Vault PKI Cert Issuance Vault PKI Quick Reference Vault PKI Verification Vault Cert Deployment ISE Certificate Troubleshooting BYOD Certificate Management
Infrastructure VyOS HA Deployment k3s Kubernetes Windows Server 2025 Core DC ISE 3.4 Deployment 802.1X Troubleshooting
Backup & Recovery Backup Strategy (3-2-1) Backup All Infrastructure Disaster Recovery
Documentation Antora UI Architecture Cloudflare Access + Antora
Tools
Core Tools dsec - Domain Secrets netapi - Network Automation
netapi Commands ISE Commands WLC Commands Cloudflare Commands Vault Commands Keycloak Commands KVM Commands Synology Commands IOS Commands Wazuh Commands
Data Tools DataConnect Queries
Linux
Arch Linux RHEL/Rocky/Alma Debian/Ubuntu
GitHub

SIEM Operations

  • Getting Started
    • Overview
    • SIEM Fundamentals
  • QRadar
    • AQL Comprehensive Reference
    • Queries
      • Threat Detection
      • Network Flows
      • Authentication
    • Threat Hunts
      • Windows Server Compromise
      • VNC Traffic Hunt
      • Evil Twin Detection
      • Suspicious Endpoint
    • Playbooks
      • Incident Response
      • Threat Hunting
    • Reference
      • AQL Functions
      • Device Types
      • Field Reference
  • Microsoft Sentinel
    • KQL Reference
  • Wazuh
    • QRadar to Wazuh Mapping
  • Splunk (Future)
    • SPL Reference
  • Migrations
    • QRadar to Sentinel
    • Changelog
      • Changelog Template
SIEM Operations
  • Automation Operations
  • Domus Digitalis
  • DOMUS ISE Linux
  • Identity & SSO
  • Infrastructure Operations
  • ISE Operations
  • ISE Windows 802.1X
  • Linux Operations
  • netapi - Network Automation Library
  • Observability Operations
  • Python Operations
  • Secrets Infrastructure
  • SIEM Operations
  • Windows Operations
  • Work Chronicles
  • SIEM Operations
  • QRadar
  • Threat Hunts
  • Evil Twin Detection

Evil Twin Detection

Overview

Placeholder for evil twin / rogue AP detection queries.

Content to be built from operational experience.
VNC Traffic Hunt Suspicious Endpoint

This page was built using the Antora default UI.

The source code for this UI is licensed under the terms of the MPL-2.0 license.