Category: Azure

Group Policy Assignments Using Microsoft Teams PowerShell

May 30, 2023 Shan

Unmanaged devices, external file-sharing, and email integration impose a big question mark on the security posture of Microsoft Teams. In order to secure and manage Microsoft Teams, policies are used under various sections like messaging, meetings, calling, conferencing, and many more. Usually, these Teams policies for users, groups, and batches are managed in the Microsoft Teams admin center or using the Teams PowerShell Module (TPM). But now Microsoft extends the managing capability of additional Office 365 group policies using the Teams PowerShell Module as per MC557818.    

According to this latest update, group policy assignments for Microsoft 365 groups, distribution lists, mail-enabled security groups, and security groups support additional policies in the Teams PowerShell Module. Apart from action control, policy assignments also set way for security controls like restricting anonymous access in meetings. 

Let us see how to assign group policies using Microsoft Teams PowerShell Module and their functionalities under this blog. 

What are Group Policy Assignments? 

As the name suggests, assigning a policy to a particular group of users is known as a group policy assignment. The groups can be managed in Microsoft 365 admin center whereas group policies can be managed under the single roof of the Teams PowerShell Module.  

Policy assignments are applied only to the direct members of a group and not to the nested group. That too, they are applied according to the precedence rules. And at the time of addition or deletion of users from a group, the policy assignments are updated which is also applicable when a policy is unassigned. Before jumping into group policy assignments, let us look through the precedence rules and ranking of policies.

What are Microsoft Teams Policy Precedence Rules?

Policy precedence determines the user’s effective policy when a user is assigned two or more of the same policy types. The precedence rules of policies are listed below for deeper insights into how an assigned policy will be deployed according to these rules. 

  • If a user is directly assigned a policy, the same type of policy can’t be inherited from the group. Therefore, the directly assigned policy takes precedence over the same policy type defined by the group. 
  • Also, if a user doesn’t contain a directly assigned policy, the user inherits the highest-ranking policy from the same type of policies applied by two or more groups. 
  • Finally, if the user is not assigned a policy directly or by group, then the global (organization-wide) policy takes precedence. 


The user policy is updated under the following circumstances. 

  • Especially when a user is added or removed from the policy assigned group. 
  • And when a group policy is unassigned.
  • At last, if a directly assigned policy is removed from a user.

What is Group Policy Assignment Rank in Teams?

As an admin, you are asked to define the rank of policy while assigning the policy. Primarily this ranking weighs the priority of the same type of policies assigned from two or more groups for a common user. Finally, the highest-ranking group policy is assigned as the effective policy to the end user after weighing the priority. Because a policy type can be assigned to a maximum number of 64 groups in Office 365.  

NOTE: If the rank value is undefined, then the lowest ranking is given to the policy assignment. 

How to Assign Policy to a Group in Teams Admin Center? 

Follow the below steps to configure group policies in the Teams admin center where it majorly supports Teams calling policy, Teams call park policy, Teams policy, Teams live events policy, Teams meeting policy, and Teams messaging policy. 

  1. Navigate using the path below.  

Microsoft Teams admin center 🡢 Messaging Policies (Select the desired policy type page) 🡢 Group policy assignment 🡢 Add group 🡢 Assign policy to group  

Group Policy Assignments in the Teams admin center

2. Then, select a group to which you want to assign a policy.
3. Set the ranking value for the group policy assignment through the select rank option. 
4. After that, select a policy from the available policy types in the drop-down list and click Apply. 

Unfortunately, all policy types can’t be managed under the Microsoft Teams admin center since it supports only certain policy types. Without a second thought, PowerShell is the go-to solution! Yes, managing policies using PowerShell is easy and efficient as it is the primary automation tool that ensures the deployment of objects in multiple tenants. Also, it is a place where error handling and logging are more flexible compared to the native admin center. Thus, let us deeply look through the next section of the blog to manage group policy assignments using Microsoft Teams PowerShell.  

Manage Group Policy Assignments Using Teams PowerShell Module 

As per the new update, Teams PowerShell Module now helps to manage group policies of Microsoft 365 groups, mail-enabled security groups, distribution lists, and security groups including Teams-related policies. Thus, create & manage groups in Microsoft 365 admin center and manage their policies in Teams PowerShell. Before getting started with PowerShell cmdlets, make sure to connect to the Teams PowerShell Module.  

  1. Assign Policy to Group Using Teams PowerShell Module 
  2. Get Group Policy Assignments Using MS Teams PowerShell 
  3. Remove Policy Assignment from a Group Using TPM 
  4. Modify Group Policy Assignment Using Teams PowerShell Module


Assign Policy to Group Using Teams PowerShell Module

By defining group policies, you can control user-specific actions like allowing them to schedule meetings, edit sent messages, etc. You can assign the available policies or create and assign custom policies depending on your requirements.
Execute the following cmdlet after replacing the unique group identifier, policy type, policy name, and expected rank to assign a new policy for a group.  

New-CsGroupPolicyAssignment -GroupId d8ebfa45-0f28-4d2d-9bcc-b158a49e2d17 -PolicyType TeamsMeetingPolicy -PolicyName AllOn -Rank 1 

This “New-CsGroupPolicyAssignment” cmdlet is basically used to create new policy assignments for security groups and distribution lists. In which the group ID, policy type, policy name, and rank must be mentioned as mandatory parameters. Here with the rank value as one, the ‘AllOn’ policy under TeamsMeetingPolicy type is created for the given group. 

The rank of the policy must be defined to determine the precedence. The recommended group membership size is 50,000 users per group while assigning a group policy. Also, it takes 24 hours or more to propagate the policy to all members of the larger groups.


Get Group Policy Assignments Using MS Teams PowerShell

Knowing all the available policy assignments allows you to understand the working conditions and their precedence levels better. Using this you can remove unnecessary policies, alter the desired ranking for policies and efficiently manage teams & groups around your Office environment. 

The “Get-CsGroupPolicyAssignment” cmdlet primarily returns all the group policy assignments with some optional parameters to filter the results.    

  1. Primarily, list all the policy-assigned groups by running the following command. 
Get-CsGroupPolicyAssignment 
Group Policy Assignments Using Microsoft Teams PowerShell

2. However, you can also retrieve all the policies assigned to a particular group using the below cmdlet. 

Get-CsGroupPolicyAssignment -GroupId e050ce51-54bc-45b7-b3e6-c00343d31274 

Here the cmdlet is mentioned with group ID so that retrieving only the policy assignments of that particular group. 

3.Also, you can list the groups based on their policy type by executing the below command.   

Get-CsGroupPolicyAssignment -PolicyType TeamsMeetingPolicy 

In this case, the policy type is mentioned as TeamsMeetingPolicy. Hence this cmdlet returns only the groups assigned with this policy.

Get Group Policy Assignments Using Microsoft Teams PowerShell Module


Remove Policy Assignment from a Group Using TPM

Remove the unnecessary policies found in your organization that are interrupting the ranking and slowing down the work progress. Most importantly, the removal of policies will update the ranking value of the same type policies where the policies in the list will be ranked consecutively after the removal. 

Run the following cmdlet to remove a specific group policy assignment in Microsoft 365 environment. 

Remove-CsGroupPolicyAssignment -PolicyType TeamsMeetingPolicy -GroupId f985e013-0826-40bb-8c94-e5f367076044 

The” Remove-CsGroupPolicyAssignment” cmdlet removes the given policy type in mentioned group ID.  

Remove Group Policy Assignment Using Teams PowerShell Module


Modify Group Policy Assignment Using Teams PowerShell Module

Directly altering the policy assignment ranking value is not possible in the Teams admin center. The policy assignments should be removed and newly assigned again with a new rank value to change the ranking. To take away this hassle, PowerShell lends you a hand with a simple and reusable cmdlet which is described below.   

Set-CsGroupPolicyAssignment -GroupId 566b8d39-5c5c-4aaa-bc07-4f36278a1b38 -PolicyType TeamsMeetingPolicy -PolicyName SupportCallPark -Rank 3 

The “Set-CsGroupPolicyAssignment” cmdlet can be used to make the following alterations in group policy assignments based on the given attributes. 

  1. Change policy assignment ranking. 
  2. Change the policy under the existing policy type. 
  3. Change policy assignment ranking value and policy of a given policy type. 

In this example, the policy is changed to ‘SupportCallPark’ policy, and the rank value is assigned to 3. 

NOTE: The “Set-CsGroupPolicyAssignment” cmdlet is currently not released for use. So, for now, you need to remove policies and add new policies to change the policy or ranking. But you can easily alter the policy settings once after the availability of this cmdlet.
 

New Group Policy Assignment Support in Teams PowerShell Module 

Microsoft rolls out group policy assignment support for additional policies in Teams PowerShell Module as a new update. So that admins can manage their groups in the M365 admin center and group policies in Teams PowerShell with a breeze. This feature will allow you to configure custom policies to groups for all Microsoft commercial licenses. With this update, dependency on global or direct policy assignments through manual methods is eliminated. In addition to the core policies such as meeting policies, calling policies, and messaging policies, the following policies are now expected to be available in Teams PowerShell by late May 2023.    

  • Application Access Policy 
  • Call Hold Policy 
  • Carrier Emergency Call Routing Policy 
  • Cortana Policy 
  • Dial Out Policy 
  • Education Assignments App Policy 
  • Emergency Calling Policy 
  • Enhanced Encryption Policy 
  • Events Policy 
  • External Access Policy 
  • Feedback Policy 
  • Files Policy 
  • IPPhone Policy 
  • Media Logging Policy 
  • Meeting Branding Policy 
  • Meeting Template Permission Policy 
  • Mobility Policy 
  • Notification And Feeds Policy 
  • Room Video Tele Conferencing Policy 
  • Synthetic Automated Call Policy 
  • Teams Branch Survivability Policy 
  • Template Permission Policy 
  •  VDI Policy 
  • Video Interop Service Policy 
  • Voice Routing Policy 
  • Voicemail Policy 

In conclusion, ultimately manage all group policies including Teams using PowerShell cmdlets. Take charge of the user-specific actions and security controls through this group policy assignment. Not only policies, you can also manage your Teams using PowerShell for effective administration. Rather than performing numerous repetitive tasks in the Teams admin center, automate them with just a few cmdlets in PowerShell.  

I hope that this blog provides you with deeper insights into group policy assignments using Teams PowerShell. For any clarifications feel free to reach us through comments. 

Source :
https://m365scripts.com/microsoft365/group-policy-assignments-using-microsoft-teams-powershell/

8 Best Network Scanning Tools & Software for 2023

BY KIHARA KIMACHIA
MAY 30, 2023

Network scanning tools are a critical investment for businesses in this era of increasing cyber threats. These tools perform an active examination of networks to identify potential security risks and help IT administrators maintain the health and security of their networks.

As businesses become more digital and interconnected, the demand for such tools has significantly increased. To help businesses sort through the plethora of these solutions available on the market, we’ve narrowed down the list to eight top products and their ideal use cases.

Here are our picks for the top network scanning software:

Top network scanning tools and software comparison

Vulnerability ScanningReal-time Network MonitoringPenetration TestingCompliance AssuranceIntegration with Other ToolsEase of UseRange of Vulnerabilities DetectedScalabilityPricing (Starting)
Burp Suite✔✘✔✔✔ModerateHighHigh$1,999/yr
Detectify✔✔✘✔✔HighModerateHigh$89/mo.
Intruder✔✔✔✔✔HighHighHigh$160/mo.
Manage Engine OpManager✔✔✘✔✔ModerateModerateHigh$245
Tenable Nessus✔✘✔✔✔HighHighHigh$4,990/yr
Pentest Tools✔✔✔✔✔ModerateHighModerate$72/mo.
Qualys VMDR✔✔✘✔✔ModerateHighHigh$6,368/yr
SolarWinds ipMonitor✔✔✘✔✔HighModerateHigh$1,570/yr

Jump to:

Burp Suite

Best for comprehensive web vulnerability scanning

PortSwigger BurpSuite dashboard
Source: portswigger.net

Burp Suite is a trusted tool among IT professionals for its robust web vulnerability scanning capabilities. It identifies security holes in web applications and is particularly well-suited for testing complex applications.

Pricing

The vendor has three enterprise pricing options as follows:

  • Pay as you scan: This tier starts at $1,999 per year plus $9 per hour scanned. It includes unlimited applications and users.
  • Classic: This tier is priced at $17,380 per year and includes 20 concurrent scans, unlimited applications and unlimited users.
  • Unlimited: This is the superior plan and is priced at $49,999 per year. It includes unlimited concurrent scans, applications, and users.

Features

  • Out-of-band Application Security Testing (OAST) added to dynamic scans for accurate identification of vulnerabilities.
  • Easy setup with point-and-click scanning or trigger via CI/CD.
  • Recurring scanning options for daily, weekly, or monthly scans.
  • Out-of-the-box configurations for fast crawl or critical vulnerability audits.
  • API security testing for increased coverage of microservices.
  • JavaScript scanning to uncover more attack surfaces in Single Page Applications (SPAs).
  • Scalable scanning with the ability to adjust the number of concurrent scans.
  • Custom configurations available, including crawl maximum link depth and reported vulnerabilities.
  • Burp Scanner, a trusted dynamic web vulnerability scanner used by over 16,000 organizations.
  • Integration with major CI/CD platforms such as Jenkins and TeamCity.
  • API-driven workflow for initiating scans and obtaining results via the REST API.
  • Integration with vulnerability management platforms for seamless scanning and security reporting.
  • Burp extensions allow customization of Burp Scanner to meet specific requirements.
  • Multiple deployment options including interactive installer and Kubernetes deployment.
  • Integration with bug tracking systems like Jira with auto ticket generation and severity triggers.
  • GraphQL API for initiating, scheduling, canceling, and updating scans.
  • Role-based access control for multi-user functionality and control.
  • Compatible configurations from Burp Suite Pro can be manually integrated into the Enterprise environment.
  • Reporting features include graphical dashboards, customizable HTML reports, scan history metrics, intuitive UI, rich email reporting, security posture graphing, aggregated issue reporting, and compliance reporting for PCI DSS and OWASP Top 10.

Pros

  • Extensive vulnerability detection.
  • Can handle complex web applications.
  • Integration with popular CI/CD tools.

Cons

  • Steep learning curve for beginners.
  • Relatively higher pricing.

Detectify

Best for ease of use and automation

Detectify dashboard
Source: detectify.com

Detectify is a fully automated External Attack Surface Management (EASM) solution powered by a world-leading ethical hacker community. It can help map out a company’s security landscape and find vulnerabilities that other scanners may miss​.

Pricing

The vendor has several pricing options as follows:

  • The full EASM package comes with a 2-week free trial. Pricing is custom and based on the number of domains, sub-domains, and web applications of the attack surface.
  • For organizations with a small attack surface, the vendor offers two pricing tiers that also come with a free 2-week trial:
    • Surface Monitoring: Pricing starts from $289 per month (billed annually). This package includes up to 25 subdomains.
    • Application Scanning: Pricing starts from $89 per month per scan profile (billed annually).

Features

The features of the full EASM solution are:

  • Continuous 24/7 coverage for discovering and monitoring your modern tech stack.
  • Crawling and fuzzing engine that surpasses traditional DAST scanners.
  • Ability to monitor large enterprise products and protect sensitive organizational data.
  • Accurate results with 99.7% accuracy in vulnerability assessments through payload-based testing.
  • SSO, API access, automatic domain verification, custom modules, and attack surface custom policies.
  • Identify risks before they are exploited by enriching assets with critical information like open ports, DNS record types, and technologies.
  • Integrates with popular tools such as Slack, Jira, and Splunk, and comes with an API that allows users to export results in the manner that best suits their workflows.

Pros

  • Simple and clean interface, easy to use.
  • Continuous automatic updates and scans.
  • Customizable reports and notifications.

Cons

  • Limited manual testing capabilities.
  • May generate false positives.

Intruder

Best for cloud-based network security

Intruder dashboard
Source: intruder.io

Intruder is a powerful cloud-based network security tool that helps businesses prevent security breaches by automating routine security checks. Each threat found is classified according to severity and a remediation plan proposed.

Pricing

  • Pricing is based on the number of applications and infrastructure targets with three pricing tiers: Essential, Pro and Premium. The Pro plan comes with a 14-day free trial.
  • Example pricing for 1 application and 1 infrastructure target is as follows:
    • Essential: $160 per month, billed annually.
    • Pro: $227 per month, billed annually.
    • Premium: From $3,737 per year.

Features

  • Easy-to-use yet powerful online vulnerability tool.
  • Comprehensive risk monitoring across your stack, including publicly and privately accessible servers, cloud systems, websites, and endpoint devices.
  • Detection of vulnerabilities such as misconfigurations, missing patches, encryption weaknesses, and application bugs, including SQL injection, Cross-Site Scripting, and OWASP Top 10.
  • Ongoing attack surface monitoring with automatic scanning for new threats and alerts for changes in exposed ports and services.
  • Intelligent results that prioritize actionable findings based on context, allowing you to focus on critical issues like exposed databases.
  • Compliance and reporting with high-quality reports to facilitate customer security questionnaires and compliance audits such as SOC2, ISO27001, and Cyber Essentials.
  • Continuous penetration testing by security professionals to enhance coverage, reduce the time from vulnerability discovery to remediation, and benefit from vulnerability triage by certified penetration testers.
  • Seamless integration with your technical environment, with no lengthy installations or complex configurations required.

Pros

  • Cloud-based, eliminating the need for on-site servers.
  • Comprehensive vulnerability coverage.
  • Automated, regular security checks.

Cons

  • Dependency on automated scanning engines may result in occasional false positives or false negatives.

ManageEngine OpManager

Best for real-time network monitoring

ManageEngine OpManager dashboard
Source:manageengine.com

ManageEngine OpManager is a comprehensive network monitoring application, capable of providing intricate insights into the functionality of various devices such as routers, switches, firewalls, load balancers, wireless LAN controllers, servers, virtual machines, printers, and storage systems. This software facilitates in-depth problem analysis to identify and address the core source of network-related issues.

Pricing

The vendor offers three editions with starting prices as follows:

  • Standard: $245 for up to 10 devices.
  • Professional: $345 for up to 10 devices.
  • Enterprise: $11,545 for 250 up to 250 devices.

Features

  • Capable of monitoring networks using over 2,000 performance metrics, equipped with user-friendly dashboards, immediate alert systems, and intelligent reporting features.
  • Provides crucial router performance data including error and discard rates, voltage, temperature, and buffer statistics.
  • Enables port-specific traffic control and switch port mapping for device identification.
  • Continuous monitoring of WAN link performance, latency, and availability, leveraging Cisco IP SLA technology.
  • Active monitoring of VoIP call quality across WAN infrastructure, facilitating the troubleshooting of subpar VoIP performance.
  • Automatic generation of L1/L2 network mapping, aiding in the visualization and identification of network outages and performance issues.
  • Provides monitoring for both physical and virtual servers across various operating systems such as Windows, Linux, Solaris, Unix, and VMware.
  • Detailed, agentless monitoring of VMware-virtualized servers with over 70 VMware performance monitors.
  • Utilizes WMI credentials to monitor Microsoft Hyper-V hosts and guest performance with over 40 in-depth metrics.
  • Enables monitoring and management of Host, VMs, and Storage Repositories of Citrix Hypervisor, providing the necessary visibility into their performance.
  • Allows for monitoring and management of processes running on discovered devices through SNMP/WMI/CLI.
  • Uses protocols like SNMP, WMI, or CLI for monitoring system resources and gathering performance data.
  • Provides immediate notifications on network issues via email and SMS alerts.
  • Facilitates the orchestration and automation of initial network fault troubleshooting steps and maintenance tasks.
  • Provides a centralized platform for identifying network faults, allowing for visualization, analysis, and correlation of multiple monitor performances at any instant.
  • Enables network availability, usage trend, and performance analysis with over 100 ready-made and customizable reports.
  • Employs a rule-based approach for syslog monitoring to read incoming syslogs and assign alerts.
  • Includes a suite of OpManager’s network monitoring tools to assist in first and second-level troubleshooting tasks.

Pros

  • In-depth network monitoring.
  • Easy-to-understand performance dashboards.
  • Supports both physical and virtual servers.

Cons

  • May be complex for beginners.
  • Cost can quickly escalate based on number of devices.

Tenable Nessus

Best for vulnerability analysis

Tenable Nessus dashboard
Source: tenable.com

Tenable Nessus is a vulnerability assessment tool that enables organizations to actively detect and rectify vulnerabilities throughout their ever-evolving attack surface. It is formulated to evaluate contemporary attack surfaces, expanding beyond conventional IT assets to ensure the security of cloud infrastructure and provide insights into internet-connected attack surfaces.

Pricing

  • Nessus offers a free 7-day trial. Customers can scan up to 32 IPs per scanner during the trial period.
  • After the trial, the product is available at a starting fee of $4,990 per year for an unlimited number of IPs per scanner.
  • Nessus Enterprise pricing is dependent on business requirements.

Features

  • Evaluates contemporary attack surfaces, extends beyond conventional IT assets, and provides insights into internet-connected environments.
  • Built with an understanding of security practitioners’ work, aiming to make vulnerability assessment simple, intuitive, and efficient.
  • Provides a reporting feature that prioritizes the top ten significant issues.
  • Nessus is deployable on a range of platforms, including Raspberry Pi, emphasizing portability and adaptability.
  • Ensures precise and efficient vulnerability assessment.
  • Offers visibility into your internet-connected attack environments.
  • Ensures the security of cloud infrastructure before deployment.
  • Focuses on the most significant threats to enhance security efficiency.
  • Provides ready-to-use policies and templates to streamline vulnerability assessment.
  • Allows for customization of reports and troubleshooting procedures.
  • Provides real-time results for immediate response and rectification.
  • Designed for straightforward and user-friendly operation.
  • Provides an organized view of vulnerability assessment findings for easy interpretation and analysis.

Pros

  • Broad vulnerability coverage.
  • Easy integration with existing security systems.
  • User-friendly interface.

Cons

  • Relatively higher pricing.

Pentest Tools

Best for penetration testing

Pentest Tools dashboard
Source: pentest-tools.com

Pentest Tools is a suite of software designed to assist with penetration testing. Pentest Tools provides the necessary capabilities to effectively carry out penetration tests, offering insights into potential weak points that may be exploited by malicious actors.

Pricing

The vendor offers four pricing plans as follows:

  • Basic: $72 per month, billed annually, for up to 5 assets and up to 2 parallel scans.
  • Advanced: $162 per month, billed annually, for up to 50 assets and up to 5 parallel scans.
  • Teams: $336 per month, billed annually, for up to 500 assets and up to 10 parallel scans.
  • Enterprise: For more than 500 assets and more than 10 parallel scans, plan pricing varies.

Features

  • Initially built on OpenVAS, now includes proprietary technology to assess network perimeter and evaluate a company’s external security posture.
  • Uses proprietary modules, like Sniper: Auto Exploiter, for a comprehensive security scan.
  • Provides a simplified and intuitive interface for immediate scanning.
  • Conducts in-depth network vulnerability scans using over 57,000 OpenVAS plugins and custom modules for critical CVEs.
  • Includes a summarized report of vulnerabilities found, their risk rating, and CVSS score.
  • Each report offers recommendations for mitigating detected security flaws.
  • Prioritizes vulnerabilities based on risk rating to optimize manual work and time.
  • Generates customizable reports with ready-to-use or custom templates.
  • Provides a complete view of “low hanging fruit” vulnerabilities, enabling focus on more advanced tests.
  • Allows testing of internal networks through a ready-to-use VPN, eliminating the need for time-consuming scripts and configurations.
  • Identifies high-risk vulnerabilities such as Log4Shell, ProxyShell, ProxyLogon, and others.
  • Assists in running vulnerability assessments necessary to comply with various standards like PCI DSS, SOC II, HIPAA, GDPR, ISO, the NIS Directive, and others.
  • Facilitates thorough infrastructure tests, detecting vulnerabilities ranging from weak passwords to missing security patches and misconfigured web servers.
  • Third-party infrastructure audit that’s useful for IT services or IT security companies, providing reports for client assurance on implemented security measures.

Pros

  • Broad coverage of penetration testing scenarios.
  • Easy to use, with detailed reports.
  • Regular updates and enhancements.

Cons

  • Proprietary technology can also limit interoperability with other tools or platforms.
  • New users may experience a steep learning curve.

Qualys VMDR

Best for cloud security compliance

Qualys VMDR dashboard
Source: qualys.com

Qualys VMDR is a top choice for businesses looking for cloud-based network security software. It provides automated cloud security and compliance solutions, allowing businesses to identify and fix vulnerabilities.

Pricing

  • Prospective customers can try out the tool for free for 30 days.
  • Pricing starts at $199 per asset with a minimum quantity of 32 (i.e., $6,368 total starting cost).
  • Flexible pricing for larger packages based on business needs.

Features

  • Qualys is a strong solution for businesses seeking cloud-based network security software, providing automated cloud security and compliance solutions.
  • Utilizes TruRisk™ to quantify risk across vulnerabilities, assets, and asset groups, enabling proactive mitigation and risk reduction tracking.
  • Automates operational tasks for vulnerability management and patching with Qualys Flow, saving valuable time.
  • Leverages insights from over 180,000 vulnerabilities and 25+ threat sources to provide preemptive alerts on potential attacks with the Qualys Threat DB.
  • Detects all IT, OT, and IoT assets for a comprehensive, categorized inventory with detailed information such as vendor lifecycle.
  • Automatically identifies vulnerabilities and critical misconfigurations per Center for Internet Security (CIS) benchmarks, by asset.
  • Integrates with ITSM tools like ServiceNow and Jira to automatically assign tickets and enable orchestration of remediation, reducing Mean Time To Resolution (MTTR).

Pros

  • Cloud-based, reducing on-premise hardware needs.
  • Comprehensive vulnerability and compliance coverage.
  • Powerful data analytics capabilities.

Cons

  • Can be complex for small businesses.
  • Pricing is high and can be prohibitive for smaller organizations.

SolarWinds ipMonitor

Best for large-scale enterprise networks

SolarWinds ipMonitor dashboard
Source:solarwinds.com

SolarWinds ipMonitor is an established network monitoring solution ideal for monitoring servers, VMware hosts, and applications on large-scale enterprise networks. It offers deep performance insights and customizable reports.

Pricing

SolarWinds ipMonitor has three pricing editions, each with a 14-day free trial: 

  • 500 monitors for $1,570
  • 1000 monitors for $2,620
  • 2500 monitors for $5,770

Features

  • The monitoring tool provides over a dozen notification types including alerts via email, text message, or directly to Windows Event Log files.
  • Facilitates the monitoring of common ports with key protocols.
  • Ensures IT environment functionality by continuously monitoring database availability.
  • Enhances end user network experience monitoring capabilities.
  • Offers monitoring of network equipment health in tandem with network infrastructure.
  • Confirms the ability of a web server to accept incoming sessions.
  • Provides critical insights into the overall IT environment.
  • Offers an affordable tool for network monitoring.
  • Utilizes VM ESXi host monitors to track the health and performance of your virtual environment.
  • Enables monitoring of Windows services and applications..

Pros

  • Extensive scalability for large networks.
  • Deep insights and comprehensive reporting.
  • Wide range of integrated applications.

Cons

  • Can be overly complex for smaller networks.
  • The pricing model may not suit smaller businesses.

Key features of network scanning tools and software

Vulnerability scanning is central to all network scanning tools, but other features, such as real-time monitoring, penetration testing, and integrability, should not be overlooked.

Vulnerability scanning

This is the most critical feature buyers typically look for in network scanning tools. Vulnerability scanning helps identify potential security threats and weak spots within the network. 

The tools do this by scanning the network’s devices, servers, and systems for known vulnerabilities such as outdated software, open ports, or incorrect configurations. 

This feature matters because it provides an overview of the network’s security posture, enabling users to take corrective measures promptly.

Real-time network monitoring

Real-time network monitoring allows for continuous observation of the network’s performance, detecting any issues or anomalies as they occur. 

This feature is vital because it can significantly reduce downtime and address performance issues before they impact business operations.

Penetration testing

Penetration testing (or pentesting) simulates cyberattacks on your network to test the effectiveness of your security measures and identify potential vulnerabilities that may not be detectable through standard vulnerability scanning. 

Penetration testing is essential for businesses as it offers a more proactive approach to cybersecurity than standard vulnerability scans.

Compliance assurance

Compliance assurance ensures that the organization’s network aligns with various regulatory standards, such as HIPAA for healthcare or PCI DSS for businesses that handle credit card information.

Compliance assurance is critical because non-compliance can result in hefty fines and damage to the company’s reputation.

Integration with other tools

Integration capabilities are an often overlooked but essential feature of network scanning tools. The ability to integrate with other IT management and security tools allows for a more streamlined and efficient workflow.

For example, integrating a network scanning tool with a ticketing system could automatically create a ticket when a vulnerability is detected.

This feature is vital as it enables businesses to enhance their overall IT infrastructure management and improve response times to potential threats.

How to choose the best network scanning software for your business

Selecting the best network scanning tool for your business involves several key considerations:

  1. Identify your needs: The first step is to understand what you need from a network scanning tool. Do you require real-time network monitoring, pentesting, compliance assurance, or more? The type of network you’re operating and the size of your business can heavily influence your needs.
  2. Consider the ease of use: The usability of the software is an important factor depending on the size and expertise of your IT team. If it’s too complex, it may be challenging for your team to use effectively. Look for software that has a user-friendly interface and offers good customer support.
  3. Examine the features: Look for software that offers the features that match your specific requirements. If you’re unsure what features you might need, consulting with an IT professional can be beneficial.
  4. Evaluate scalability: Your business is likely to grow, and so will your network. The network scanning tool you choose should be able to scale along with your business without losing efficiency.
  5. Check for regular support and updates: Good network scanning software should provide reliable support and regular updates to address emerging security threats. Check whether the software is frequently updated and if technical support is readily available.
  6. Review pricing: Lastly, consider the pricing and your budget. Keep in mind that while some software might be more expensive, it could offer more features or better support, leading to better value for your business in the long run.

Frequently Asked Questions (FAQs)

What are the benefits of network scanning tools?

Network scanning tools offer a multitude of benefits, including:

  • Security enhancement: Network scanning tools identify vulnerabilities and security risks within a network, allowing businesses to address these issues proactively and bolster their security posture.
  • Compliance assurance: Many of these tools help ensure that your network aligns with various regulatory and industry standards, reducing the risk of non-compliance penalties.
  • Real-time monitoring: By providing real-time network monitoring, these tools allow for immediate detection and mitigation of issues, thereby reducing network downtime and improving performance.
  • Resource optimization: Network scanning can identify underutilized resources, aiding in more efficient resource allocation and cost savings.
  • Improved network management: With a thorough understanding of the network infrastructure, administrators can make more informed decisions regarding network planning and expansion.

Who should use network scanning software?

Network scanning software is beneficial for a variety of roles and industries, including:

  • Network administrators: These professionals can use network scanning tools to monitor and manage the health of the network, consistently optimizing its performance.
  • IT security professionals: These tools are crucial for IT security staff in identifying potential vulnerabilities and mitigating security risks.
  • Managed Service Providers (MSPs): MSPs can utilize network scanning tools to manage and monitor their clients’ networks, ensuring they are secure and comply with relevant regulations.
  • Regulated industries: Businesses within industries that must adhere to strict data security standards, such as healthcare, finance, and e-commerce, can benefit significantly from these tools to ensure compliance and protect sensitive data.

What are the types of network scanning?

Network scanning can be categorized into several types based on their function:

  • Port scanning: This type identifies open ports and services available on a network host. It can help detect potential security vulnerabilities.
  • Vulnerability scanning: This process involves identifying known vulnerabilities in the network, such as outdated software or misconfigurations, that could be exploited.
  • Network mapping: This type of scanning identifies the various devices on a network, their interconnections, and topology.
  • Performance scanning: This form of scanning monitors network performance, identifying potential issues that could affect the speed or reliability of the network.
  • Compliance scanning: This type checks the network’s compliance with certain regulatory or industry standards, helping avoid potential legal issues.

Methodology

The selection, review, and ranking of the network scanning tools in this list was carried out through a comprehensive and structured methodology, which involved several key steps: namely, requirement identification, market research, feature evaluation, user reviews and feedback, ease of use, pricing, and scalability.

By combining these steps, we have aimed to provide a balanced and comprehensive overview of the top network scanning tools of 2023, thereby enabling potential buyers to make an informed decision that best suits their specific needs and circumstances.

Bottom line: Managing vulnerabilities with network scanning tools

Network scanning tools are essential for any organization striving to maintain a secure and efficient IT environment. From identifying vulnerabilities to ensuring compliance and enhancing overall network performance, these tools play a pivotal role in successful network management.

The eight tools discussed in this article offer a variety of features and capabilities, catering to different needs and business sizes. However, choosing the right tool should be guided by an organization’s unique requirements, budget, and the tool’s ability to scale alongside the growth of the business.

By doing so, businesses can foster a more secure, compliant, and reliable IT network, boosting operational efficiency and business resilience.

Knowing your network’s vulnerabilities is just the beginning. Here are the best vulnerability management tools to keep your data locked up safe.

Source :
https://www.enterprisenetworkingplanet.com/security/network-scanning-tools/

ChatGPT vs. Bing Chat: Which AI chatbot should you use?

By Elena Alston · May 16, 2023

I’ve been using ChatGPT ever since OpenAI launched it in 2022. It’s helped me write meta descriptions for blog posts, create simple code snippets, and generate outlines. Heck, I’ve even used it to plan a trip to Portugal. 

Try Zapier’s new ChatGPT plugin

Learn more

But I’ve been keen to try out Microsoft’s new Bing AI chatbot to see if it lives up to the hype. With Bing Chat, you’re able to chat, compose content, generate images, and get summarized answers to complex questions—all in one interface. It’s supposed to be a far more advanced version of ChatGPT, so I was excited to see how their features stack up. 

Here are the main differences I discovered while comparing ChatGPT vs. Bing Chat. 

ChatGPT vs. Bing Chat at a glance

If you want free access to GPT-4 (OpenAI’s most advanced and more powerful language model), Bing Chat is currently the way to go. You can access GPT-4 via ChatGPT Plus, which is a paid subscription, but Bing Chat gives you free access via Microsoft Edge. Beyond that, here’s the main difference:

  • Bing Chat is built into Microsoft Edge, so it’s a more integrated, tailored way of searching for answers. That makes it a powerful research assistant.
  • ChatGPT—though a more isolated experience—can be accessed on any browser and has more powerful integrations and plugins. It’s better suited as a personal assistant than a research assistant.

I’ll walk through some of the core differences between ChatGPT and Bing Chat in depth in the coming sections, but here’s a quick breakdown of how they compare.

Bing ChatChatGPT
Language modelOpenAI’s GPT-4OpenAI’s GPT-3.5 (ChatGPT Plus: GPT-4)
PlatformIntegrated with Microsoft’s search engineStandalone website or API 
Internet accessCan perform web searches and offer links and recommendations Browsing feature for ChatGPT Plus users
Image generationCan generate creative content, including images using DALL·ECan only generate text
Best used asA research assistantA personal assistant
Usage limitsUsers get to ask 20 chats per session and 200 total chats per dayUnlimited conversations per day; ChatGPT Plus users get 25 GPT-4 messages every 3 hours 
PricingFreeFree; ChatGPT Plus available for $20/month

Bing Chat is part of search, while ChatGPT is an isolated interface

Both ChatGPT and Bing Chat use OpenAI’s language models, which means that, for the most part, they generate very similar results. 

The biggest difference between them is that Bing Chat is also powered by Microsoft’s Prometheus, a model that integrates Bing Search with the AI tool.     

Marketed as a “co-pilot” for the web, Bing Chat distills the latest information from across the web and summarizes it when answering your prompts. It even cites its sources and generates a list of relevant links (as well as pulling in visuals). This is what it looks like within the Bing Chat web interface.

Bing Chat telling the weather in London

ChatGPT, on the other hand, doesn’t pull in current results from the internet as it’s only been trained on information up until 2021. There’s a simple workaround, though: you can access OpenAI’s native web browser plugin, available on ChatGPT Plus. 

The Web Browsing option in ChatGPT

The web browser can look through web results and share them with you like Bing can, but I’ve found that it doesn’t integrate visuals like Bing does. The result is a more text-heavy experience, but no less effective. 

ChatGPT telling the weather in London

The downside is that when it comes to researching facts, news stories, or historical events, ChatGPT doesn’t always cite its sources. It doesn’t seem to have a problem citing weather reports, but for other information, it can be a bit hit or miss—unless you specifically instruct it to provide sources. (Which, by the way, I’d recommend, given its tendency to hallucinate.)  

Asking ChatGPT to cite its sources

In addition to being more reliable with its citations, Bing offers recommendations on what to search for next. 

Bing Chat's suggestions for what to search next

And, if you scroll down on the chat page, Microsoft will return you to its regular search page, with a link to the most recent question you asked the chat. 

Bing Chat showing your recent chats in the search

ChatGPT, on the other hand, feels more mechanical: it doesn’t offer follow-up recommendations, and the web browser you’re using ChatGPT with will have no memory of what you’ve been asking it. 

As a whole, Bing AI feels a lot more like a search tool that’ll summarize complex answers for you—giving you the sources if you want to dig deeper into any topic. All without having to search through multiple pages yourself. 

You get that same ease with ChatGPT, but it’s a much more isolated experience—it definitely feels like a chatbot, not a search tool. 

Bing is integrated into a web browser, which allows for more tailored outputs based on what you’re doing

Bing is integrated into a sidebar, called Discover, on the Microsoft Edge browser, and it includes a few features, called Chat, Composition, and Insights. 

The Discover sidebar in Microsoft Edge

Chat

You can chat with Bing Chat directly from the sidebar, without having to go to the Bing Chat webpage. The best part is that when you’re on a website full of information, it answers questions from that page contextually. 

Reading a complex article and want the key takeaways? Done. Need to understand a complex concept in simpler terms? Done. 

Bing Chat showing takeaways from the current web page you're on

This can be pretty helpful when you need an AI assistant while going through information-dense internet research. 

You can still do this with ChatGPT Plus—just feed it a link and ask it to summarize the information—but it’s not seamlessly integrated into the same page you’re on. 

ChatGPT summarizing an article based on a link

The difference just depends on how you like to search for information. But if you don’t mind doing your research in Microsoft Edge, Bing AI is hard to beat for a tailored AI experience.

Insights

Bing has an Insights tab that’ll give you even more information about the page you’re on. It surfaces things like a Q&A, key points, page topics, and related articles. 

The Bing Insights feature

Scroll all the way down, and you can also get a quick overview of analytics about the website you’re visiting (like domain name, hosting service, and even traffic rank). This is something that ChatGPT doesn’t have, as it’s primarily focused on text generation. 

Composition

With ChatGPT, you have to be extremely specific in your prompts; otherwise, the output will be pretty vague and most likely won’t tick all your boxes. 

ChatGPT offering a generic suggestion

Bing’s Composition feature steers you more toward getting the specific output you want, by giving you ready-made options. Inside the text box, you can write out your prompt, set the tone you’re after, select the format (blog post, email, etc.), and set the length. It feels more like an AI writing generator in that way.

Bing AI's composition feature

This is pretty handy if you’re not sure how to create prompts that will get you what you’re after, but you can just tell ChatGPT these same things in your prompt, and it’ll do a decent job. 

ChatGPT has more powerful integrations and plugins, transforming it into a highly efficient assistant

While Bing Chat is a powerful search tool and a more sophisticated web browser, ChatGPT offers a whole suite of plugins that let you combine AI with other apps to unlock more varied use cases. 

ChatGPT plugins

For example, with the Expedia plugin, I just tell ChatGPT about a trip I’m thinking of booking, and it’ll immediately surface the cheapest flights it can find via the travel site, along with the link, airport details, duration of flight, and most importantly, the pricing.  

Using the ChatGPT Expedia plugin

It’s so much easier than going through travel sites yourself, adjusting filters, and comparing sites side-by-side. (The hassle.)

Not only that, but the AI will also offer lodgings or other area-specific activities for you to explore. It’s a completely different ballgame compared to its web browser plugin, which refuses to offer any follow-up recommendations. 

ChatGPT offering more suggestions from the Expedia plugin

The best part is you can install a number of ChatGPT plugins to work in tandem. For example, you can ask the AI for a recipe recommendation, get an accurate count of calories (using the Wolfram plugin), and then ask it to create a shopping list (with the Instacart plugin). 

Using the Wolfram and Instacart plugins on ChatGPT

It’s practically like having a personal assistant—ideal for those who hate planning ahead for anything. (Ahem.)

Travel and food aside, you can also install the Zapier plugin to automate workflows directly inside the ChatGPT interface. Need the AI to write an email, then save it as a draft? It’ll do it within a matter of seconds. 

Zapier's ChatGPT plugin

ChatGPT also integrates with Zapier outside of the plugin, so you can connect it to thousands of other apps and access ChatGPT from the apps you use most. Here are some examples of tasks you can automate.

Create Notion tasks using ChatGPT conversations generated from new Slack reactions

Try it

  • Slack logo
  • ChatGPT logo
  • Notion logo

Slack, ChatGPT, Notion

Slack + ChatGPT + NotionMore details

Start a conversation with ChatGPT when a prompt is posted in a particular Slack channel

Try it

  • Slack logo
  • ChatGPT logo
  • Slack logo

Slack, ChatGPT

Slack + ChatGPTMore details

Zapier is the leader in no-code automation—integrating with 5,000+ apps from partners like Google, Salesforce, and Microsoft. Build secure, automated systems for your business-critical workflows across your organization’s technology stack. Learn more.

Bing AI can generate images using DALL·E, but ChatGPT is better at generating long-form content

One of the best—and most surprising—things about Bing is that it can generate images for you inside the chat function. That’s without you having to go through another AI image generator, so you can literally do everything—search, create copy, get images—all in the same interface. 

Bing Image Creator

Powered by OpenAI’s DALL·E, you can just ask it to create a pic, and it takes a matter of seconds to deliver. 

Imagine you’re a travel writer. This could be a workflow you follow: You ask Bing about popular spots in New York using the chat feature. Then you ask the composition feature to create a blog post about New York. After that, you can ask Bing to create a blog hero image. That’s not a super nuanced example, but you get the gist.

Bing Image Creator making a picture of New York in a cartoon style

In that regard, ChatGPT can’t really compare, as it’s purely text-based. 

But while we’re talking about strengths, ChatGPT is a lot better at providing longer-form content like articles or case studies. No matter how I tweaked the prompt, whenever I asked Bing to create a 1,000-word blog post, it repeatedly ignored those instructions and created a piece under 500 words. 

ChatGPT doesn’t have that problem. It’s a good listener. 

ChatGPT writing a long-form article

Bing Chat vs. ChatGPT: Which should you use?

Both ChatGPT and Bing can be handy writing tools and informative chatbots—but the better one depends on your actual use case. 

If you want a powerful research tool that’s integrated with a web browser (and which shines in terms of in-depth page insights, image generation, and citing reputable sources), Bing Chat is your best bet. 

If, however, you want to have an AI-powered personal assistant that can perform actions for you in different apps, there’s no contest: ChatGPT wins  because of its suite of plugins. 

The best way to know what works for you? Try them both out. 

Related reading:


Source :
https://zapier.com/blog/chatgpt-vs-bing-chat/

W3 Eden Addresses Authenticated Stored XSS Vulnerability in Download Manager WordPress Plugin

István Márton – May 22, 2023

On April 25, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for a stored Cross-Site Scripting (XSS) vulnerability in W3 Eden’s Download Manager plugin, which is actively installed on more than 100,000 WordPress websites, making it one of the most popular download management plugins. The vulnerability enables threat actors with contributor-level permissions or higher to inject malicious web scripts into pages using the plugin’s shortcode.

All Wordfence Premium, Wordfence Care, and Wordfence Response customers, as well as those still using the free version of our plugin, are protected against any exploits targeting this vulnerability by the Wordfence firewall’s built-in Cross-Site Scripting protection.

We contacted W3 Eden on April 25, 2023, and promptly received a response. After providing full disclosure details, the developer released a patch on May 1, 2023. We would like to commend the W3 Eden development team for their prompt response and timely patch.

We urge users to update their sites with the latest patched version of Download Manager, version 3.2.71 at the time of this writing, as soon as possible.

Vulnerability Summary from Wordfence Intelligence

Description: Download Manager <= 3.2.70 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Affected Plugin: Download Manager
Plugin Slug: download-manager
Affected Versions: <= 3.2.70
CVE ID: CVE-2023-2305
CVSS Score: 6.4 (Medium)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Researcher/s: Lana Codes
Fully Patched Version: 3.2.71

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpdm_members’, ‘wpdm_login_form’, ‘wpdm_reg_form’ shortcodes in versions up to, and including, 3.2.70 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Technical Analysis

Download Manager is a plugin designed to allow WordPress users to manage, track and control file downloads. It provides a shortcode ([wpdm_members]) that lists the authors and the number of files they have added when added to a WordPress page. However, insecure implementation of the plugin’s shortcode functionality allows for the injection of arbitrary web scripts into these pages. Examining the code reveals that the members method in the User class did not adequately sanitize the user-supplied ‘sid’ input, and then loads the members.php view file, where it also did not adequately escape ‘sid’ output. This makes it possible to inject attribute-based Cross-Site Scripting payloads via the ‘sid’ attribute.

1011classUser{
173174175176177178179180functionmembers($params= array()){    $sid= isset($params['sid']) ? $params['sid'] : '';    update_post_meta(get_the_ID(), '__wpdm_users_params'. $sid, $params);    ob_start();    includeTemplate::locate("members.php", __DIR__.'/views');    returnob_get_clean();}

The members method in the User class

101112<div class="w3eden"id="wpdm-authors<?php echo isset($params['sid'])?"-{$params['sid']}":""; ?>">    <?php $this->listAuthors($params); ?></div>

The members.php view file

There are two other shortcodes, a login form shortcode ([wpdm_login_form]) and a registration form shortcode ([wpdm_reg_form]), that add forms to a WordPress site. However, the insecure implementation of these two shortcode functions, similar to the previous example, also allows arbitrary web scripts to be inserted into these pages. Examining the code reveals that the functions of both forms do not adequately sanitize the user-supplied ‘logo’ input, and in the view files these ‘logo’ outputs are not adequately escaped.

1617classLogin{
8182838485868788functionform($params= array()){    global$current_user;    if(!isset($params) || !is_array($params)) $params= array();    if(isset($params) && is_array($params))        extract($params);

The form method in the Login class

6789101112<div class="w3eden">    <div id="wpdmlogin"<?php if(wpdm_query_var('action') == 'lostpassword') echo'class="lostpass"'; ?>>        <?php if(isset($params['logo']) && $params['logo'] != ''&& !is_user_logged_in()){ ?>            <div class="text-center wpdmlogin-logo">                <a href="<?php echo home_url('/'); ?>"><img alt="Logo"src="<?php echo $params['logo'];?>"/></a>            </div>        <?php } ?>

The login-form.php view file

1718classRegister{
87888990919293949596functionform($params= array()){    if(!get_option('users_can_register')) return\WPDM\__\Messages::warning(__("User registration is disabled", "download-manager"), -1);    if(!isset($params) || !is_array($params)) $params= array();        ...        if(!isset($params['logo'])) $params['logo'] = get_site_icon_url();

The form method in the Register class

345678910111213<div class="w3eden">    <div class='w3eden'id='wpdmreg'>        <?php        if(get_option('users_can_register')){            //LOGO            if(isset($params['logo']) && $params['logo'] != ''&& !isset($nologo)){ ?>            <div class="text-center wpdmlogin-logo">                <a href="<?php echo esc_url(home_url('/')); ?>"><img src="<?php echo $params['logo'];?>"/></a>            </div>            <?php } ?>

The reg-form.php view file

These make it possible for threat actors to carry out stored XSS attacks. Once a script is injected into a page or post, it will execute each time a user accesses the affected page. While this vulnerability does require that a trusted contributor account is compromised, or a user be able to register as a contributor, successful threat actors could steal sensitive information, manipulate site content, inject administrative users, edit files, or redirect users to malicious websites which are all severe consequences.

Disclosure Timeline

April 25, 2023 – Wordfence Threat Intelligence team discovers the stored XSS vulnerability in Download Manager and initiates responsible disclosure.
April 27, 2023 – We get in touch with the development team at W3 Eden and send full disclosure details.
May 1, 2023 – The fully patched version, 3.2.71, is released.
May 3, 2023 – The vendor notified Wordfence that they released the patch.
May 3, 2023 – Wordfence confirms the fix addresses the vulnerability.

Conclusion

In this blog post, we have detailed a stored XSS vulnerability within the Download Manager plugin affecting versions 3.2.70 and earlier. This vulnerability allows authenticated threat actors with contributor-level permissions or higher to inject malicious web scripts into pages that execute when a user accesses an affected page. The vulnerability has been fully addressed in version 3.2.71 of the plugin.

We encourage WordPress users to verify that their sites are updated to the latest patched version of Download Manager.

All Wordfence users, including those running Wordfence Premium, Wordfence Care, and Wordfence Response, as well as sites still running the free version of Wordfence, are fully protected against this vulnerability.

If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.

For security researchers looking to disclose vulnerabilities responsibly and obtain a CVE ID, you can submit your findings to Wordfence Intelligence and potentially earn a spot on our leaderboard.

Did you enjoy this post? Share it!

Source :
https://www.wordfence.com/blog/2023/05/w3-eden-addresses-authenticated-stored-xss-vulnerability-in-download-manager-wordpress-plugin/

Top 20 Open Source Cyber Security Monitoring Tools in 2023

As cyber threats continue to evolve, security professionals require reliable tools to defend against security vulnerabilities, protect sensitive data, and maintain network security. Open source cyber security tools provide a cost-effective solution for individuals and organizations to combat these threats on-premises and with cloud security and mobile devices. Let’s consider the top 25 open-source cyber security monitoring tools in 2023 that help ensure continuous network and system performance monitoring.

Table of contents

What are the Top Cybersecurity Threats Today?

As cyber threats continue to evolve and become more sophisticated, organizations must stay informed and prepared to defend against a wide range of security risks.

Here are the top cybersecurity threats that businesses and individuals should be aware of today:

1. Phishing Attacks: Phishing attacks are a prevalent form of social engineering where cybercriminals use deceptive emails or websites to trick users into revealing sensitive information or installing malware. These attacks often target login credentials, financial information, and other personal data.

Altaro VM Backup

2. Ransomware: Ransomware is a type of malicious software that encrypts a victim’s files or locks their systems, demanding a ransom payment to restore access. Ransomware attacks can cause significant financial losses and operational disruptions for organizations.

3. Insider Threats: Insider threats refer to security risks posed by employees, contractors, or other individuals with authorized access to an organization’s systems and data. These threats can result from malicious intent or negligence, leading to data breaches or system compromises.

4. Supply Chain Attacks: Also known as third-party attacks or vendor risk, supply chain attacks target an organization’s suppliers, vendors, or partners to gain access to their systems and data. These attacks often exploit security vulnerabilities in the supply chain to compromise multiple organizations.

5. Distributed Denial of Service (DDoS) Attacks: DDoS attacks involve overwhelming a target’s network or system with a flood of traffic, rendering it inaccessible to legitimate users. DDoS attacks can cause severe downtime and service disruptions.

6. Advanced Persistent Threats (APTs): APTs are sophisticated, coordinated cyberattacks by well-funded threat actors or nation-state groups that target specific organizations for espionage, data theft, or sabotage. APTs often use advanced techniques and tactics to evade detection and maintain a long-term presence within a target’s network.

7. Zero-Day Exploits: Zero-day exploits are attacks that take advantage of previously unknown security vulnerabilities in software or systems. These vulnerabilities, also known as zero-day flaws, have no existing patches or fixes, making them particularly dangerous and challenging to defend against.

8. Internet of Things (IoT) Security: The increasing adoption of IoT devices and connected technologies has expanded the attack surface for cybercriminals. IoT devices are often vulnerable to cyber threats due to weak security measures, creating new risks for organizations and consumers.

9. Data Breaches: Data breaches occur when unauthorized individuals gain access to an organization’s sensitive data, such as customer information, financial records, or intellectual property. Data breaches can result in significant financial and reputational damage for organizations.

10. Cloud Security Threats: As more organizations migrate to cloud-based services, cloud security has become a critical concern. Threats in the cloud can arise from misconfigurations, weak authentication mechanisms, and vulnerabilities in cloud applications or infrastructure.

Benefits of Open-Source CyberSecurity tools

Open source cyber security monitoring tools offer numerous advantages over proprietary solutions, making them an attractive option for businesses, organizations, and individuals looking to enhance their security posture and perform effective security testing.

Here are some key benefits of using open-source tools for cyber security monitoring for monitoring services that pose security threats, even if you have another network monitoring system. Proper cybersecurity monitoring and access management are key to maintaining a secure environment.

Cost-Effectiveness

One of the most significant benefits of open-source cyber security tools is their cost-effectiveness. With no licensing fees or subscription costs, these free tools enable security teams to access powerful network monitoring solutions without breaking the bank.

This particularly benefits small businesses and startups with limited budgets, allowing them to allocate resources to other critical areas.

Customizability and Flexibility

Open-source network monitoring tools offer high customizability and flexibility, allowing security professionals to tailor the tools to their specific needs. This adaptability enables organizations to address unique security threats and vulnerabilities, ensuring a more robust security posture.

Additionally, the ability to integrate these tools with existing security infrastructure adds an extra layer of protection to network security.

Rapid Development and Updates

The open-source community is known for its rapid development and frequent updates. As new security threats and vulnerabilities emerge, open-source cyber security tools are often among the first to receive patches and updates.

This continuous monitoring and proactive response help organizations stay ahead of potential security risks and maintain a strong security posture.

Extensive Support and Collaboration

Open-source cyber security tools benefit from an extensive support network, comprising developers, users, and experts from around the world.

This collaborative environment fosters knowledge sharing, allowing security professionals to learn from one another and develop more effective security strategies.

Additionally, the availability of comprehensive documentation and online forums makes it easier for users to troubleshoot issues and enhance their understanding of network monitoring and security.

Improved Security and Transparency

With their source code openly available for inspection, open-source cyber security tools offer greater transparency than proprietary alternatives. This transparency allows security professionals and researchers to scrutinize the code for potential security vulnerabilities and ensure its integrity.

Moreover, the collaborative nature of the open-source community means that any identified issues are addressed quickly, further enhancing the overall security of these tools.

Platform Independence and Interoperability

Open-source network monitoring software often supports a wide range of operating systems, including Windows, macOS, and Linux, allowing organizations to deploy these tools across diverse environments.

This platform independence and interoperability help organizations ensure comprehensive network monitoring, regardless of the underlying infrastructure.

Top 25 Open Source Cyber Security Monitoring Tools in 2023

Note the following free cyber security monitoring tools in 2023 and the open-source list of solutions you can take advantage of and no free trial needed.

1. Wireshark: Network Protocol Analyzer

Wireshark is a widely-used network protocol analyzer that enables security teams to troubleshoot, analyze, and monitor network traffic in real-time to detect security issues. It is a defacto standard network monitoring tool.

command line interface data packets open source platform data breaches packet capture web apps network packets computer security experts solarwinds security event manager security scanning

By dissecting network protocols, Wireshark provides valuable insights into potential security risks and network vulnerabilities, allowing professionals to identify and resolve issues efficiently with the Wireshark network monitoring solution.

You can monitor a wide range of protocols, including TCP/IP, simple network management protocol, FTP, and many others. If you are looking for a network monitor this is it.

2. Snort: Network Intrusion Detection and Prevention System

Snort is a powerful open-source intrusion detection and prevention system (IDPS) that monitors network traffic and detects potential security threats.

It provides real-time traffic analysis, packet logging, and alerting capabilities, making it an essential tool for security auditing and network monitoring.

3. OSSEC: Host-Based Intrusion Detection System

OSSEC is a comprehensive host-based intrusion detection system (HIDS) that offers log analysis, file integrity checking, rootkit detection, and more.

It supports various operating systems, including Linux, Windows, and macOS, and helps security professionals monitor and analyze network protocols for potential security vulnerabilities.

4. Security Onion: Intrusion Detection and Network Security Monitoring Distribution

Security Onion is a Linux distribution specifically designed for intrusion detection, network security monitoring, and log management.

With a suite of powerful open-source tools, including Snort, Suricata, and Zeek, Security Onion provides a robust solution for security teams to monitor networks and detect security breaches.

5. Nmap: Network Scanning and Discovery Tool

Nmap is a versatile network scanning and discovery tool that helps security professionals identify network devices, open ports, and running services.

It is an essential network monitoring software for vulnerability management, penetration testing, and network inventory management.

6. Kismet: Wireless Network Detector, Sniffer, and Intrusion Detection System

Kismet is a wi fi security tool that detects, sniffs, and analyzes wireless networks. By monitoring wireless network traffic, Kismet identifies potential security risks, network vulnerabilities, and unauthorized users, making it an invaluable tool for wireless network security.

7. Suricata: High-Performance Network Intrusion Detection and Prevention Engine

Suricata is an open-source, high-performance network intrusion detection and prevention engine that provides real-time network traffic analysis, threat detection, and alerting.

Suricata enables security professionals to maintain network integrity and security by employing advanced threat defense and anomaly detection techniques.

8. Zeek (formerly Bro): Network Analysis Framework for Security Monitoring

Zeek, previously known as Bro, is a powerful network analysis framework that offers real-time insight into network traffic.

With its flexible scripting language and extensible plugin architecture, Zeek provides comprehensive visibility into network activity, enabling security teams to detect and prevent security threats.

9. OpenVAS: Vulnerability Scanning and Management Solution

OpenVAS is a comprehensive vulnerability scanning and management solution that helps security professionals identify, assess, and remediate security vulnerabilities.

With its extensive plugin library, OpenVAS ensures continuous monitoring and up-to-date vulnerability information, making it a critical tool for vulnerability management.

10. ClamAV: Open-Source Antivirus Engine

ClamAV is an open-source antivirus engine that detects trojans, viruses, and other malicious software.

It offers a command-line scanner, a graphical user interface (GUI) for Windows operating system, and integration with mail servers, ensuring that your systems are protected from security threats.

11. Fail2Ban: Log-Parsing Application to Protect Against Brute-Force Attacks

Fail2Ban is a log-parsing application that monitors log files for malicious activity, such as repeated failed login attempts. Fail2Ban bans the offending IP address when a potential attack is detected, effectively protecting your network from brute-force attacks and unauthorized access.

12. AlienVault OSSIM: Open-Source Security Information and Event Management Platform

AlienVault OSSIM is an open-source security information and event management (SIEM) platform that provides real-time event correlation, log analysis, and threat intelligence.

By integrating multiple security tools, OSSIM helps security teams maintain a unified user interface and enhance their overall security posture.

13. Cuckoo Sandbox: Automated Malware Analysis System

Cuckoo Sandbox is an open-source automated malware analysis system that enables security professionals to analyze suspicious files and URLs in a safe, isolated environment.

It provides detailed reports on malware behavior, including network traffic analysis, file system changes, and API traces, helping security teams identify and mitigate security risks.

14. Logstash: Log Processing and Management Tool

Logstash is part of the Elastic Stack (ELK Stack) and offers log processing and management capabilities.

It collects, parses, and stores log data from various sources, making it an essential tool for security professionals to monitor and analyze network activity, detect security breaches, and maintain system performance.

15. pfSense: Open-Source Firewall and Router Distribution

pfSense is an open-source firewall and router distribution based on FreeBSD. It offers a powerful and flexible network security, traffic shaping, and VPN connectivity solution.

With its extensive features and customization options, pfSense is ideal for securing web servers and internal networks.

16. ModSecurity: Open-Source Web Application Firewall

ModSecurity is an open-source web application firewall (WAF) providing real-time security monitoring and access control. It detects and prevents web attacks, protects sensitive data, and helps security professionals maintain compliance with industry standards and regulations.

17. AIDE (Advanced Intrusion Detection Environment): File and Directory Integrity Checker

AIDE is a file and directory integrity checker that monitors system files for unauthorized changes. It detects modifications, deletions, and additions, allowing security teams to maintain system integrity and prevent security breaches.

18. Graylog: Open-Source Log Management Platform

Graylog is an open-source log management platform that centralizes and analyzes log data from various sources.

Graylog helps security professionals detect security threats, identify network vulnerabilities, and maintain network security by providing comprehensive visibility into network activity.

19. Wazuh: Security Monitoring and Compliance Solution

Wazuh is a free, open-source security monitoring and compliance solution that integrates host-based and network-based intrusion detection systems, file integrity monitoring and security policy enforcement.

Wazuh’s centralized management and powerful analytics capabilities make it an essential tool for security teams to detect and respond to security threats.

20. T-Pot: Honeypot Platform

T-Pot is a platform combining multiple honeypots into a single, easy-to-deploy solution for cyber security monitoring. By simulating vulnerable systems and services, T-Pot attracts attackers and collects threat data, providing valuable insights into current attack trends and techniques.

Honorable mentions

Samhain: Host-Based Intrusion Detection System

Samhain is a host-based intrusion detection system (HIDS) that provides file integrity checking and log file monitoring. It detects unauthorized modifications, deletions, and additions, helping security professionals maintain system integrity and prevent security breaches.

SELKS: Network Security Management ISO with Suricata

SELKS is a live and installable network security management ISO based on Debian, focusing on a complete and ready-to-use Suricata IDS/IPS ecosystem. It offers a user-friendly interface and powerful analytics tools, making it an ideal choice for security teams to monitor networks and detect potential security threats.

Squid: Open-Source Web Proxy Cache and Forward Proxy

Squid is an open-source web proxy cache and forward proxy that improves web performance and security. By caching frequently-requested web content and filtering web traffic, Squid helps reduce bandwidth usage, enhance user privacy, and protect against web-based security threats.

YARA: Pattern-Matching Tool for Malware Researchers

YARA is a pattern-matching tool designed for malware researchers to identify and classify malware samples. By creating custom rules and signatures, YARA enables security professionals to detect and analyze malicious software, enhancing their understanding of current malware trends and techniques.

Arkime (formerly Moloch): Large-Scale, Open-Source, Indexed Packet Capture and Search System

Arkime is a large-scale, open-source, indexed packet capture and search system that provides comprehensive visibility into network traffic. It enables security professionals to analyze network protocols, detect security vulnerabilities, and identify potential security threats, making it an essential tool for network monitoring and security auditing.

Tips to Improve Your Cybersecurity Posture

Improving your cybersecurity posture is essential for safeguarding your organization from various cyber threats. Here are some practical tips to help enhance your cybersecurity defenses:

  1. Implement Regular Security Audits: Conducting routine security audits can help identify potential weaknesses in your organization’s cybersecurity infrastructure.
  2. This includes checking for outdated software, misconfigured settings, and other vulnerabilities that may expose your systems to attacks.
  3. Keep Software and Systems Updated: Regularly update your software, operating systems, and firmware to protect against known vulnerabilities and exploits.
  4. This includes applying security patches and updates as soon as they become available.
  5. Use Strong Authentication Mechanisms: Implement multi-factor authentication (MFA) for all critical systems and applications.
  6. MFA adds an extra layer of security by requiring users to provide additional verification, such as a one-time code or biometric authentication, in addition to their password.
  7. Encrypt Sensitive Data: Encrypt sensitive data both in transit and at rest to prevent unauthorized access. This includes using secure communication protocols, such as HTTPS and TLS, and implementing encryption solutions for data storage.
  8. Establish a Strong Password Policy: Enforce a robust password policy that requires users to create complex, unique passwords and update them regularly. Additionally, consider using a password manager to help users manage and store their passwords securely.
  9. Educate Employees on Cybersecurity Best Practices: Provide ongoing security awareness training to educate employees about common cyber threats, safe online practices, and how to recognize and report potential security incidents.
  10. Implement Network Segmentation: Divide your network into smaller segments, isolating critical systems and data from less secure areas. This can help prevent the spread of malware and limit the damage in case of a security breach.
  11. Regularly Backup Important Data: Regularly back up essential data and store copies offsite or in the cloud. This ensures that you can quickly recover from data loss or ransomware attacks.
  12. Utilize Endpoint Security Solutions: Deploy comprehensive endpoint security solutions to protect devices connected to your network.
  13. This includes antivirus software, firewalls, intrusion detection and prevention systems, and device management tools.
  14. Monitor and Analyze Network Traffic: Use network monitoring tools to analyze network traffic, detect anomalies, and identify potential security threats. Regular monitoring can help detect and respond to security incidents more effectively.
  15. Develop a Cybersecurity Incident Response Plan: Create a detailed incident response plan outlining the steps to take in a security breach. Regularly review and update the plan, and ensure that all employees are familiar with the procedures.
  16. Collaborate with Security Professionals: Engage with cybersecurity experts or managed service providers to help develop and maintain a strong security posture.
  17. This can provide access to specialized knowledge and resources to stay up-to-date with the latest threats and best practices.

Frequently Asked Questions (FAQs)

1. What are the best open-source cyber security monitoring tools available in 2023?

This blog post covers the top 25 open-source cyber security monitoring tools in 2023, including Wireshark, Snort, OSSEC, Security Onion, Nmap, Kismet, Suricata, Zeek, OpenVAS, ClamAV, and more.

These tools provide comprehensive network monitoring, threat detection, and vulnerability management capabilities to help organizations maintain a robust security posture.

2. Why choose open-source cyber security monitoring tools over proprietary alternatives?

Open-source cyber security monitoring tools offer several advantages: cost-effectiveness, customizability, rapid development and updates, extensive support, improved security, and platform independence.

These benefits make open-source tools attractive for organizations looking to enhance their network security and protect sensitive data.

3. How can I improve my organization’s cybersecurity hygiene?

In addition to utilizing open-source cyber security monitoring tools, organizations can improve their cybersecurity hygiene by implementing security awareness training, regularly updating software and systems, employing strong password policies, using multi-factor authentication, monitoring network traffic, and conducting regular security audits and penetration testing.

4. What is the importance of continuous monitoring in cybersecurity?

Continuous monitoring plays a crucial role in identifying and addressing security threats and vulnerabilities in real-time.

By regularly analyzing network traffic, security professionals can detect potential issues, respond to incidents promptly, and ensure the safety and integrity of their digital assets.

5. How can I protect my web applications from security threats?

Web application security can be improved by using tools such as ModSecurity, an open-source web application firewall (WAF) that provides real-time application security monitoring and access control.

Regularly updating web applications, conducting vulnerability assessments, and implementing secure coding practices can also help mitigate security risks.

6. What role do threat intelligence and threat data play in cybersecurity?

Threat intelligence and threat data help security professionals understand the latest trends, tactics, and techniques cybercriminals use.

Organizations can proactively address potential issues and maintain a strong security posture by staying informed about emerging threats and vulnerabilities.

7. Are open-source cyber security monitoring tools suitable for small businesses and startups?

Yes, open-source cyber security monitoring tools are ideal for small businesses and startups, as they offer cost-effective and powerful network monitoring solutions.

These tools enable organizations with limited budgets to access advanced security features without incurring high licensing fees or subscription costs.

Wrapping up

The ever-evolving landscape of cyber threats demands reliable and effective tools for security professionals to protect networks, systems, and sensitive data.

These Top 20 open-source cyber security monitoring tools in 2023 provide a comprehensive network monitoring, threat detection, and vulnerability management solution.

By incorporating these tools into your security strategy, you can enhance your overall security posture and ensure the safety and integrity of your digital assets.

Source :
https://www.virtualizationhowto.com/2023/05/top-20-open-source-cyber-security-monitoring-tools-in-2023/

Huge List Of PowerShell Commands for Active Directory, Office 365 and more

This is the ultimate collection of PowerShell commands for Active Directory, Office 365, Windows Server and more.

These commands will help with numerous tasks and make your life easier.

Table of Contents:

This section contains general commands for getting domain details.

View all Active Directory commands

get-command -Module ActiveDirectory

Display Basic Domain Information

Get-ADDomain

Get all Domain Controllers by Hostname and Operating

Get-ADDomainController -filter * | select hostname, operatingsystem

Get all Fine Grained Password Policies

Get-ADFineGrainedPasswordPolicy -filter *

Get Domain Default Password Policy

Gets the password policy from the logged in domain

Get-ADDefaultDomainPasswordPolicy

Backup Active Directory System State Remotely

This will back up the domain controllers system state data. Change DC-Name to your server name and change the Backup-Path. The backup path can be a local disk or a UNC path

invoke-command -ComputerName DC-Name -scriptblock {wbadmin start systemstateback up -backupTarget:"Backup-Path" -quiet}

Related: Windows CMD Commands

This section is all Active Directory user commands.

Get User and List All Properties (attributes)

Change username to the samAccountName of the account

Get-ADUser username -Properties *

Get User and List Specific Properties

Just add whatever you want to display after select

Get-ADUser username -Properties * | Select name, department, title

Get All Active Directory Users in Domain

Get-ADUser -Filter *

Get All Users From a Specific  OU

OU = the distinguished path of the OU

Get-ADUser -SearchBase “OU=ADPRO Users,dc=ad,dc=activedirectorypro.com” -Filter *

Get AD Users by Name

This command will find all users that have the word robert in the name. Just change robert to the word you want to search for.

get-Aduser -Filter {name -like "*robert*"}

Get All Disable User Accounts

Search-ADAccount -AccountDisabled | select name

Disable User Account

Disable-ADAccount -Identity rallen

Enable User Account

Enable-ADAccount -Identity rallen

Get All Accounts with Password Set to Never Expire

get-aduser -filter * -properties Name, PasswordNeverExpires | where {$_.passwordNeverExpires -eq "true" } | Select-Object DistinguishedName,Name,Enabled

Find All Locked User Accounts

Search-ADAccount -LockedOut

Unlock User Account

Unlock-ADAccount –Identity john.smith

List all Disabled User Accounts

Search-ADAccount -AccountDisabled

Force Password Change at Next Login

Set-ADUser -Identity username -ChangePasswordAtLogon $true

Move a Single User to a New OU

You will need the distinguishedName of the user and the target OU

Move-ADObject -Identity "CN=Test User (0001),OU=ADPRO Users,DC=ad,DC=activedirectorypro,DC=com" -TargetPath "OU=HR,OU=ADPRO Users,DC=ad,DC=activedirectorypro,DC=com"

Move Users to an OU from a CSV

Setup a csv with a name field and a list of the users sAmAccountNames. Then just change the target OU path.

# Specify target OU. $TargetOU = "OU=HR,OU=ADPRO Users,DC=ad,DC=activedirectorypro,DC=com" # Read user sAMAccountNames from csv file (field labeled "Name"). Import-Csv -Path Users.csv | ForEach-Object { # Retrieve DN of User. $UserDN = (Get-ADUser -Identity $_.Name).distinguishedName # Move user to target OU. Move-ADObject -Identity $UserDN -TargetPath $TargetOU }

This section list commands used for getting Active Directory group information.

Get All members Of A Security Group

Get-ADGroupMember -identity “HR Full”

Get All Security Groups

This will list all security groups in a domain

Get-ADGroup -filter *

Add User to Group

Change group-name to the AD group you want to add users to

Add-ADGroupMember -Identity group-name -Members Sser1, user2

Export Users From a Group

This will export group members to a CSV, change group-name to the group you want to export.

Get-ADGroupMember -identity “Group-name” | select name | Export-csv -path C:\OutputGroupmembers.csv -NoTypeInformation

Get Group by keyword

Find a group by keyword. Helpful if you are not sure of the name, change group-name.

get-adgroup -filter * | Where-Object {$_.name -like "*group-name*"}

Import a List of Users to a Group

$members = Import-CSV c:itadd-to-group.csv | Select-Object -ExpandProperty samaccountname Add-ADGroupMember -Identity hr-n-drive-rw -Members $members

List of commands for getting Active Directory computers.

Get All Computers

This will list all computers in the domain

Get-AdComputer -filter *

Get All Computers by Name

This will list all the computers in the domain and only display the hostname

Get-ADComputer -filter * | select name

Get All Computers from an OU

Get-ADComputer -SearchBase "OU=DN" -Filter *

Get a Count of All Computers in Domain

Get-ADComputer -filter * | measure

Get all Windows 10 Computers

Change Windows 10 to any OS you want to search for

Get-ADComputer -filter {OperatingSystem -Like '*Windows 10*'} -property * | select name, operatingsystem

Get a Count of All computers by Operating System

This will provide a count of all computers and group them by the operating system. A great command to give you a quick inventory of computers in AD.

Get-ADComputer -Filter "name -like '*'" -Properties operatingSystem | group -Property operatingSystem | Select Name,Count

Delete a single Computer

Remove-ADComputer -Identity "USER04-SRV4"

Delete a List of Computer Accounts

Add the hostnames to a text file and run the command below.

Get-Content -Path C:ComputerList.txt | Remove-ADComputer

Delete Computers From an OU

Get-ADComputer -SearchBase "OU=DN" -Filter * | Remote-ADComputer

List of commands for getting group policy details.

Get all GPO related commands

get-command -Module grouppolicy

Get all GPOs by status

get-GPO -all | select DisplayName, gpostatus

Backup all GPOs in the Domain

Backup-Gpo -All -Path E:GPObackup

Office 365 PowerShell Commands

Commands for Office 365.

Connect To Exchange Online

This will pop up and ask for credentials

$UserCredential = Get-Credential $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $LiveCred -Authentication Basic -AllowRedirection Import-PSSession $Session

Force Azure Sync

This is for the azure ad sync client.

Force delta sync (only sync changes

Start-ADSyncSyncCycle -PolicyType Delta Force a full sync Start-ADSyncSyncCycle -PolicyType Initial

Get A List of All Office 365 Users

Get-MsolUser | Select DisplayName, City, Department, ObjectID

Get Full mailbox details

Get-Mailbox email-address | fl

Get Calendar Permissions

Get-MailboxFolderPermission username:calendar

Enable Remote Mailbox (Hybrid Environment)

Use this command if you have an existing on-premise user that needs an office 365 mailbox. There are other ways to do this but this creates all the attributes in the AD account.

Replace the username and the tenant fields

Enable-RemoteMailbox username -RemoteRoutingAddress "username@tenant.mail.onmicrosoft.com"

Windows Server & Client Commands

Get all Services

get-service

Get all Processes

get-process

Display Network Adapters

Gets detailed about the network adapter installed such as name,  status, speed and mac address.

get-netadapater

Restart Remote Computers

Restart-Computer -ComputerName "Server01", "Server02", "localhost"

Get Last Boot Time

This takes a few lines

$os = Get-WmiObject win32_operatingsystem $uptime = (Get-Date) - $os.ConvertToDateTime($os.LastBootUpTime) Write-Output ("Last boot: " + $os.ConvertToDateTime($os.LastBootUpTime))

You can also run this single line to get last boot time

systeminfo | more

Start a Remote Session

Use this to start an interactive session with a remote computer

Enter-PSSession -ComputerName

Read the Content of a File (Open a file)

This example shows how to read the content of the windows firewall log file

Get-Content -Path "c:windowssystem32logfilesfirewallpfirewall.log"

Copy Files & Folders

Use this command to copy an entire folder to another folder. This will copy the folder and all the sub folder/files. The -verbose command will display the results to the console.

copy-item E:\WindowsImageBackup\exchange -destination \\server1\Backups\Exchange -recurse -verbose

Basic PowerShell Commands

Get Execution Policy

get-executionpolicy

Set Execution Policy to Unrestricted

set-executionpolicy unrestricted

Show PowerShell Version

$PSVersionTable

Get help for a command

Use this to get the help information for a command

get-help command-name

Search Get Help

Use this to search the help files. This is useful if you don’t know the command or want to see if one exists.

get-help *keyword*

Get Installed Modules

Use this command to display all the installed modules on a computer

get-installedmodule

List All Available Modules

This will list all available modules on the computer.

Get-Module -ListAvailable

Exporting results to CSV

Add export-csv to the end of commands

Get-ADUser username -Properties * | Select name, department, title | export-csv c:\user.csv

Display available commands

This will display all commands that are available based on the modules that are loaded.

get-command

Find New Modules

Replace *ntfs* with the keyword you want to search for. This searches modules at https://www.powershellgallery.com/

Find-Module *ntfs*

Install a New Module

Installs modules from https://www.powershellgallery.com/

I found a module called NTFSSecurity, to install it I run this command

install-module NTFSSecurity

Recommended Tool: SolarWinds Hybrid Systems Monitor

Monitor your physical and virtual servers with ease and troubleshoot more easily when downtime or other application performance issues occur.

What I like best about this tool is it’s easy-to-use dashboard and built-in alerting. See key metrics to help identify issues before users complain.

Monitor Active Directory, DNS, DHCP, and other critical IT systems, both locally and cloud hosted. Get automated email alerts and know which applications are having issues in your environment.

Source :
https://activedirectorypro.com/powershell-commands/

Why High Tech Companies Struggle with SaaS Security

It’s easy to think high-tech companies have a security advantage over other older, more mature industries. Most are unburdened by 40 years of legacy systems and software. They draw some of the world’s youngest, brightest digital natives to their ranks, all of whom consider cybersecurity issues their entire lives.

Perhaps it is due to their familiarity with technology that causes them to overlook SaaS security configurations. During the last Christmas holiday season, Slack had some private code stolen from its GitHub repository. According to Slack, the stolen code didn’t impact production, and no customer data was taken.

Still, the breach should serve as a warning sign to other tech companies. Stolen tokens allowed threat actors to access the GitHub instance and download the code. If this type of attack can happen to Slack on GitHub, it can happen to any high-tech company. Tech companies must take SaaS security seriously to prevent resources from leaking or being stolen.

App Breaches: A Recurring Story#

Slack’s misfortune with GitHub wasn’t the first time a GitHub breach occurred. Back in April, a stolen OAuth token from Heroku and Travis CI-maintained OAuth applications were stolen, leading to an attacker downloading data from dozens of private code repositories.

MailChimp, a SaaS app used to manage email campaigns, experienced three breaches over 12 months spanning 2022-23. Customer data was stolen by threat actors, who used that data in attacks against cryptocurrency companies.

SevenRooms had over 400 GB of sensitive data stolen from its CRM platform, PayPal notified customers in January that unauthorized parties accessed accounts using stolen login credentials, and Atlassian saw employee data and corporate data exposed in a February breach.

Clearly, tech companies aren’t immune to data breaches. Protecting their proprietary code, customer data, and employee records that are stored within SaaS applications should be a top priority.

Reliance on SaaS Applications#

A strong SaaS posture is important for any company, but it is particularly important for organizations that store their proprietary code in SaaS applications. This code is especially tempting to threat actors, who would like nothing more than to monetize their efforts and ransom the code back to its creators.

Tech companies also tend to rely on a large number and mix of SaaS applications, from collaboration platforms to sales and marketing tools, legal and finance, data warehouses, cybersecurity solutions, and many more – making it even more challenging to secure the entire stack.

Tech employees heavily depend on SaaS apps to do their day-to-day work; this requires security teams to strictly govern identities and their access. Moreover, these users tend to log into their SaaS apps through different devices to maintain efficiency, which may pose a risk to the organization based on the device’s level of hygiene. On top of this, tech employees tend to connect third-party applications to the core stack without thinking twice, granting these apps high risk scopes.

Learn how Adaptive Shield can help you secure your entire SaaS stack.

Controlling SaaS Access After Layoffs#

The high-tech industry is known for periods of hyper-growth, followed by downsizing. Over the past few months, we’ve seen Facebook, Google, Amazon, Microsoft, LinkedIn, Shopify and others announce layoffs.

Deprovisioning employees from SaaS applications is a critical element in data security. While much of the offboarding of employees is automated, SaaS applications that are not connected to the company directory don’t automatically revoke access. Even those applications that are connected may have admin accounts that are outside the company’s SSO. While the primary SSO account may be disconnected, the user’s admin access through the app’s login screen is often accessible.

Organic Hyper Growth and M&As#

At the same time, the industry is ripe with mergers and acquisition announcements. As a result of M&As, the acquiring company needs to create a baseline for SaaS security and monitor all SaaS stacks of merged or acquired companies, while enabling business continuity. Whether the hyper growth is organic or through an M&A, organizations need to be able to ensure access is right-sized for their users, at scale and rapidly.

Identity Threat Detection & Response#

The majority of data breaches impacting tech companies stem from stolen credentials and tokens. The threat actor enters the system through the front door, using valid credentials of the user.

Identity Threat Detection and Response (ITDR) picks up suspicious events that would otherwise go unnoticed. An SSPM (SaaS Security Posture Management) solution with threat detection engines in place will alert when there is an Indicator of Compromise (IOC). These IOCs are based on cross-referencing of activities such as user geolocation, time, frequency, recurring attempts to login, excessive activities and more.

Securing High Tech’s SaaS#

Maintaining a high SaaS security posture is challenging for high tech companies, who may mistakenly believe they are equipped and well trained to prevent SaaS attacks. SaaS Security Posture Management is essential to preventing SaaS breaches, while an SSPM with ITDR capabilities will go a long way toward ensuring that your SaaS data is secure.

Learn how Adaptive Shield can help you secure your entire SaaS stack.

Source :
https://thehackernews.com/2023/05/why-high-tech-companies-struggle-with.html

Back/Forward Cache: What It Is and How to Use It to Serve Content Immediately

Last updated on Feb 20th, 2023 | 7 min

Imagine this…

A user is browsing your website. They go to your product page. Then to your pricing page. Then back to your product page as they forgot to check if you offer that specific feature. Finally, they navigate forward to your pricing page and finish their order. 

As it turns out, it’s a pretty common scenario. 

Chrome usage data shows that 1 in 10 (10%) navigations on desktop and 1 in 5 (20%) on mobile are either back or forward.

Truly spectacular numbers. 

But…

The more important thing is – how can you guarantee that after navigating back and forward to your pages, they load immediately? 

Enter back/forward cache (or bfcache).

In the following lines, you will learn everything about bfcache and how to implement it to improve speed and perceived performance.

Spoiler alert: it’s easier than you think. 


What is the back/forward cache?

Bfcache is a feature that allows browsers to create and store a snapshot of an already visited web page in their in-memory. So the next time a visitor navigates back or forward to it, the browser can display it immediately.

The whole behind-the-scene process looks like this…

When a visitor requests to load a specific page, the browser goes through the following process:

  1. Establishes a connection with the server
  2. Downloads and parses the information
  3. Constructs the Document Object Model (DOM) and CSS Object Model (CSSOM)
  4. Renders the content
  5. Makes the page interactive
Browser loading a web page


If the back/forward cache isn’t enabled for the specific page, it means that every time you leave it and then navigate back to it, the browser will have to go through the whole 5-step process. 

And that takes time. 

On the contrary, with bfcache enabled, the browser “freezes” the page with all of its resources, so the next time you re-visit it, the browser won’t need to waste time rebuilding and will be able to load it instantly. 

The following Addy Osmani’s video illustrates best how fast a web page loads with and without bfcache:

data:text/html;https://www.youtube.com/embed/_me7_7C6Drs?autoplay=1;base64,PGJvZHkgc3R5bGU9J3dpZHRoOjEwMCU7aGVpZ2h0OjEwMCU7bWFyZ2luOjA7cGFkZGluZzowO2JhY2tncm91bmQ6dXJsKGh0dHBzOi8vaW1nLnlvdXR1YmUuY29tL3ZpL19tZTdfN0M2RHJzLzAuanBnKSBjZW50ZXIvMTAwJSBuby1yZXBlYXQnPjxzdHlsZT5ib2R5ey0tYnRuQmFja2dyb3VuZDpyZ2JhKDAsMCwwLC42NSk7fWJvZHk6aG92ZXJ7LS1idG5CYWNrZ3JvdW5kOnJnYmEoMCwwLDApO2N1cnNvcjpwb2ludGVyO30jcGxheUJ0bntkaXNwbGF5OmZsZXg7YWxpZ24taXRlbXM6Y2VudGVyO2p1c3RpZnktY29udGVudDpjZW50ZXI7Y2xlYXI6Ym90aDt3aWR0aDoxMDBweDtoZWlnaHQ6NzBweDtsaW5lLWhlaWdodDo3MHB4O2ZvbnQtc2l6ZTo0NXB4O2JhY2tncm91bmQ6dmFyKC0tYnRuQmFja2dyb3VuZCk7dGV4dC1hbGlnbjpjZW50ZXI7Y29sb3I6I2ZmZjtib3JkZXItcmFkaXVzOjE4cHg7dmVydGljYWwtYWxpZ246bWlkZGxlO3Bvc2l0aW9uOmFic29sdXRlO3RvcDo1MCU7bGVmdDo1MCU7bWFyZ2luLWxlZnQ6LTUwcHg7bWFyZ2luLXRvcDotMzVweH0jcGxheUFycm93e3dpZHRoOjA7aGVpZ2h0OjA7Ym9yZGVyLXRvcDoxNXB4IHNvbGlkIHRyYW5zcGFyZW50O2JvcmRlci1ib3R0b206MTVweCBzb2xpZCB0cmFuc3BhcmVudDtib3JkZXItbGVmdDoyNXB4IHNvbGlkICNmZmY7fTwvc3R5bGU+PGRpdiBpZD0ncGxheUJ0bic+PGRpdiBpZD0ncGxheUFycm93Jz48L2Rpdj48L2Rpdj48c2NyaXB0PmRvY3VtZW50LmJvZHkuYWRkRXZlbnRMaXN0ZW5lcignY2xpY2snLCBmdW5jdGlvbigpe3dpbmRvdy5wYXJlbnQucG9zdE1lc3NhZ2Uoe2FjdGlvbjogJ3BsYXlCdG5DbGlja2VkJ30sICcqJyk7fSk7PC9zY3JpcHQ+PC9ib2R5Pg==


As you can see from the video, the loading time is almost non-existent. On top of that, bfcache will reduce your visitors’ data usage as they won’t have to re-download the same resources repeatedly. 

And while all of these benefits sound incredible, a certain question might still bother you:

I already have an HTTP cache set up for my website. Do I need bfcache as well? 

Here’s the answer…
 

What is the difference between bfcache and HTTP cache?

Put simply, bfcache is a snapshot of the entire page stored in-memory (including the JavaScript heap), whereas the HTTP cache includes only the previously requested resources. 

And as Google claims:

“…it’s quite rare that all requests required to load a page can be fulfilled from the HTTP cache…”


Not all resources are allowed to be cached in the HTTP Cache. For instance, some sites don’t cache the HTML document itself, but only the resources. As a result, every time a visitor loads a specific page, the browser needs to re-download the document. 

Another reason back/forward cache can be faster is the difference between in-memory and disk cache. 

It’s true that loading resources from the disk cache (HTTP cache) could be much faster than requesting them over the network. But there’s an extra boost from not even having to read them from disk and fetching the entire page directly from the browser’s in-memory. 
 

What browsers support the back/forward cache?

All of them – Chrome, Safari, Firefox, Opera, and Edge:

Bfcache browser support

The truth is back/forward cache isn’t a new concept. Safari added support for this feature back in 2009. Firefox has supported it since version 1.5.

Edge and Chrome were the latest to join the party, with the former introducing bfcache in 2020, while the latter did it a year later. 

Now that you know that all major browsers support it let’s see how you can check if your page is served from the bfcache. 


How can I check if my site can be served from the back/forward cache?

The best thing about back/forward cache is that it just works in the majority of cases because browsers automatically do all the work for you.

In some cases, however, your pages will not be restored by the bfcache. 

The easiest way to check if everything works correctly is to run a PageSpeed Insights audit. 


Using Google PageSpeed Insights

Since the release of Lighthouse v10, there’s been a new PSI audit called “Page prevented back/forward cache restoration.” 

The audit will fail if the page you tested cannot be restored from bfcache for any reason. Clicking on the warning, a drop-down menu will open, and you’ll see a list with reasons and the frame(s) that caused the issue.

Failure reasons are separated into three categories:

  • Actionable: You can fix these issues to enable caching.
  • Pending Support: Chrome doesn’t support these features yet, so they prevent caching. However, once supported, Chrome removes these limitations.
  • Not Actionable: You can’t fix these issues on this page. Something that is outside the page’s control prevents caching.
Page prevented back/forward cache restoration warning

Using Chrome DevTools

Another option is to use Chrome’s Developer Tools, following these steps:

1. Open Chrome DevTools on the page you want to test:

How to open Chrome DevTools

2. Navigate to Application > Cache > Back/forward cache:

How to open bfcache settings in Chrome DevTools

3. Click Test back/forward cache

Test back/forward cache in Chrome Devtools

If bfcache works on your page, you’ll see this message:

Page eligible for bfcache

If not, you will see a list of issues:

Page ineligible for bfcache


Now that you know how to test it, let’s see how you can optimize your pages for bfcache and fix PSI’s warning. 
 

How to fix the “Page prevented back/forward cache restoration” warning in PageSpeed Insights

Even if you don’t see the warning, meaning your page is eligible for bfcache, it’s good to know that it won’t stay there indefinitely.

That’s why it’s crucial to know how to optimize for back/forward cache.

Here are some best practices you can use to make it as likely as possible that browsers bfcache your pages:

1. Avoid using the unload event 

The most surefire way to optimize for bfcache is to avoid using the unload event at all costs. 

The unload event fires when the user navigates away from the page (by clicking on a link, submitting a form, closing the browser window, etc.).

On desktop, Chrome and Firefox consider a page ineligible for bfcache if it uses the unload event. Safari, on the other hand, will cache some pages that fire the unload event listener, but to reduce potential breakage, it will not run it when a user is navigating away.

On mobile, Chrome and Safari will cache a page that uses the event, but Firefox won’t. 

In general, avoid using the unload event and instead go for the pagehide event. Otherwise, you’re risking slowing down your site, and your code won’t even run most of the time in Chrome and Safari. 

Also, there’s an ongoing discussion between browsers to deprecate unload. 
 

2. Be careful with adding beforeunload listeners

It’s ok to use beforeunload events in Chrome and Safari, but keep in mind that Firefox will flag your pages as ineligible for bfcache. 

However, there are legitimate use cases for the beforeunload event, unlike the unload event. One example is when you must caution the user about losing unsaved changes if they exit the page. It’s advisable to attach beforeunload event listeners only when there are unsaved changes and to remove them promptly after saving those changes.
 

3. Use Cache-Control: no-store only with information-sensitive pages

If a page contains sensitive information and caching is inappropriate, then Cache-Control: no-store should be used to prevent it from being eligible for bfcache. On the other hand, if a page doesn’t contain sensitive information and always requires up-to-date content, Cache-Control: no-cache or Cache-Control: max-age=0 can be used. These directives prompt the browser to revalidate the content before serving it and don’t impact a page’s eligibility for bfcache.
 

4. Update sensitive data after bfcache restore

The bfcache isn’t supposed to work for pages that contain sensitive data. For instance, when a user signs out of a website on a public computer, the next user shouldn’t be able to sign back in just by hitting the back button. 

To achieve that, it’s a good practice to update the page after a pageshow event if event.persisted is true.

Here’s a code from web.dev you can use:

Web dev code


5. Avoid window.opener references

Whenever possible, use rel=”noopener” instead of window.opener references. The opened window or the opener won’t be eligible for bfcache if your site opens windows and controls them through window.postMessage().

Always close connections and disconnect observers during the pagehide and freeze event

When the page is stored in the bfcache, all JavaScript tasks are paused and resumed as soon as it is taken out of the cache.

If these tasks only access APIs isolated to the current page, there won’t be any problems. 

However, if these tasks are connected to APIs that are also accessible from other pages in the same origin, then they may prevent code in other tabs from running properly.

If that’s the case, some browsers will not put a page in bfcache in the following scenarios:

The best thing you can do is to permanently close connections and remove or disconnect observers during pagehide or freeze events if your page uses any of these APIs. By doing this, the browser can cache the page without worrying about other open tabs being affected.
 

Key Takeaways

For something handled by browsers, we’ve covered a lot of information. 

So here are the key takeaways from this article:

  • Bfcache allows browsers to create and store a snapshot of an already visited web page in their in-memory, making the subsequent back/forward navigation load instantly. 
  • The benefits of your page being served from the bfcache include reduced data usage, better perceived performance, improved Core Web Vitals, and user experience.
  • The difference between bfcache and HTTP cache is that the former stores a snapshot of the whole page while the latter only the previously used resources. Also, with bfcache, the content is restored from the browser’s in-memory, while with HTTP cache is from a disk cache. 
  • All major browsers support back/forward cache. 
  • You can check if a particular page is eligible for back/forward caching using PageSpeed Insights or Chrome DevTools.
  • То optimize your pages for bfcache and fix the “Page prevented back/forward cache restoration” warning by doing the following:
  • Avoid using the unload event
  • Be careful with adding beforeunload listeners
  • Use Cache-Control: no-store only with information-sensitive pages
  • Avoid window.opener references
  • Always close connections and disconnect observers during the pagehide and freeze event

As always, don’t forget to test. Back/forward cache is a great feature, but remember that not every page should be eligible for it. Your visitors’ experience should always be a first priority. 

Source :
https://nitropack.io/blog/post/back-forward-cache

Tip – How to Disable Cloud-Based Clipboard (WIN+V) History in Windows 10

This tutorial will help you in disabling cloud-based clipboard (WIN+V) history feature in Windows 10. Once you follow the steps given in this guide, you’ll be able to prevent or restrict Windows 10 as well as other users from enabling cloud-clipboard feature from Settings and accessing your copied data from cloud-clipboard fly-out.

Newer versions of Windows 10 come with new cloud-based Clipboard feature which allows users to copy and paste multiple items from the clipboard. Users can copy multiple items to the new clipboard and then they can select and paste desired copied items from cloud-clipboard to anywhere they want such as Notepad, MS Word, etc.

The new cloud-based clipboard can be used by pressing WIN+V keys together. To copy items you need to use the good old Ctrl+C hotkey but to paste the copied text from new cloud-based clipboard, you need to use the new WIN+V keyboard shortcut.

When you press WIN+V keys together to access cloud-clipboard, Windows 10 launches the new cloud-based clipboard fly-out as shown in following screenshot:

Clear_Cloud_Based_Clipboard_History_Windows_10.png

To paste an item, you need to click on the item and it’ll be immediately pasted at current cursor position in your program window.

Users can enable/disable cloud-clipboard using Windows 10 Settings app. Open Settings app (WIN+I) and go to System -> Clipboard section. Now you can turn on/off Clipboard History option to allow/disallow Windows 10 from copying items to new cloud-clipboard as shown in following screenshot:

Customize_Cloud_Based_Clipboard_Settings_Windows_10.png

We posted a detailed tutorial reviewing cloud-based clipboard feature at following link:

[Tip] How to Configure and Use Cloud-Based Clipboard (WIN+V) Feature in Windows 10

Although it’s a good feature but many Windows 10 users may not like the new cloud-clipboard feature and they may want to disable or deactivate it due to privacy and security reasons.

In this tutorial, we’ll tell you how to permanently disable cloud-clipboard feature in Windows 10 so that no one can access your copied data by pressing WIN+V hotkey.

Once deactivated or disabled, when anyone will try to open Settings -> System -> Clipboard page in your Windows 10 device, he’ll notice that Clipboard History option is grayed out i.e. disabled and he can’t change it. So users will be unable to activate or enable cloud-clipboard feature without your permission. Also a message “Some of these settings are hidden or managed by your organization” will be displayed at the top of the page as shown in following screenshot:

Cloud_Clipboard_History_Disabled_Grayed_Out_Windows_10_Settings.png

If anyone will try to press WIN+V hotkey in Notepad or any other program to access cloud-clipboard feature, the new clipboard fly-out will open blank or empty. Windows 10 will no longer store your copied items to cloud-clipboard.

Following methods will help you in disabling cloud-clipboard feature in Windows 10 operating system:

METHOD 1: Using Group Policy Editor

1. Press WIN+R keys together to launch RUN dialog box. Now type gpedit.msc and press Enter. It’ll open Group Policy Editor.

2. Now go to:

Computer Configuration -> Administrative Templates -> System -> OS Policies

3. In right-side pane, look for following options:

Allow Clipboard History

Allow Clipboard synchronization across devices

4. Double-click on both options one by one and set both of them to Disabled.

Disable_Cloud_Clipboard_History_Windows_10_Group_Policy.png

That’s it. It’ll permanently disable cloud-clipboard feature in Windows 10.

PS: In future, if you decide to restore default settings and restore cloud-clipboard feature, set the above mentioned options to Not Configured again in Group Policy Editor.

METHOD 2: Using Registry Editor

If you are using Home edition of Windows, you’ll not be able to run gpedit.msc command because this edition doesn’t come with Group Policy Editor.

If you can’t use or don’t want to use Group Policy Editor, you can take help of Registry Editor for the same task. Just follow these simple steps:

1. Press WIN+R keys together to launch RUN dialog box. Now type regedit and press Enter. It’ll open Registry Editor.

2. Now go to following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System

3. In right-side pane, right-click on empty area and select New -> DWORD (32-bit) Value option. Set the new DWORD name as AllowClipboardHistory and keep its value to 0

Again right-click on empty area and select New -> DWORD (32-bit) Value option. Set the new DWORD name as AllowCrossDeviceClipboard and keep its value to 0

Disable_Cloud_Clipboard_History_Windows_10_Registry_Editor.png

4. Close Registry Editor. You may need to restart your computer to take effects.

That’s it. It’ll completely disable cloud-clipboard feature in Windows 10.

PS: In future, if you decide to restore default settings and restore cloud-clipboard feature, delete the DWORD values created in above mentioned steps from Registry Editor.

Also Check:

[Fix] Some Settings are Managed by Your Organization in Windows 10

You are here: Home » Windows 10 » [Tip] How to Disable Cloud-Based Clipboard (WIN+V) History in Windows 10

Published in: Windows 10

About the author: Vishal Gupta (also known as VG) has been awarded with Microsoft MVP (Most Valuable Professional) award. He holds Masters degree in Computer Applications (MCA). He has written several tech articles for popular newspapers and magazines and has also appeared in tech shows on various TV channels.

Source :
https://www.askvg.com/tip-how-to-disable-cloud-based-clipboard-winv-history-in-windows-10/

How to automatically generate email summaries with Zapier and OpenAI

By Michael Toth · May 1, 2023

Keeping up with your email inbox can be a daunting task. It’s easy to get bogged down in long, rambling messages or get overwhelmed by a million unimportant emails and miss the important information buried within. Fortunately, there’s a solution that can help. 

Do more with OpenAI

Discover more ways to add AI to your workflows.

Explore now

With Zapier and OpenAI’s GPT-3, summarizing your email’s essential details has never been easier. With just a few clicks, you can automatically get a summary for each email in Slack or a handy daily digest that includes all the critical info you need from each email all in one go.

In this article, we’ll walk you through the steps of setting up this powerful Zap—our word for Zapier’s automated workflows. Whether you’re a busy professional or simply seeking to optimize your process, this tutorial will help you streamline your email management and stay on top of your inbox.

Looking for GPT-4? GPT-4 may be available with our OpenAI integration in the future. In the meantime, users with a paid subscription to ChatGPT Plus can access GPT-4 via our ChatGPT integration now—allowing you to add ChatGPT-powered conversations into apps like Slack.

How it works

For this project, we’ll be using OpenAI’s GPT-3 to summarize our emails, and then we’ll send the summaries to Slack. 

A 4-step Zap in the Zap editor.

If you’d like to start with a template, click on the Zap template below to go to the Zap editor. You’ll need to create a Zapier account if you don’t already have one. Then, follow the directions below to set up your Zap.

Get an OpenAI-generated email summary in Slack for new Gmail emails

Try it

  • Gmail logo
  • +2
  • Slack logo

Gmail, Formatter by Zapier, OpenAI (GPT-3, DALL·E, Whisper), Slack

Gmail + Formatter by Zapier + OpenAI (GPT-3, DALL·E, Whisper) + 1 moreMore details

Alternatively, if you prefer to receive the notifications as a daily digest rather than individually, we’ll walk through how you can use Digest by Zapier for this purpose. 

A 5-step Zap in the Zap editor.

If you’d like to go the digest route, you can start with the following Zap template:

Get an AI-generated daily digest of your emails in Slack

Try it

  • Gmail logo
  • +3
  • Slack logo

Gmail, Digest by Zapier, Formatter by Zapier, OpenAI (GPT-3, DALL·E, Whisper), Slack

Gmail + Digest by Zapier + Formatter by Zapier + 2 moreMore details

Before we begin developing our Zap, you’ll also need an OpenAI account if you don’t already have one. Go to platform.openai.com to sign up for your account. You’ll also need a free Slack account, which you can sign up for at www.slack.com. 

Are you ready to build this yourself? Let’s get started!

New to Zapier? It’s a tool that helps anyone connect apps and automate workflows—without any complicated code. Sign up for free.

Step 1: Set up your Gmail trigger step

Head over to Zapier, and click the Create Zap button to create a new Zap. 

Search for and select Gmail for the trigger app and New Email in Gmail for the trigger event (if you’re using the Zap template, these will already be selected for you). 

A Zap with Gmail selected for the trigger app and New Email for the trigger event.

Next, connect your Gmail account if you haven’t already connected it to Zapier.

In the Label/Mailbox field, select INBOX. You can optionally leave this blank to trigger for all emails. But since that will also trigger for sent messages and drafts, INBOX is the best choice unless you do heavy email filtering/labeling to remove emails from your inbox.

In the Label/Mailbox field, INBOX is shown selected.

Click Test Trigger, and you should see a recent email from your inbox, as shown below:

A successful test result that shows an email found in a Gmail inbox.

Step 2: Set up a formatter step to truncate your email

Currently, GPT-3 only allows you to send a limited amount of data to summarize, so we’ll need to truncate our email to make sure we don’t exceed this limit. In the future, OpenAI plans to develop new models with higher limits, or possibly no limits, but for now, this is a necessary step.

Click the + symbol beneath your Gmail trigger, then search for and select Formatter by Zapier for the action app and Text for the event. 

An action step of a Zap with Formatter by Zapier selected for the action app and Text for the action event.

Select Truncate as your transform action. Click in the Input field, and select Body Plain from the data dropdown from your Gmail trigger—this contains the plain-text body of the email. 

In the Max Length field, enter 6000, and then select True for the Append Ellipsis option. Here’s what your complete action step should look like:

A formatter step in the Zap editor with assorted fields filled out.

This 6000-character truncation means that if the email is shorter than 6000 characters, we’ll keep the entire thing, but if it’s longer, we’ll only keep the first 6000. 6000 characters is quite long, but I do often see emails that go over this limit. Most commonly, this will be longer newsletters or long back-and-forth email threads, as Gmail will include the entire thread in the body that Zapier receives. Because Gmail processes their email threads in reverse chronological order, this truncation will keep the most recent emails in the thread. 

Next, click Test Action to ensure everything is working properly. Next, we’ll set up our prompt to send to OpenAI.

Step 3: Set up your OpenAI email summary prompt

If you haven’t set up your Zapier connection to OpenAI, you’ll have to do that now. To start, head back over to platform.openai.com to log into your account. At the top right of the page, click on your profile icon and click View API Keys:

The Settings menu in OpenAI with the View API Keys tab selected.

From that page, click on the + Create new secret key button to generate a new API key. You’ll need this key to connect to your OpenAI account within Zapier. Copy this key and store it somewhere safe! 

A list of API keys in OpenAI.

Head back over to Zapier and add a new action step at the bottom of your Zap. Search for the OpenAI app and choose the Send Prompt event:

An action step in the Zap editor with OpenAI selected for the action app and Send Prompt for the action event.

Click on Choose account, and set up a new account by providing the API key you just generated in OpenAI. If you already have set up your account connection, simply select your existing account.

Head to the Set up action section to set up the prompt we’ll be sending over to OpenAI. In the Prompt field, copy and paste the following: 

Summarize the following email into 3 sentences max. Make it concise: 

"""

<Output from Formatter by Zapier>

"""

Replace the bracketed content with the Output variable from your Formatter by Zapier step by selecting Output from the Insert Data dropdown.

An OpenAI action step in the Zap editor with a prompt added to the Prompt field.

The triple quotes help GPT-3 to understand where the email starts and stops. 

If you want, you can give more specific instructions for the summary depending on your use case. For example, if you’re using this for your work email, you might provide information about your role at your company and the type of information that is or isn’t important to you. You might also consider providing additional context about the services or products your company offers so that GPT-3 can incorporate some of those details into the summary. For now, we’ll keep it simple with the prompt I show above.

You can leave all of the other fields for this step set to their default values. 

Click Test Action to send the email over to OpenAI. Review the summary and make sure everything looks okay. 

If you want to get a notification in Slack for each email you receive, continue to the next step.

If you want to get a daily digest of all of your emails, skip ahead.

Get notifications for each email step 4: Set up your Slack message

Next, we’ll set up the action step that will send the email summary back to you in a Slack message. This could also be set up to send as an email or SMS if you prefer, but we’ll be using Slack for this example.

Add a fourth action step and search for the Slackapp. Select the Send Channel Message event. 

A Slack action step in the Zap editor with Send Channel Message selected for the action event.

Connect your Slack account if you haven’t already connected it to Zapier.

Next, we’ll set up the action step. Select the Slack channel you want these messages to be sent to. I created a new channel called email-summaries for this purpose. 

In the Message Text field, copy and paste the following, replacing the bracketed content with data from your previous Zap steps, which you can select from the Insert Data dropdown:

*New email summary*

From {Gmail From Name}, {Gmail From Email}

Received {Gmail Date}

Summary: {OpenAI Choices Text}

<{Gmail Message URL}|Go To Email>

Your Message Text field should look like the following image when complete:

The Message Text field of a Slack step in the Zap editor.

This will create a message in Slack that includes the sender name and email address, the date and time the email was received, the summary generated by OpenAI, and a link to open the email directly in Gmail for easy responding.

Switch the Include a link to this Zap? field to No and leave the remaining fields as is. 

Next, click Test Action to send the summary message to your Slack channel and make sure everything is working properly. If everything looks good, you’re now ready to use your Zap.

Get a daily digest step 4: Set up your digest entries

If the idea of receiving instant notifications for every email you receive sounds too distracting, the daily digest is an ideal solution for you. Instead of setting up a Slack notification for the fourth step, we can use a built-in Zapier tool called Digest by Zapier to store up the email summaries throughout the day and then release them to us all at once at a designated time. 

Add a new action step to the bottom of your Zap. Select Digest by Zapier for your action app and Append Entry and Schedule Digest for your action event. 

A Digest by Zapier step in the Zap editor with Append Entry and Schedule Digest selected for the action event.

Navigate to the Action section and give your digest a descriptive title like Daily Email Summaries. 

For the Entry field, simply copy and paste the copy below. Then replace the bracketed content with the variables from the prior steps by selecting them from the Insert Data dropdown.

From {Gmail From Name}, {Gmail From Email}

Received {Gmail Date}

Summary: {OpenAI Choices Text}

<{Gmail Message URL}|Go To Email>

For the Frequency field, select Daily, and for the Time of Day field, choose when you’d like to receive the digest. Your completed action step should look like this:

A digest step in the Zap editor with a list of emails summarized in the Body field.

Click Test Action to add an entry to your digest and make sure your action step is set up correctly.

Get a daily digest step 5: Set up the Slack action to release your daily digest

Finally, we’ll set up the action step that will release your daily digest and send all of the email summaries to you in a Slack message. This digest message will automatically send at the Time of Day you specified in the prior action step. 

Add an action step and search for the Slackapp. Select the Send Channel Message event. 

A Slack step in the Zap editor with Send Channel Message selected for the action event.

Click on the Actionsection. As before, select the channel you want these messages to be sent to. I created a new channel called email-summaries for this purpose. 

In the Message Text field, copy and paste the following, replacing the bracketed content with the data received from your previous digest step by selecting them from the insert Data dropdown:

*You received {Digest Count} emails today*

{Current Digest}

Your Message Text field should look like the following image when complete:

A Slack message text field with a daily digest of 4 emails.

This will create a message in Slack that includes the total number of emails received and the digest with all of the email summaries that were created throughout the day, formatted as we specified in the prior step. 

Switch the Include a link to this Zap? field to No and leave the remaining fields as is. 

Next, click Test Action to send the summary digest to your Slack Channel and make sure everything is working properly. If everything looks right, you’re now ready to use your Zap! 

Putting it all together

Whether you’re a busy professional or simply looking to optimize your email management process, setting up either of these workflows can help streamline your day and keep you on top of your inbox. Give it a try and see the difference it can make!

Related reading:


Source :
https://zapier.com/blog/generate-email-summaries-with-ai/