Luke Mccord Email & Phone Number

EDR solutions ( Crowdstrike Falcon and Sentinel one) - Investigation to alerts to True positive or false positive and root cause analysis - Run playbook and execute actions per SOP for active threats - Quarntine or other actions to contain threats - Use of splunk Queries to sort through data Proofpoint - Email header analysis - Forensic investigations in alerts - Deny or allow traffic based on pattern determination - Integration with EDR and other security tools OSINT tools - MxToolbox used to look at Dmarc, DKim, SPF fields for manual email analysis - Cyberchef Primarily used to de-fanged malicious URL to add to report or ticket so it doesn't get clicked on. Good to use for debase 64 code. - Talos Domain and Ip address ownership and reputation for potential threats and confidence of sites - Virus total deciphering of file hashes to determine if its a threat, if possible the family of threat and what it does, in conjunction with other OSINT tools can deliver IP address information and mitre attach matrix information. - Joes sandbox (sandbox)Can throw files into this to get a run down on what it will do and deliver information in regard to threat, including Mitre attack matrix. - abuseipdb Ip address and domain confidence tool, we can alos obtain location and reputation of sites and domains. - URLscan.io (url analysis)When obtaining potential malicous link can be used to scan and analysis - ultimatewindowssecurityDictionary on windows even logs and what they mean - Phish tool (email analysis)Email phishing tool to analysis emails Web application and vulnerability scanner - Netsparker - Teneable Nessus

Greater St. Louis Area

Tier 1 support- Incident management Use of Incident management plan to adjust and prioritze Incidents that need higher urgency and bring to the front the teams that can handle and solve the issue at hand. -Service manager Ticketing system- Active DirectoryUsing of Active directory to make adjustment to permission via groups or permission using company conventions for access. as well as basic account work like passwords and unlock. - Microsoft authenticator (authentication) configuring or maintaining of users accounts for authentication so user can access network resources remotely- Office Suite (word, excel, onedrive, etc) - Standard support plus profile rebuilding and mobile access to apps - Windows 10 OS support This includes shared drives, settings, upgrades, and peripherals that interact with it (Cameras, monitors, docking station, wifi and network setup- Citrix director Often in conjunction with Meraki, network access and support of the applications through citrix. Most of the time the eliminating of bad applications or reset of the Meraki session the client has. - Cisco anyconnect (vpn for remote access) As one of 2 ways to remote access, troubleshooting network connectivity to the vpn via a company laptop so coworkers can access network resources. - Cisco Mearki Work from home users with endpoint equipment needing help with setup or most of the time connectivity troubleshooting of the equipment to.- Application deployment (SCCM) The use of computer class policy to push applications through to computers. Then can also be down via SCCM for troubleshooting specific issues with computers.- Jabber and Webex Support The troubleshooting and configuration of webex and jabber including jabber phone. - Epic medical record system The troubleshooting of processes, workflow, and or additional support for workers within the program itself.

Greater St. Louis Area

Provide IT support to client PC's.Various Remote methods- This is done via remote connection (Bomgar, Proxy, and Windows remote assistance). - IQ track ticketing system We use IQ track ticketing system to handle calls and route issues to support team- Citrix is a platform that many clients use and we do to. - Active Directory is a main source of troubleshooting for clients.