Adversaries, especially APT groups, routinely stand up infrastructure on domains registered days or hours before an operation begins. By the time a domain shows up on a reputation blocklist, the campaign may already be underway. This talk introduces NRD-db, an open-source Docker/Redis pipeline that ingests newly registered domains then feeds that intelligence directly into Arkime’s WISE tagging.

I’ll cover the architecture, then demo it live: recognizing a newly-registered domain in Arkime sessions and pivoting through existing enrichment data tools to assess it as a potential APT staging point.

Takeaways: a deployable open-source tool and a practical WISE integration pattern for anyone running network security monitoring or threat hunting with Arkime. Aimed at analysts and engineers from beginner to advanced.

github.com/StrackVibes/NRD-db

In this presentation we will go over, “What is JA4+?”

And how to use JA4+ to identify:

• Suspicious/malicious connections through residential proxies and VPNs
• Bots
• AI agents and scrapers
• Exploit tools
• DDoS tools
• Malware
• Devices and software on the network
• Malicious servers / C2s on the Internet
• Reverse SSH shells

We’re basically going to show you how to solve the internet in about 45 minutes.

Manually enriching indicators is slow, repetitive work. This talk covers what Cont3xt is and where it came from, how to actually use it day to day and pair it with Arkime, the integrations it ships with, and its MCP support.

Takeaways: a look at what Cont3xt is, what it can do for you, and why it deserves a place in your toolkit.