There's no way out, the practices of Detection Engineering and Threat Hunting are becoming utterly important within a Cyber Security Program. How to define boundaries and establish ownership of the processes involved? Where's the overlap? Read along for some insights from the field. Give me a hunt, I give you a detection I have been writing about Detection Engineering…

This is a post to highlight the importance of rich telemetry and how it serves well for strengthening alert signals when coupling static pattern with behavioral & anomaly based indicators to detect RAT and RMM tools. TL;DR: for practical detection engineering, skip to "Tracking Patterns". RATs?! The acronym stands for Remote…

After integrating so many tools and data sources into all sorts of security monitoring workflows and processes, let me share a few thoughts in regards to SOAR and how it actually helps (or hinders) the challenge of threat detection based on log telemetry, usually tackled via a SIEM. Why SOAR? Before exploring…

This article highlights part of the thought process I adopt when trying to spot malicious activity by the means of log telemetry, which is one of the primary objectives of the Detection Engineering practice. It also touches on what good defenders and attackers have in common: a good sniff for…

Anyone working in log-based Threat Detection knows this. Command-line telemetry is the Crème de la Crème of data sources. And we don't need much effort to verify such statement. Simply check how many TTPs one is able to monitor from such rich telemetry: In short, detection-wise, those logs do provide…

Alright, this is a public service for SIEM engineers. How many times you've heard that answer when someone asks 'What should be logged?' and how hard is it today to predict the outcome of over-logging? Disclaimer: all opinions here are applicable to enterprise, corporate environments only. That's where most of…

TLDR: he misses a flow-based functional processing language. Before getting into the topic, let me provide you some background and motivation, especially if you are about to embark on the 'Data Lake' wagon aiming at security use cases (SIEM). The SIEM is not the default gateway for log data This year I had a chance to work for a large…

Below is a question I started asking myself some years ago when I had realized I could write log-based detection content for a living: How to determine detection value? How could customers buy a “detection” if they cannot evaluate its value? …

Detection Engineering is really making its way into the lexicon of what Cybersecurity customers demand today. After advocating for that practice for many years, I thought it would be great to share a few bullets on that. This might not only serve practitioners in the field but also product managers…