PinnedMember-onlyA Research-Driven process applied to Threat Detection Engineering InputsThis article is an evolution of a previous one I wrote on Jira Workflows for Detection Engineering teams but more focused on the detection inputs and with the introduction of a new actor: the Detection Researcher. What you are going to learn here: What are the primary INPUTS for a detection idea? Who or What drives the…Detection Engineering4 min readDetection Engineering4 min read
PinnedMember-onlyThe dotted lines between Threat Hunting and Detection EngineeringThere's no way out, the practices of Detection Engineering and Threat Hunting are becoming utterly important within a Cyber Security Program. How to define boundaries and establish ownership of the processes involved? Where's the overlap? Read along for some insights from the field. Give me a hunt, I give you a detection I have been writing about Detection Engineering…Siem5 min readSiem5 min read
2 days agoMember-onlyOpportunistic by trade: when Attackers and Defenders think alikeThis article highlights part of the thought process I adopt when trying to spot malicious activity by the means of log telemetry, which is one of the primary objectives of the Detection Engineering practice. It also touches on what good defenders and attackers have in common: a good sniff for…Cyber10 min readCyber10 min read
Mar 19Member-onlyDetection Surface & the role of Endpoint TelemetryAnyone working in log-based Threat Detection knows this. Command-line telemetry is the Crème de la Crème of data sources. And we don't need much effort to verify such statement. Simply check how many TTPs one is able to monitor from such rich telemetry: …Threat Detection4 min readThreat Detection4 min read
Mar 14Member-onlyThreat Detection Bad Trips: Log Everything!Alright, this is a public service for SIEM engineers. How many times you've heard that answer when someone asks 'What should be logged?' and how hard is it today to predict the outcome of over-logging? Disclaimer: all opinions here are applicable to enterprise, corporate environments only. That's where most of…Siem3 min readSiem3 min read
Oct 24, 2022Member-onlyA SIEM developer goes fishing in the data lake. What happens next?TLDR: he misses a flow-based functional processing language. Before getting into the topic, let me provide you some background and motivation, especially if you are about to embark on the 'Data Lake' wagon aiming at security use cases (SIEM). The SIEM is not the default gateway for log data This year I had a chance to work for a large…Siem7 min readSiem7 min read
Sep 20, 2022Member-onlyThreat Detection cost & value: a few lessons from the field.Below is a question I started asking myself some years ago when I had realized I could write log-based detection content for a living: How to determine detection value? How could customers buy a “detection” if they cannot evaluate its value? Or how could I estimate value for a detection…Detection6 min readDetection6 min read
Sep 12, 2022Member-onlyWhat Threat Detection is NOT about — before they sell it to you!Detection Engineering is really making its way into the lexicon of what Cybersecurity customers demand today. After advocating for that practice for many years, I thought it would be great to share a few bullets on that. This might not only serve practitioners in the field but also product managers…Threat Detection5 min readThreat Detection5 min read
Sep 5, 2022Member-onlySIEM Hyper Queries: atomic alerts, correlation and other hard truths (part II/II)Alright, it’s been more than a year after publishing the first part of this article, so time to remove it from drafts. In case you haven’t checked the first part entirely, let's start with a quick recap on what a SIEM Hyper Query is about if you want to take…Detection Engineering5 min readDetection Engineering5 min read
Mar 30, 2022Member-onlyThe Shift-Left strategy applied to Threat DetectionThis is a quick one just to share a win I've been recently through that might be applicable or inspirational (why not?) to some while sharing my unasked opinion on SOAR — from a detection engineer perspective. Before exploring the topic deeper, check if you agree on the following needs: …Siem6 min readSiem6 min read
