There's no way out, the practices of Detection Engineering and Threat Hunting are becoming utterly important within a Cyber Security Program. How to define boundaries and establish ownership of the processes involved? Where's the overlap? Read along for some insights from the field. Give me a hunt, I give you a detection I have been writing about Detection Engineering…

The idea is to explore a few simple steps of the workflow I often use when developing Splunk dashboards that I'm sure others can benefit. I’ll start sharing more practical Splunk tips besides the usual Detection Engineering insights so stay tuned for more! Let's start with the must know, then…

In this post I describe one important building block detection engineers often rely upon when designing detections and other enrichment use cases. This topic becomes particularly important when lookups are built from dynamic, ever-changing data. Below are just a few scenarios: User accounts and devices enrichment from CMDB/Inventory IP address…

This is a short one for inspiring those planning or already adventuring with anomaly detection as part of their use cases backlog. Anomaly-based detection is the process of comparing definitions of what activity is considered normal against observed events to identify significant deviations. Above definition is from Security Controls Evaluation…

After working with many different Threat Intelligence Platforms (TIP) and Indicators of Compromise (IOC) feeds I've decided to break the primary CTI use cases down down into the following components: CTI Repository Stats: IOC repository insights via dashboards. IOC Ad-Hoc Scanner: interactive dashboard for IOC scanning. IOC Scan Framework: automated…

This is a short blog to help those focused on SOC metrics! Although I have previously covered this topic, it remains evident that effectively tracking reliable metrics demands the team to adapt and potentially implement new processes to achieve their objectives. I share here a few ideas that might be…

This is a short article highlighting the benefits of rich log telemetry when coupled with advanced Endpoint Analytics content. The exercise presented here is based on an out-of-band “Attack Lab” built by one of my colleagues in a project focused on Detection Validation process. Research/Lab Time = Better Engineering I am a data nerd, my…

This is a post to highlight the importance of rich telemetry and how it serves well for strengthening alert signals when coupling static pattern with behavioral & anomaly based indicators to detect RAT and RMM tools. TL;DR: for practical detection engineering, skip to "Tracking Patterns". RATs?! The acronym stands for Remote…

After integrating so many tools and data sources into all sorts of security monitoring workflows and processes, let me share a few thoughts in regards to SOAR and how it actually helps (or hinders) the challenge of threat detection based on log telemetry, usually tackled via a SIEM. Why SOAR? Before exploring…