Oct 24, 2022A SIEM developer goes fishing in the data lake. What happens next?TLDR: he misses a flow-based functional processing language. Before getting into the topic, let me provide you some background and motivation, especially if you are about to embark on the 'Data Lake' wagon aiming at security use cases (SIEM). The SIEM is not the default gateway for log data This year I had a chance to work for a large…Siem7 min readSiem7 min read
Sep 20, 2022Threat Detection cost & value: a few lessons from the field.Below is a question I started asking myself some years ago when I had realized I could write log-based detection content for a living: How to determine detection value? How could customers buy a “detection” if they cannot evaluate its value? …Detection6 min readDetection6 min read
Sep 12, 2022What Threat Detection is NOT about — before they sell it to you!Detection Engineering is really making its way into the lexicon of what Cybersecurity customers demand today. After advocating for that practice for many years, I thought it would be great to share a few bullets on that. This might not only serve practitioners in the field but also product managers…Threat Detection5 min readThreat Detection5 min read
Sep 5, 2022SIEM Hyper Queries: atomic alerts, correlation and other hard truths (part II/II)Alright, it’s been more than a year after publishing the first part of this article, so time to remove it from drafts. In case you haven’t checked the first part entirely, let's start with a quick recap on what a SIEM Hyper Query is about if you want to take…Detection Engineering5 min readDetection Engineering5 min read
Mar 30, 2022The Shift-Left strategy applied to Threat DetectionThis is a quick one just to share a win I've been recently through that might be applicable or inspirational (why not?) to some while sharing my unasked opinion on SOAR — from a detection engineer perspective. Before exploring the topic deeper, check if you agree on the following needs: …Siem6 min readSiem6 min read
Dec 13, 2021Splunk IOC Scanner: a use case every-single-SOC needsTL;DR: tstats + term() + walklex = super speedy (and accurate) queries. Leveraging Splunk terms by addressing a simple, yet highly demanded SecOps use case. How do you search for IOCs in Splunk? When you have an IP address, do you map all data sources that might contain a valid IP address entry? What if a field is…8 min read8 min read
Aug 19, 2021Anomaly-based detection workflow: leveraging the Novelty component using EDR log telemetryThis is a more technical post to exemplify how my workflow goes when designing and implementing a new detection while serving as follow-up from a previous post The role of ‘Novelty’ and ‘Behaviour’ in Computer Forensics & Detection Engineering. When you start following security researchers and their work, it’s truly…Threat Detection6 min readThreat Detection6 min read
Aug 10, 2021The role of ‘Novelty’ and ‘Behaviour’ in Computer Forensics & Detection EngineeringThis is just another quick blog that could not fit in a tweet which is hopefully inspiring for for all Detection Engineering teams out there. First off, let's get the definitions loud and clear: Novelty: the quality of being new, original, or unusual. Behaviour: the way in which one acts…Threat Detection3 min readThreat Detection3 min read
Jun 14, 2021SIEM Hyper Queries: introduction, current detection methods (part I/II)The Splunk language is very powerful. I've been writing SPL for years and I still keep discovering new ways to use it, especially when browsing the docs or the community forums trying to solve another problem. This year, I've published a query for detecting multiple flavors of password brute-force attacks…Threat Detection7 min readThreat Detection7 min read
Apr 30, 2021Detecting network beacons via KQL using simple spread stats functionsWhat’s a network beacon? Why is that important? Well, let’s start with a quick definition before jumping into detection design and KQL code. As Google suggests, beacon is a visible object serving as a signal or warning. …Threat Detection8 min readThreat Detection8 min read
