Mar 30The Shift-Left strategy applied to Threat DetectionThis is a quick one just to share a win I've been recently through that might be applicable or inspirational (why not?) to some while sharing my unasked opinion on SOAR — from a detection engineer perspective. Before exploring the topic deeper, check if you agree on the following needs: …Siem6 min read
Dec 13, 2021Splunk IOC Scanner: a use case every-single-SOC needsTL;DR: tstats + term() + walklex = super speedy (and accurate) queries. Leveraging Splunk terms by addressing a simple, yet highly demanded SecOps use case. How do you search for IOCs in Splunk? When you have an IP address, do you map all data sources that might contain a valid IP address entry? What if a field is…8 min read
Aug 19, 2021Anomaly-based detection workflow: leveraging the Novelty component using EDR log telemetryThis is a more technical post to exemplify how my workflow goes when designing and implementing a new detection while serving as follow-up from a previous post The role of ‘Novelty’ and ‘Behaviour’ in Computer Forensics & Detection Engineering. When you start following security researchers and their work, it’s truly…Threat Detection6 min read
Aug 10, 2021The role of ‘Novelty’ and ‘Behaviour’ in Computer Forensics & Detection EngineeringThis is just another quick blog that could not fit in a tweet which is hopefully inspiring for for all Detection Engineering teams out there. First off, let's get the definitions loud and clear: Novelty: the quality of being new, original, or unusual. Behaviour: the way in which one acts…Threat Detection3 min read
Jun 14, 2021SIEM Hyper Queries: introduction, current detection methods (part I/II)The Splunk language is very powerful. I've been writing SPL for years and I still keep discovering new ways to use it, especially when browsing the docs or the community forums trying to solve another problem. This year, I've published a query for detecting multiple flavors of password brute-force attacks…Threat Detection7 min read
Apr 30, 2021Detecting network beacons via KQL using simple spread stats functionsWhat’s a network beacon? Why is that important? Well, let’s start with a quick definition before jumping into detection design and KQL code. As Google suggests, beacon is a visible object serving as a signal or warning. That’s what we, as detection engineers, are looking for when deploying a new…Threat Detection8 min read
Mar 5, 2021Different SIEMs, Same Challenges? Only Time(Generated) will tell…I’ve recently joined BlueVoyant where I’m having a great opportunity to be part of a talented team fully dedicated to Threat Detection Engineering and Threat Hunting practices. (we’re hiring!) Among other things, besides designing detections to run on a much bigger scale (hundreds of customers), I’m finally playing with Microsoft’s…Azure5 min read
Dec 27, 2020What does it mean to be a threat detection engineer?The idea of this post came after a Slack chat with Ryan Long, a Sr. Security Analyst who had asked this very question highlighted in the blog title. Ryan as many others is realizing there’s sometimes a very thin line between analysis (operations) and engineering when it comes to threat…Siem3 min read
Nov 22, 2019JIRA workflow for Detection Engineering teamsThreat Detection Engineering practice seems to be evolving. Not only because of easier log management methods and platforms, but because attackers will easily adapt to OOB security, evading detection and achieving their goals. Nevertheless access to all this data is only the start. The challenge for Blue Teamers keeps increasing…Agile4 min read
Jun 12, 2019Threat detection metrics: exploring the true-positive spectrumI’ve had the chance to work with many great security teams during my career and in 2012, I had the opportunity to join Verizon's SOC in Germany. That was a very challenging experience considering its massive scale SecOps. It was also by that time when I realized Splunk could be…Threat Detection6 min read
