Published inDetect FYIThe Detection Opportunity CostWhat should drive picking one detection idea over another?May 1A response icon2May 1A response icon2
Published inDetect FYIBecoming a Detection Engineering Contractor, Part II— The PreparationYou want to become a contractor or an independent consultant in the Detection Engineering (DE) space? This series is for you.Mar 26A response icon1Mar 26A response icon1
Published inDetect FYIThreat Hunting step-by-step: Collecting Web Shells 🐚 using Ephemeral BaselinesTurning a KQL hunting query into a Defender detection rule to spot unusual web server processes using simple statistics.Feb 25A response icon1Feb 25A response icon1
Published inDetect FYIBaselines 101: Building Resilient, Frictionless SIEM DetectionsHow to leverage Enterprises' Circadian Window to spot unusual activity and potentially uncover cyber threats.Feb 12A response icon1Feb 12A response icon1
Published inDetect FYIBecoming a Detection Engineering Contractor, Part I — The MotivationSo you wanna become a contractor (freelancer, independent consultant) in the Detection Engineering space? Here I share my impressions.Jan 17A response icon3Jan 17A response icon3
Published inDetect FYIFrom Intelligence to Detection: A Workflow for Integrating CTI, IR, Hunting & Red TeamsIn 2017, a former software tester suggested that I should consider shipping detection content by following the SDLC, and it seemed like a…Nov 3, 2024A response icon3Nov 3, 2024A response icon3
Published inDetect FYIIs Security Analytics the key to High-Fidelity, Context-Rich Alerts?Turning massive security alerts stream into a few manageable, stats-annotated, scored, aggregated Alert Sessions.Oct 3, 2024A response icon3Oct 3, 2024A response icon3
Published inDetect FYISysmon: a viable alternative to EDR?I've been recently engaged in workshops with distinct clients from completely different industries/verticals and this is a recurring topic.Jul 4, 2024A response icon11Jul 4, 2024A response icon11
Published inCodeXData Science & Exploratory Data Analysis: the Panda versus the Pony!Exploratory data analysis sits at the core of any insightful data work. Performing log analysis in search for threats is no different.Jun 5, 2024Jun 5, 2024
Published inDetect FYIHow to prioritize a Detection Backlog?I started writing Medium stories in 2017 and the very first article was "How to rank Quick Wins", a fascinating topic that deserved another…May 13, 2024A response icon7May 13, 2024A response icon7