Detection Engineering 101 : Establishing a Structured Approach to Detection Engineering

Overview: As defenders, we are always outnumbered, but we are by no means outmaneuvered. Attackers may hide in the haystack of haystacks, but with scalable detection logic, efficient coding practices, a thorough investigation methodology, and a reasonable corpus of computing, we can still determine which haystack to look within, and subsequently find the needle. This is often made possible by a detection pipeline. And knowing how detection pipelines work, and the role each component plays, can help us wri

Key Topics: te more efficient, more accurate detections to make life hard for the attacker. By reducing the attacker's window of opportunity, whilst making the subsequent investigation easier for the would-be analyst, we can maintain a strong defensive position, forcing the attacker to burn significantly more resources in an attempt to make progress. This workshop will run attendees through implementing a simple detection pipeline in code, and some basic detection rules, to understand how to: - Ingest and normalize arbitrary log data, and make such data available for downstream detection rules; - Implement detection logic, to isolate potentially maliciou

Takeaways: aiding investigation; and - Draw relationships from individual log entries, to reduce investigative noise. Attendees should be comfortable with either Python 3 or Golang, including core language syntax and the execution environment of their preferred language.