Intelligent Response: Merging Threat Intel, MDR, and Incident Response for Maximum Impact

The talk starts from the problem that traditional incident response struggles with today's cases. Data volumes keep growing, flash storage loses deleted artifacts quickly, responder headcount is hard to scale, and ransomware groups set tight deadlines. Clients now run hybrid environments with cloud services, SaaS platforms and remote staff, so full disk collection no longer fits.

The speakers then walk through their stack. Cases are tracked in the open-source Iris platform, which is driven by its API and provisions case channels and forensic instances automatically. Velociraptor runs in containers across client environments to hunt at scale, using standardized hunts and imported offline collections. A separate MDR team works with SentinelOne and an extended detection service that ingests data from other vendors. A small group called Mixer bridges incident response and MDR, staying with a client from alert through recovery. A four-person labs team mines case data, profiles threat actors and returns new indicators and behaviors to the hunters. A Fog ransomware case shows the loop in practice: initial access through a compromised VPN and firewall vulnerabilities, credential theft, and encryption of ESXi hosts, with indicators passed to other clients within hours.

The practical takeaways are to share indicators across teams quickly, favor behavior-based detections over hash lists that attackers change, write targeted queries instead of pulling everything, and budget for storage and API rate limits at scale.