The Black Hat NOC: Greatest Hits and Holy...Cows
summary
The Black Hat NOC describes concrete engineering: partners supply Palo Alto firewalls, Gigamon taps, Ruckus APs, Cisco Threat Grid sandboxing, RSA NetWitness and ThreatConnect, and CenturyLink two 10‑gig pipes; the NOC scales from ~1,200 to ~20,000 attendees and teams from a few people to ~75. Dashboards include an OIP visual map that flags scans, automated pipelines pivoting NetWitness → ThreatGrid → ThreatConnect trigger a captive portal to warn impacted users, registration machines run endpoint protection and decryption, and a submitted sample once scanned 10,000 hosts and attempted crypto‑mining plus ransomware.
AI-written summary · about
chapters (28)
- 0:00Intro
- 2:03NOC Team
- 4:23Architecture
- 7:20Devices
- 9:47Dashboards
- 12:42Threat Grid
- 13:44Darkness
- 16:27Evolution
- 18:15Stability
- 20:26Operational Intelligence
- 23:10ThreatGrid
- 27:22Automation
- 29:54Briefings
- 30:35Captive Portal
- 32:23Greatest Hits
- 35:41VPNs
- 36:14Financial Documents
- 37:18Zero Day
- 37:51Casino Security
- 38:44Police Attack
- 39:33Seat Change
- 40:08Barcodes
- 40:36Folders
- 41:17BigFix
- 41:59Corporatejira
- 42:19Singapore
- 42:53Pop3 Spam
- 43:23Physical Devices
related talks
54mLessons and Lulz: The 5th Annual Black Hat USA NOC Report
38mThe Black Hat Europe Network Operations Center (NOC) Report
47mDecisions and Revisions - The Ever Evolving Face of the Black Hat NOC
45mDecisions and Revisions - The Ever Evolving Face of the Black Hat NOC
33mThe Black Hat Europe NOC Report
40mThe 9th Annual Black Hat USA Network Operations Center (NOC) Report
40mThe NOC Report
47mTales from the NOC: Going Public in Asia