Decisions and Revisions - The Ever Evolving Face of the Black Hat NOC
summary
Black Hat NOC moves from taped-on consumer kit to enterprise partners: PA‑30/50 active/passive for core, 28 Ruckus APs for Wi‑Fi serving ~1,100+ unique devices and a busiest client at ~50 GB. All packets flow into NetWitness packet capture to disk (wiped after show) and suspicious files go to Threat Grid detonation for analysis. DNS totals hit ~7M requests, outbound blocking is minimal to preserve labs, and automation adds dynamic user groups plus captive‑portal notifications; honey‑pots see few hits.
AI-written summary · about
chapters (17)
- 0:00Start
- 1:04NOC PARTNERS
- 3:54THE TEAM
- 4:12ARCHITECTURE
- 8:27THE DASHBOARDS
- 10:13MOAR DASHBOARDS!
- 10:46WIFI STATS
- 11:48DNS STATS
- 13:02EVOLUTION
- 19:32AUTOMATION
- 21:47COLLABORATION
- 26:49EMAIL SECURITY
- 27:57GDPR FTW??
- 29:16SQL INJECTION TO PUBLIC DOMAIN
- 30:27OUTBOUND WEBSHELL
- 31:15BIG FIX OR BIG BROKEN?
- 33:42PORN AWARDS
related talks
47mDecisions and Revisions - The Ever Evolving Face of the Black Hat NOC
45mThe Black Hat NOC: Greatest Hits and Holy...Cows
54mLessons and Lulz: The 5th Annual Black Hat USA NOC Report
38mThe Black Hat Europe Network Operations Center (NOC) Report
40mThe NOC Report
33mThe Black Hat Europe NOC Report
40mThe 9th Annual Black Hat USA Network Operations Center (NOC) Report
47mTales from the NOC: Going Public in Asia