The Black Hat Europe NOC Report
summary
Black Hat NOC shows the actual setup: Gigamon taps feeding NetWitness, IronNet NDR, Palo Alto firewalls and Cisco Meraki Wi‑Fi, with Threat Grid sandboxing for payloads. The deployed stack captures about 228 million packets (5.3 billion log events on a decoder), uses PA-5260s for core firewalling, and mirrors traffic into hunting tools via Gigamon. Teams build the network in two days, detonate samples, notify infected machines seen beaconing to C2, and wipe all captures after the event.
AI-written summary · about
chapters (21)
- 0:00Black Hat Europe NOC intro
- 1:50Industry partner collaboration
- 3:57NOC network architecture
- 6:45Open-source to enterprise NOC
- 9:58Network setup process and partner contributions
- 10:40Monitoring dashboards and visibility
- 12:04Year-over-year network stats
- 13:27Packet and log capture metrics
- 14:54Malicious traffic analysis
- 15:55TLS and threat intelligence
- 16:37Critical security vulnerabilities
- 18:22Network stability vs security
- 20:27Threat hunting in hostile networks
- 21:52Malware sandboxing process
- 22:54Identity and access management
- 23:57Directionality in network traffic
- 25:22Misconfigured endpoint security
- 26:46Proactive threat notifications
- 27:48Chrome extension malware case
- 29:12Registration server security
- 30:38International show threats
related talks
54mLessons and Lulz: The 5th Annual Black Hat USA NOC Report
38mThe Black Hat Europe Network Operations Center (NOC) Report
45mThe Black Hat NOC: Greatest Hits and Holy...Cows
47mDecisions and Revisions - The Ever Evolving Face of the Black Hat NOC
40mThe NOC Report
45mDecisions and Revisions - The Ever Evolving Face of the Black Hat NOC
40mThe 9th Annual Black Hat USA Network Operations Center (NOC) Report
47mTales from the NOC: Going Public in Asia