Streamlining Threat Hunting in Cloud Environments with Jupyter
summary
Jupyter notebooks load CloudTrail and Azure audit CSVs from S3, run NetworkX mapping to MITRE ATT&CK, and flag concrete actions like disabling Defender, deleting logs or policies, and non‑MFA console logins. An autoencoder trains on features (IP, account, error codes) to surface autoencoder anomaly detection, using threshold = mean + 2σ; example result is ~2,000 anomalies from 100k events. A notebook visualization highlights a 4 GB Graph API in 30 minutes from one IP, generates high‑fidelity alerts, and can push findings into SIEM via an automated pipeline.
AI-written summary · about
chapters (8)
- 0:00Introduction to threat hunting
- 4:55Limitations of traditional hunting
- 7:07Azure logs fundamentals
- 10:15Threat hunting with Jupyter
- 18:32AWS CloudTrail logs
- 22:48Machine learning for detection
- 27:00Takeaways and automation
- 28:26Q&A session
related talks
48mCatch Me if You Can: Hunting Cloud Exfiltration Using Anomaly Detection
48mHunting Stealth Adversaries with Graphs & AI
28m"Cyber Security Investigations with Jupyter Notebooks"
28mPatterns for scalable security detections on AWS
29mThresholds Are for Old Threats: Demystifying AI and Machine Learning to Enhance SOC Detection
01h 02mAzure Identity and Security
50mHunting Supply Chain Threats Using Anomaly Detection
49mFight Smarter: Accelerate Your SOC with AI Discovered Attacks