Collect All the Data; Protect All the Things
summary
Argues that reducing mean discovery from ~146 days requires collecting network, host, application and telemetry data and correlating it, showing concrete tools and signals: NetFlow/Zeek sessions, Suricata/Snort signatures (example: nmap 0–65535 scans only detect ~5 ports), session visualization with Moloch/Arkime, JA3 TLS hashes for encrypted-traffic whitelisting, DNS entropy for DGA detection, OSQuery plus Sysmon/PowerShell for endpoint forensics, telemetry voltage baselines for supply‑chain anomalies, ELK/Kibana + Apache Spark statistical ML, and Hive/Cortex to triage alerts that match across domains.
AI-written summary · about
chapters (15)
- 0:00Start
- 3:54Signature Analysis
- 6:49Bro Internal Scanning Script
- 7:17Internal Scanning Alerts
- 7:27Visualize the Data with Moloch
- 9:13Machine Logs
- 13:18Telemetry Streams
- 13:31Telemetry Basics
- 15:34Endpoint Analysis
- 16:43Defensive PowerShell
- 18:52Application Logs
- 19:34Calculate Entropy with a Bro Script
- 20:10Protocol Metadata
- 21:45Visualizing the Data with the ELK Stack
- 23:45Questions?
related talks
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce
29mDetection Engineering: Defending Networks with Purpose
01h 05mPractical network defense at scale
43mBuilding a network security practice in your organization | Pannel Discussion
49mA Real-World Example of Using Network Behaviour to Detect Cyber-Compromise
39mImproving OT Network and Host Baselines to Secure Critical Infrastructure
54mLessons and Lulz: The 5th Annual Black Hat USA NOC Report
31mCollection is not Detection - Sec Ops in a Cloud Native Environment