Graph Based Detection and Response with Grapl
summary
Grapl is an open source graph analytics detection and response platform that ingests Sysmon or JSON logs, deduplicates entities into a master graph and claims sublinear storage growth by replacing repeated log fields with edges. It runs Python analyzers (unit testable) compiled to graph queries that execute in constant time, scores risk by summing labeled risks with stacking multipliers, and uses Jupyter notebooks for reproducible investigations. Deployment uses an AWS CDK script and the backend graph DB is Dgraph.
AI-written summary · about
chapters (28)
- 0:00Introduction
- 4:10What is a graph
- 5:15Examples of graphs
- 6:28Financial security
- 7:03Graphs
- 9:43Bloodhound
- 10:20CloudMapper
- 10:57Logs
- 13:57Nodes
- 14:29Identity
- 17:34Logbased Detection
- 19:09Word and PowerShell
- 20:51Fundamentals
- 24:47Python
- 25:45Python Analyzer
- 29:00Logbased investigations
- 30:21Finding the parent process
- 32:58Jupiter notebooks
- 34:00Lenses
- 34:42Graph
- 35:59Engagements
- 36:25Pivoting
- 36:59Pivoting behavior
- 38:00Visualization and investigation
- 39:47Grapl plugin
- 40:14Process tree analysis
- 40:39Recursive queries
- 41:13Setting up Grapl
related talks
41mGraphGen: Conducting Graph Analytics over Relational Databases
45mApplications of Graph in Fraud Detection
29mBuilding a Graph User-Interface for Malware-Analysis
27mChagu: Graph-Powered LLM Shielding and Anomaly Detection for Secure AI Pipelines
24mGuardian - fraud detection using graph analysis
17mElevating security investigations with generative AI
45mConnecting the dots to go from tabular security incident data to behavioral graph understanding
48mHunting Stealth Adversaries with Graphs & AI