Eiffel: A Tool to Oversee Incident Response From the Heights
summary
Eiffel ingests KAPE outputs and Velociraptor JSON into a normalized data lake, runs SIGMA-based alerts (about 3,000 community rules plus 65 lab-created rules), and surfaces needles across hundreds of hosts via an evidence gateway and analytic layer. Phase one triage yields ~300 MB per host (83 hosts), phase two ~1.5 GB per host; the stack is ~17,000 LOC. A cloud-backed forensic assistant prototype exists with preprocessing to limit hallucinations; it scales and speeds remote DFIR without replacing analysts.
AI-written summary · about
chapters (15)
- 0:00Welcome
- 1:25Cyber Security Agency overview
- 3:57Remote incident challenges
- 6:07Evidence gateway platform
- 8:14Paris analytic layer
- 10:23Alerting and detection
- 12:51Threat hunting integration
- 14:13Technical hurdles and failures
- 16:00Data normalization with ECS
- 17:49Threat hunting in heterogeneous environments
- 19:17AI for forensic assistance
- 21:04Live demo: Paris platform
- 25:06Future plans and open source
- 26:10Sysmon telemetry expansion
- 27:14Conclusions and next steps
related talks
01h 05mPractical network defense at scale
32mKeynote: Incident Investigation at Planetary Scale
40mApplying Artificial Intelligence to the Incident Response Function
42mEverything Everywhere All at Once: A Guide to Alert Triage and Analysis
20mSIEM with Elastic – Insights for Security, Freedom for DevOp
47mDetection as Code: The Engineering-Focused Future...
28mSecurity Kill Chain Stages in a 100k+ Daily Container Environment with Falco
29m📙 Incident Readiness You and Your Leaders Will Actually Trust 🔥