1. Security Operations Without Going Blind
Greg Taylor-Broun, Product Strategist

2. Challenge #1
Majority of analysts don’t enjoy continuous security monitoring nor do they rate is as particularly valuable to their primary objective
Voice of the Analyst Survey, Cyentia Institute

3. Challenge #2
Hiring and retaining analysts

4. Challenge #3
We’ll never be able to look at everything with human analysis
Telemetry
IDS/IPS, AV, Web Proxy, EDR
Pattern-matching
Log Platform
Collectors, Forwarders and DB
Aggregation, Filtering & Storage
Rules, Queries & ML
SIEM, UEBA, ML
Correlation & Anomalies
Consoles & Dashboards
Human Analytics
Human Security Monitoring

5. Security Analyst role Investigate Threat Prioritize & Escalate
Receive feedback & improve
Operational
Duties
Scope & Build Case
Environmental Awareness
Foundational
Knowledge
Security Expertise

6. You’re the Analyst How would you analyze this Network IPS event?
: > :443, SQL Injection, 6Aug16, 20:08:03, Exploitation, Permit, Medium

7. You’re the Analyst How would you analyze this Network IPS event?
Source Port
Ephemeral?
Destination Port
Server Port?
Attack Category
Which attack stage?
Severity
How severe?
: > :443, SQL Injection, 6Aug16, 20:08:03, Exploitation, Permit, Medium
Source IP
Ext or Int?
Tor Exit Node?
Public VPN?
Country of Origin?
Is an IOC?
Destination IP
Vulnerable?
Port open?
Change ticket?
Critical Asset?
Signature
Modern?
Recently updated?
Seen in an incident?
False positive?
Date and Time
Suspicious Pattern?
False positive pattern?
Device Action
Blocked?
Allowed?
Now do this 170 times an hour in a hour shift!!

8. Modeling Human Decision Making
Expert system and Bayesian Network

9. Rule Logic vs. Probabilistic Reasoning
Probability theory is nothing but common sense reduced to calculation.
Pierre-Simon Laplace

10. Security Operations Center Respond Software AI Expert System
Strategy & Approach
We’re moving to a new model for security monitoring and analysis
Security Operations Center
Business Focused Analytics
8x5 Operations
Incident Response
Hunting & Investigation Business Focused Use Cases
&
Respond Software AI Expert System
24/7 Monitoring, Scoping & Escalation Complete Visibility of Core Use Cases Business Context
Local and Global Learning
Elevate your analysts

11. Questions