Detection Lead @ Mandiant Managed Defense / Former IR Consultant @mandiant. Tier 3 Hipster; I came in like a #WrectorBall
San Francisco, CA
Joined July 2012
- Tweets318
- Following409
- Followers1.3K
- Likes1.2K
Great cross team collaboration across Google Cloud to get this service off the ground. Let's find some evil!
Just announced in preview: Mandiant Hunt for Chronicle Security Operations! This new service is tailored to organizations with existing security programs who want a threat hunting capability to discover new threats that may be missed by product detection.
cloud.google.com/blog/produc…
Andy Rector retweeted
I’m proud to present ProtoBurp, a new Burp Suite extension to help encode and fuzz Protobuf messages based on pain points with existing tooling.
Check out my latest blog post about it! dillonfrankesecurity.com/pos…
#pentesting #burpsuite #protobuf #offsec
I don't feel like this is the right question. Threat hunting is a function of detection engineering, where detections are being tested and matched against customer telemetry. If not matches, no additional work. The question we should be asking is what is the service hunting for?
I couldn't be prouder of my team for the work they did to implement auto containment at scale in Managed Defense. Auto containment stops impactful threats in their tracks.
Jon's tweet alludes to the challenge that this entails.
Here's a🧵on how we did it, and it's impact⬇️
How many folks perform auto remediation actions on alert creation?
E.g, an EDR alert is created with “Critical” severity; when any “Critical” sev EDR alert is created, auto contain the host(s). If alert is marked as “fp/benign” auto remove containment. If else, keep contained.
28%Nope. Hard pass.
28%For a small % of alerts.
6%For most/all alerts.
38%Show me the results.
361 votes • Final resultsI don't think it's unreasonable to say that auto containment protects networks from ransomware deployment. There are so many wins in auto containment, ranging from solid application of theory (funnel) to providing the analyst everything they need to know to respond quickly, to
straight up stop threat in its tracks. This work is built on the A+ efforts of teammates like @tommysec and @PootSoHard and many more to maintain and improve the entire system.
It turns out in Security Operations, Whack-A-Mole can work very well!
Question for Threat Intelligence Analysts, and SOC alike... would you consider Detection Rules Threat Intel?
Curious on the perspective of consumers of DE content whether or not Detection Rules should be considered Threat Intelligence or not.
29%As SOC, yes
38%As CTI, yes
17%As SOC, no
17%As CTI, no
24 votes • Final resultsStrong agreement here. Detection Engineering is an exercise in labeling and classifying security relevant data.
FP reduction is critically important in reducing alert fatigue, but the opportunity to tune comes directly from SOC dispositions. It's the best feedback loop you have
This Post is from an account that no longer exists. Learn more
I don't think ASO is about replacing humans and being fully automated. It's about leveling up analysts to become analyst/engineer hybrids. The industry talks all day about the talent shortage, and it's not getting better. ASO is an answer to that. It provides a blueprint for 1/2
🧵 the 'Autonomous SOC' is a pipedream. 1/n
forrester.com/blogs/the-auto…
If you're in the Detection Engineering space, come watch @FryGuy2600 and I geek out on all things DE. We have the following planned:
1️⃣ Establish what DE is and isn't
2️⃣ Details on the DE process from a practitioners perspective
3️⃣ DE Maturity model
4️⃣ Measuring success
🎯🎯🎯
Attending #mWISE? Catch our CTO Fred Frey (@FryGuy2600) and @Mandiant's Andrew Rector (@DetectorRector) for their talk 10/19 at 3:15 about #detectionengineering and leveraging tech + teams in a repeatable process, driving robust, resilient, and efficient detection development.
For some context on this poll, this is a fun conversation we've been having internally. I've landed on both, for the following reasons:
1️⃣ Vendors/MSSP have constraints on how they can craft their logic. High efficacy, low FP.
2️⃣ Vendors/MSSP have competing opp queues.
