Detection Engineering Dispatch is a live series of 30 to 45-minute episodes featuring hands-on experiences, open discussions and live case studies with security operations teams at leading companies on what it takes to build a great detection engineering program.
Join your peers to knowledge share, deep-dive on technical best practices, and engage in discussions relevant to the detection engineering community.
Days Until The Next Live -Session
Building Thorough Detections via Detection Modeling
In this episode, Andrew VanVleet walks us through detection modeling with a Detection Data Model (DDM). We'll map out an attack technique and build a thorough detection strategy using Kerberoasting (T1558.003) – cracking a password hash using Kerberos service tickets – as an example. Then we'll employ the model to create the most thorough detection strategy we can. Crafting solid detections isn’t just about writing rules, it’s about understanding attack techniques inside and out, and you'll get a front-row seat.
%20(1).png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.png)
