<description>&lt;p dir="ltr"&gt;Guest:&lt;/p&gt; &lt;ul&gt; &lt;li dir="ltr" aria-level="1"&gt; &lt;p dir="ltr" role="presentation"&gt;&lt;a href= "https://www.linkedin.com/in/behemoth/"&gt;Amine Besson&lt;/a&gt;, Tech Lead on Detection Engineering, Behemoth Cyberdefence&lt;/p&gt; &lt;/li&gt; &lt;/ul&gt; &lt;p dir="ltr"&gt;Topics:&lt;/p&gt; &lt;ul&gt; &lt;li dir="ltr" role="presentation"&gt;What is your best advice on detection engineering to organizations who don’t want to engineer anything in security? &lt;/li&gt; &lt;li dir="ltr" role="presentation"&gt;What is the state of art when it comes to SOC ? Who is doing well? What on Earth is a fusion center? &lt;/li&gt; &lt;li dir="ltr" role="presentation"&gt;Why classic “tiered SOCs” fall flat when dealing with modern threats?&lt;/li&gt; &lt;li dir="ltr" role="presentation"&gt;Let’s focus on a correct definition of detection as code. Can you provide yours?&lt;/li&gt; &lt;li dir="ltr" role="presentation"&gt;Detection x response engineering - is there a thing called “response engineering”? Should there be?&lt;/li&gt; &lt;li dir="ltr" role="presentation"&gt;What are your lessons learned to fuse intel, detections, and hunting ops?&lt;/li&gt; &lt;li dir="ltr" role="presentation"&gt;What is this &lt;em&gt;SIEMless&lt;/em&gt; yet &lt;em&gt;SOARful&lt;/em&gt; detection architecture?&lt;/li&gt; &lt;li dir="ltr" role="presentation"&gt;What’s next with &lt;a href= "https://code.europa.eu/ec-digit-s2/opentide"&gt;OpenTIDE 2.0&lt;/a&gt;?&lt;/li&gt; &lt;/ul&gt; &lt;p dir="ltr"&gt;Resources:&lt;/p&gt; &lt;ul&gt; &lt;li dir="ltr" role="presentation"&gt;&lt;a href= "https://medium.com/anton-on-security/guide-your-soc-leaders-to-more-engineering-wisdom-for-detection-part-9-a46319bd362c"&gt; Guide your SOC Leaders to More Engineering Wisdom for Detection (Part 9)&lt;/a&gt; and other parts linked there&lt;/li&gt; &lt;li dir="ltr" role="presentation"&gt;&lt;a href= "https://www.youtube.com/watch?v=lng-87nRTGQ"&gt;Hack.lu 2023: TIDeMEC : A Detection Engineering Platform Homegrown At The EC video&lt;/a&gt;&lt;/li&gt; &lt;li dir="ltr" role="presentation"&gt;&lt;a href= "https://code.europa.eu/ec-digit-s2/opentide"&gt;OpenTIDE · GitLab&lt;/a&gt; &lt;/li&gt; &lt;li dir="ltr" role="presentation"&gt;&lt;a href= "https://code.europa.eu/groups/ec-digit-s2/opentide/-/wikis/Blog/%5B2024-03-11%5D-OpenTIDE-1.0-Release"&gt; OpenTIDE 1.0 Release blog&lt;/a&gt;&lt;/li&gt; &lt;li dir="ltr" role="presentation"&gt;&lt;a href= "https://posts.specterops.io/on-detection/home"&gt;SpectreOps blog series ‘on detection’&lt;/a&gt;&lt;/li&gt; &lt;li dir="ltr" role="presentation"&gt;&lt;a href= "https://www.slideshare.net/slideshow/future-of-soc-more-security-less-operations/267023230"&gt; Does your SOC have  NOC DNA? presentation&lt;/a&gt;&lt;/li&gt; &lt;li dir="ltr" role="presentation"&gt;&lt;a href= "https://medium.com/anton-on-security/kill-soc-toil-do-soc-eng-50f29bfe52bd"&gt; Kill SOC Toil, Do SOC Eng&lt;/a&gt; blog (&lt;a href= "https://cloud.google.com/blog/products/identity-security/achieving-autonomic-security-operations-reducing-toil"&gt;tame version&lt;/a&gt;)&lt;/li&gt; &lt;li dir="ltr" role="presentation"&gt;&lt;a href= "https://services.google.com/fh/files/misc/googlecloud_autonomicsecurityoperations_soc10x.pdf"&gt; The original ASO paper&lt;/a&gt; (2021, still epic!)&lt;/li&gt; &lt;li dir="ltr" role="presentation"&gt;&lt;a href= "https://redcanary.com/blog/security-operations/detection-engineering/"&gt; Behind the Scenes with Red Canary's Detection Engineering Team&lt;/a&gt;&lt;/li&gt; &lt;li dir="ltr" role="presentation"&gt;&lt;a href= "https://thedfirreport.com/"&gt;The DFIR Report – Real Intrusions by Real Attackers, The Truth Behind the Intrusion&lt;/a&gt;&lt;/li&gt; &lt;li dir="ltr" role="presentation"&gt;&lt;a href= "https://cloud.google.com/sre?hl=en"&gt;Site Reliability Engineering (SRE) | Google Cloud&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt; &lt;/p&gt;</description>

Cloud Security Podcast by Google

Anton Chuvakin

EP202 Beyond Tiered SOCs: Detection as Code and the Rise of Response Engineering

DEC 9, 202437 MIN
Cloud Security Podcast by Google

EP202 Beyond Tiered SOCs: Detection as Code and the Rise of Response Engineering

DEC 9, 202437 MIN

Description

Guest:

  • Amine Besson, Tech Lead on Detection Engineering, Behemoth Cyberdefence

Topics:

  • What is your best advice on detection engineering to organizations who don’t want to engineer anything in security? 
  • What is the state of art when it comes to SOC ? Who is doing well? What on Earth is a fusion center? 
  • Why classic “tiered SOCs” fall flat when dealing with modern threats?
  • Let’s focus on a correct definition of detection as code. Can you provide yours?
  • Detection x response engineering - is there a thing called “response engineering”? Should there be?
  • What are your lessons learned to fuse intel, detections, and hunting ops?
  • What is this SIEMless yet SOARful detection architecture?
  • What’s next with OpenTIDE 2.0?

Resources: