Steve Cooper

Should a detection engineering team be expected to have detection engineering requirements similar to a cti team?

Would it add value or friction?

Nice, had not seen that one before. I like the hand drawn look!

na my bad, thought you were subtweeting something! It's a nuanced subject for 240 chars!

What tools are peole using for threat intelligence diagrams these days? Are there any cool AI diagramming tools out now?

I typically use draw io since it's free but I'm a lackluser designer so need al the help I can get!

My comment was in relation to the paper that has been recently shared around social media. I think you’re right that it’s about outcomes not metrics.

www.computer.org/csdl/proceed...

Saw a study saying same. Not sure I agreed with their methodology

Very hard thing to measure since major incidents are a sparse dataset in single companies. Even meta analysis is difficult because extracting only impact of phishing training out of entire transformation program is impossible

Fantastic write up. Some really interesting tradecraft and the definition of APT.

But also highlights some foundational detections all orgs should have around suspicions process locations, cred access, etc.

Even using sophisticated techniques most attackers still leave tracks!

I use and like both but lean towards Windows these days. Better ui and window management, file mgt, games.

Mac did make using Linux tools, docker and devops tooling easier. However WSL solves that now.

I still like my M1 ‘s battery life and cool running! M4 max looks awesome for local LLM too!

Good blog!

All comes down to really understanding your org, data and use case. And expectations on recall versus precision.

Also not every use case needs to run hourly. Longer windows and schedules may actaully be better for analytics focused detections and avoid the lag problem entirely.

Someone really has the knives out for Google!

Feels destructive and lacking clear understanding of the market. Search is about to get disrupted big time.

Yea vital to have good knowledge of search languages. Most big orgs will be Splunk SPL or Sentinel KQL.

Sigma and uncoder.io are great!

If you wanted to help someone go zero to hero as a detection engineer what resources would you suggest?