News for hackers. Stuff that matters.
Re:Detections as Code by StefanKarpinski on Monday February 01, 2021 @02:26PM (#25992545)
Fails the "what is it?" test. I don't really care to dig around. Anyone want to enlighten me and all the others who read this who have no idea: what is a detection?
Re:Detections as Code by kartikeypan on Tuesday February 02, 2021 @02:48AM (#25998313)
Sorry about that. We've now added a new section in the blog explaining more about Detections. Thanks!
Re:Detections as Code by kyrrewk on Monday February 01, 2021 @03:04PM (#25993039)
a detection is typically a rule that describes known bad or suspicious behaviour. all simple rule would just be a list of malware hashes or domain names

so instead of writing rules using tools such as YARA: https://github.com/fireeye/sunburst_countermeasures/blob/mai... (sunburst) they want to write them in python

Re:Detections as Code by kyrrewk on Monday February 01, 2021 @02:24PM (#25992505)
panther looks very interesting

i'm trying to evaluate solutions in this space and these are the ones i am aware of: chronicle security, panther and grapl

otherwise i have seen teams build their custom platform using databricks (apple did this), snowflake, or some other cloud-native data warehouse/lake

any others around?

Re:Detections as Code by jacknagz on Tuesday February 02, 2021 @12:49AM (#25997803)
FYI Panther can also integrate to Snowflake as the data backend
Re:Detections as Code by k__ on Monday February 01, 2021 @02:01PM (#25992146)
Seems like a Python only tool.

AWS CodeGuru is Java only, AFAIK.

Anyone knows good JavaScript/TypeScript tools?

Re:Detections as Code by jacknagz on Tuesday February 02, 2021 @01:01AM (#25997846)
Panther uses Python for real-time log analysis and SQL for analytics over the stored/normalized data.