Detections as Code

Re:Detections as Code by StefanKarpinski on Monday February 01, 2021 @02:26PM (#25992545)

Fails the "what is it?" test. I don't really care to dig around. Anyone want to enlighten me and all the others who read this who have no idea: what is a detection?

[ Parent | on HN ]

Re:Detections as Code by kartikeypan on Tuesday February 02, 2021 @02:48AM (#25998313)

Sorry about that. We've now added a new section in the blog explaining more about Detections. Thanks!

[ Parent | on HN ]

Re:Detections as Code by kyrrewk on Monday February 01, 2021 @03:04PM (#25993039)

a detection is typically a rule that describes known bad or suspicious behaviour. all simple rule would just be a list of malware hashes or domain names

so instead of writing rules using tools such as YARA: https://github.com/fireeye/sunburst_countermeasures/blob/mai... (sunburst) they want to write them in python

[ Parent | on HN ]