Show HN: Tracecat – Open-source security alert automation / SOAR alternative

Re:Show HN: Tracecat – Open-source security alert automation... by neochris on Monday March 25, 2024 @09:11PM (#39823255)

Really appreciate the advice here. I also hate security theatre. We will make it triple clear that our Cloud version is JUST for preview, not production.

Repeat (as we mentioned in our README) for anybody reading this thread: Cloud is just for preview! Upload a known malware SHA-256 sample, send it off to VirusTotal, then pass the JSON response into a LLM action to summarize. There are plenty of workflows you can run to test our platform without exposing sensitive data.

Excited to work on securing our platform though. Thanks for the basic checklist. We have a lot more work to do and will find the best security professionals to work with. There are plenty of scary good practitioners, folks who have seen and responded to APTs in their previous work, within the YC network. The first thing we did when we got into YC was network with the YC security community.

Here are some shout outs who are helping YC companies and beyond truly improve their security posture: - Oneleet: 10 year+ experienced red teamers, now building an all-in-one pentest, vCISO, vSOC, and compliance platform and service - 0Pass: FIDO2 keys as service (ex-SpaceX, Amazon Cognito security engineers) - Infisical: open source secrets management

[ Parent | on HN ]

Re:Show HN: Tracecat – Open-source security alert automation... by dogman144 on Tuesday March 26, 2024 @12:51PM (#39830047)

Same sort of questions - if the whole YC suite is secured by other YC security startups, that’s raises the same questions about where does the risk recursion stop - is anyone using yubikeys, vetted secrets management platforms, plainjane google auth, is there an internal SOC + SSO anywhere, and done by hires with actual blue team experience?

Sec teams don’t want to sign vendors to support innovation. We sign them to not get hacked, increase the odds that we’re not, and save money after. The less bread and butter deployments seen, the more skepticism is needed. Again, this model is actively exploited currently bc threat actors do this same logic.

[ Parent | on HN ]

Re:Show HN: Tracecat – Open-source security alert automation... by neochris on Tuesday March 26, 2024 @09:42PM (#39834869)

Don't assume a person doesn't have infosec experience. The person you're pointing fingers at might happen to be a data engineer who worked at a large MSSP and crypto analytics team building internal tools to solve problems security engineers could not. And picked up best practices, and few tricks or two along the way.

I'm about 2-3 pivots away from identifying who you are.

1. USAF Artillery officer 2. IR then product sec 3. Fresno State (maybe but not 100% sure, it'll be close enough) 4. Ethereum 5. I also know your age and narrowed down where you live and used to live for a short time (not US), but I'm not going to reveal that as it'll make it too easy for others to dox you and I'm not going to do that.

Don't judge a book by its cover.

[ Parent | on HN ]

Re:Show HN: Tracecat – Open-source security alert automation... by neochris on Tuesday March 26, 2024 @09:43PM (#39834881)

Also I think we would actually get along? You should just contact me on LinkedIn or Discord (if you want to stay anon). I actually like everything you said hahah. Just not the assumptions about me :)

[ Parent | on HN ]

Re:Show HN: Tracecat – Open-source security alert automation... by 0x4e53 on Wednesday March 27, 2024 @01:05PM (#39841731)

Asking if folks use Yubikeys directly after he mentions a YC company literally responsible for deploying Yubikeys.

Nice.

[ Parent | on HN ]