kyrrewk

this is cool! wish there was a commerical product that did this. marimo does something similar, but you have to do the deployment yourself

a detection is typically a rule that describes known bad or suspicious behaviour. all simple rule would just be a list of malware hashes or domain names

so instead of writing rules using tools such as YARA: https://github.com/fireeye/sunburst_countermeasures/blob/mai... (sunburst) they want to write them in python

panther looks very interesting

i'm trying to evaluate solutions in this space and these are the ones i am aware of: chronicle security, panther and grapl

otherwise i have seen teams build their custom platform using databricks (apple did this), snowflake, or some other cloud-native data warehouse/lake

any others around?

toilet seat up

I have had some success running Android x86 (http://www.android-x86.org/) in VirtualBox.