1. Moscone West | 2009

Detecting complex attacks has changed from reliance on tooling like SIEM and been replaced with analyst-derived code. Whether asking the data questions to determine deviation from normal, distilling data for manual analysis or automating SOC functions, python, scripting, unique data structures and search tools are the new normal. This lab will demonstrate and teach analysts creative use of coding tools.

Download pptx
Download pdf