LASCON X

You have SIEM & NetFlow to catch the adversary, but can you query your data for useful information? Do you truly understand what is leaving your network?

This talk is for security professionals and developers who are curious about helping the SecOps folks.

General security knowledge is all that is required to benefit from this talk, but seasoned security gurus will find this helpful too.

We will discuss an ingenious approach to log analysis that augments enterprise security monitoring tools; specifically we will look at analyzing outbound network traffic.

I will cover the visibility gap and how with a bit of scripting I created a tool to quickly discover the most relevant information.

You will leave with specific ideas you can implement in your organization to augment and enhance your threat hunting and blue team operations.