SlideShare una empresa de Scribd logo
1 de 13
Descargar para leer sin conexión
ALERT FIDELITY
NVIEW MDR
MARTIN POTGIETER - MARCH 2019
ALERTS
[DETECTORS]
{RULES}
(WATCHERS)
WHAT
ARE
ALERTS
STATUS
QUO
CANNED
QUALITY ALERTS REDUCE DWELL TIME
SHORTER DWELL TIME REDUCES BUSINESS IMPACT
DWELL TIME AVERAGES
FIREEYE M-TRENDS REPORT 2018
Average global
dwell time
decreased from
101 to 78 days
in 2018
HOW DO WE MEASURE IT?
WHAT ARE SOME ALERT METRICS
0 9 18 27 36
SIMPLICITY
CERTAINTY
RESILIENCY
RELEVANCY
THIS IS AN “EDWARDS-VENN” DIAGRAM
IS THERE A RELATIONSHIP BETWEEN THE METRICS?
Sweet Spot?
RELEVANCE
RELEVANCE IS NOT SO OBJECTIVE
LETS LOOK AT SOME REAL ALERTS
LETS LOOK AT SOME SAMPLE ALERTS
PASSWORD SPRAY ATTEMPT DETECTED
▸ Looks at failed logons with multiple usernames.
SIMPLICITY
CERTAINTY
RESILIENCY
RELEVANCY
0 2,5 5 7,5 10
Rarely triggers falsely, Unlikely to not trigger.
No AI required here - AD audit requirements
Great resiliency, but can bypass with time.
100% relevant - common method to guess passwords.
LETS LOOK AT SOME SAMPLE ALERTS
SPIKE IN 400 ERRORS ON WEB APPLICATION
▸ Looks for a dramatic increase in HTTP 400 Errors.
SIMPLICITY
CERTAINTY
RESILIENCY
RELEVANCY
0 2,5 5 7,5 10
This one is kinda noisy,
some false positives.
No AI required here. Simple measurement
Web Apps are common targets.
Fairly Resilient
LETS LOOK AT SOME SAMPLE ALERTS
MULTIPLE UNIQUE LOGONS FROM SAME SOURCE
▸ Looks for multiple user accounts from same source.
SIMPLICITY
CERTAINTY
RESILIENCY
RELEVANCY
0 2,5 5 7,5 10
NOT!
Not too complicated, but needed tuning.
Nothing to measure against.
Somewhat - if it worked.
IN CLOSING
TAKE AWAYS
▸ Alert quality matters.
▸ Tune but don’t tune out.
▸ Chuck bad alerts out.
▸ Relevancy - Important but requires maturity

Más contenido relacionado

Último

IAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI SolutionsIAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI Solutions
Enterprise Knowledge
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
Joaquim Jorge
 

Último (20)

Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organization
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
 
Slack Application Development 101 Slides
Slack Application Development 101 SlidesSlack Application Development 101 Slides
Slack Application Development 101 Slides
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptxFactors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
IAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI SolutionsIAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI Solutions
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 

Destacado

How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
ThinkNow
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
Kurio // The Social Media Age(ncy)
 

Destacado (20)

Product Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage EngineeringsProduct Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage Engineerings
 
How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
 
Skeleton Culture Code
Skeleton Culture CodeSkeleton Culture Code
Skeleton Culture Code
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best Practices
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
 
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
 
12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work
 

Alert Fidelity Measuring Detection Quality - march2019

  • 1. ALERT FIDELITY NVIEW MDR MARTIN POTGIETER - MARCH 2019
  • 4. QUALITY ALERTS REDUCE DWELL TIME SHORTER DWELL TIME REDUCES BUSINESS IMPACT
  • 5. DWELL TIME AVERAGES FIREEYE M-TRENDS REPORT 2018 Average global dwell time decreased from 101 to 78 days in 2018
  • 6. HOW DO WE MEASURE IT? WHAT ARE SOME ALERT METRICS 0 9 18 27 36 SIMPLICITY CERTAINTY RESILIENCY RELEVANCY
  • 7. THIS IS AN “EDWARDS-VENN” DIAGRAM IS THERE A RELATIONSHIP BETWEEN THE METRICS? Sweet Spot?
  • 9. LETS LOOK AT SOME REAL ALERTS
  • 10. LETS LOOK AT SOME SAMPLE ALERTS PASSWORD SPRAY ATTEMPT DETECTED ▸ Looks at failed logons with multiple usernames. SIMPLICITY CERTAINTY RESILIENCY RELEVANCY 0 2,5 5 7,5 10 Rarely triggers falsely, Unlikely to not trigger. No AI required here - AD audit requirements Great resiliency, but can bypass with time. 100% relevant - common method to guess passwords.
  • 11. LETS LOOK AT SOME SAMPLE ALERTS SPIKE IN 400 ERRORS ON WEB APPLICATION ▸ Looks for a dramatic increase in HTTP 400 Errors. SIMPLICITY CERTAINTY RESILIENCY RELEVANCY 0 2,5 5 7,5 10 This one is kinda noisy, some false positives. No AI required here. Simple measurement Web Apps are common targets. Fairly Resilient
  • 12. LETS LOOK AT SOME SAMPLE ALERTS MULTIPLE UNIQUE LOGONS FROM SAME SOURCE ▸ Looks for multiple user accounts from same source. SIMPLICITY CERTAINTY RESILIENCY RELEVANCY 0 2,5 5 7,5 10 NOT! Not too complicated, but needed tuning. Nothing to measure against. Somewhat - if it worked.
  • 13. IN CLOSING TAKE AWAYS ▸ Alert quality matters. ▸ Tune but don’t tune out. ▸ Chuck bad alerts out. ▸ Relevancy - Important but requires maturity