How I Learned to Stop Worrying and Build a Modern Detection & Response Program
summary
A four‑phase framework maps assess/analyze, design/develop, implement, and evaluate/report to turn noisy legacy SOCs into proactive programs that prioritize automation and business context. It prescribes intel-driven detection fed by threat modeling and MITRE ATT&CK, capability maps (not product categories), and micro purple tests that run ATT&CK techniques across landscapes (endpoints vs containers) and score pass/fail to reveal gaps. Metrics focus on observability, detection efficacy/accuracy/efficiency, and incident narratives to justify roadmap, budget, and hires.
AI-written summary · about
chapters (6)
- 0:00Modern detection intro
- 3:56Legacy vs modern programs
- 12:08Designing like a story
- 24:33Budget and headcount limits
- 28:06Legacy to modern reporting
- 35:58Q&A
related talks
29mBuilding a Security Operations Program
37mThreats versus Capabilities Building Better Detect and Respond Capabilities
34mA Blueprint for Detection Engineering: Tools, Processes, and Metrics
42mThe Fault in Our Metrics: Rethinking How We Measure Detection & Response
20mDynamic Defense: Crafting threat models with real-world Intelligence
49mTraining for Incident Response: The Red, the Blue, and the Ugly
32mThe SOC Of The Future… The Future Is Now
30mShall We Play a Game?