The Black Hat Europe Network Operations Center (NOC) Report
summary
Black Hat NOC teams describe running a vendor-integrated network with Palo Alto, NetWitness, Cisco, Corite, Arista and ThousandEyes, capturing every packet stored then wiped and instrumenting the venue for hunting. Concrete numbers: 2,222 unique clients, 13.4 TB transferred, ~87,000 severe alerts with only 208 blocked after contextual vetting. They deploy automation via Exor and Slack plus hourly ML clustering to surface outliers, use captive portals for C2/crypto/cleartext, and uncover issues like Synology on port 5000 and a Google Translate extension leaking supposedly end‑to‑end encrypted chats.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:46The Team
- 2:28The Partners
- 5:31The Team Leads
- 6:04The Architecture
- 8:10Integrations
- 9:39Architecture
- 11:07Twitch
- 12:08Dashboards
- 12:37Stats
- 13:52Mobile Device Management
- 14:35DNS Requests
- 19:01Network Traffic
- 21:28The Knock
- 24:45Automation
- 25:56A fish is just a fish
- 28:12Threat hunting is a game
- 33:48Google Translate
- 36:03Synology
related talks
40mThe NOC Report
54mLessons and Lulz: The 5th Annual Black Hat USA NOC Report
45mThe Black Hat NOC: Greatest Hits and Holy...Cows
33mThe Black Hat Europe NOC Report
47mDecisions and Revisions - The Ever Evolving Face of the Black Hat NOC
40mThe 9th Annual Black Hat USA Network Operations Center (NOC) Report
45mDecisions and Revisions - The Ever Evolving Face of the Black Hat NOC
47mTales from the NOC: Going Public in Asia