How to Train Your Detection Dragon
summary
Built a detection and response pipeline from scratch for a mid‑size production stack, ingesting about 10–20 sources prioritized by compliance and business criticality, and using Sigma rules as the alert bank. Claims: no need for 100% coverage, use Goldilocks tuning and anomaly detection; concrete tools: PagerDuty for paging, Slack and email for notifications, Datadog for incidents. Added log enrichment, exceptions and response playbooks embedded in rules to cut thousands of daily alerts to a manageable queue and improve triage and cross‑team collaboration.
AI-written summary · about
chapters (13)
- 0:00Introduction and SecOps
- 3:52Planning the pipeline
- 5:15Log source prioritization
- 7:01Detection alerts and rules
- 11:18Alert notification methods
- 13:44Response strategies
- 17:05Integrating response steps
- 18:51Scaling and enrichment
- 20:53Prioritization and exceptions
- 23:58Automation and collaboration
- 26:56Sustaining and improving
- 30:22Tools and future outlook
- 33:33Q&A and closing
related talks
30mDetection Allegro: Composing Detection Rules with... (Raphael Ruban, Chen Cao)
30mDetection as Code: Detection Development Using CI/CD
34mA Blueprint for Detection Engineering: Tools, Processes, and Metrics
47mDetection as Code: The Engineering-Focused Future...
29mComposing the Response: Building an Incident Pipeline from Scratch
49mThe Always-On Purple Team: An Automated CI/CD for Detection Engineering
40mApplying Artificial Intelligence to the Incident Response Function
01h 02mSecuring data and democratizing the alert landscape