Detection at Scale: Abstracting Detection Intent
summary
Claim: abstracting detection intent lets large teams and high event volumes scale detections by separating declarative pattern expression from system execution. Engineers build a Go API that compiles into a proto/structured intent, then an orchestrator maps stages to streaming, batch and query engines. Patterns include predicates, enrichments (example: VirusTotal enrichment on hashes), correlations, thresholds and clustering. The architecture hides event-time vs processing-time complexity, centralizes late-data handling and proves practical in long‑running production use.
AI-written summary · about
chapters (8)
- 0:00Welcome and introduction
- 1:52What is detection
- 6:47Capturing detection intent
- 9:33Simple detection patterns
- 13:06Complex detection patterns
- 19:47Executing detection intent
- 28:12Balancing abstraction levels
- 32:29Q&A session
related talks
47mDetection as Code: The Engineering-Focused Future...
34mA Blueprint for Detection Engineering: Tools, Processes, and Metrics
37mHow to Train Your Detection Dragon
40mApplying Artificial Intelligence to the Incident Response Function
01h 02mSecuring data and democratizing the alert landscape
29mReinventing ETL for Detection and Response Teams
28mPatterns for scalable security detections on AWS
30mDetection as Code: Detection Development Using CI/CD