Applying Artificial Intelligence to the Incident Response Function
summary
Pipeline turns detections into normalized artifacts, sandbox enrichment, classifier-driven scoping and response; models include a <10MB edge random forest that scans in under 0.1s and a 1+GB cloud DNN trained on millions of samples, yielding about 93% endpoint accuracy on static files. Techniques include pseudo‑labeling and GAN hardening, queues (RabbitMQ/Kafka), Kubernetes for scale, Redis caching, ML‑Ops for continuous retrain, and a certainty threshold that gates semi‑ or fully automated remediation.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 7:10Incident Response Process
- 12:02Investigation Process
- 14:31Extractions
- 15:06Scoping
- 15:45artifact
- 16:23removal
- 17:04investigation
- 18:29classification
- 22:19Gun
- 24:00Trashing
- 24:56Summary
- 25:21Remediation
- 25:41Randomization
- 26:30Process
- 28:07Sources
- 28:56Summarize
- 29:12Application Architecture
- 30:27Recommendations
- 31:08MLOps
- 32:00Tips
- 32:57Conclusion
related talks
34mCan automated responses to cyber incidents be supported by AI?
19mFrom Alerts to Action: AI-Powered Incident Response Systems
17mIncident Response @ Scale-Building a Next Generation SOC
35mAgentic Incident Response
32mAI/Machine Learning: What is Actually Working in Cybersecurity?
14mEnhancing Enterprise Security with AI
29mComposing the Response: Building an Incident Pipeline from Scratch
05mAI-Driven Incident Resolution – Hype or Reality