Elevate Cloud Threat Hunting with AI
summary
Kestrel as a Service deploys a composable threat‑hunting language plus a machine interpreter in containers and Kubernetes (MiniKube, OpenShift, Podman/Docker), enabling shared JupyterHub huntbooks and reusable hunt steps; an AI analytics plugin uses GPT-3.5-turbo to rank thousands of Windows process records for suspiciousness, cutting triage time, though a live demo fails intermittently; repos and Docker/Quay images are available and the system runs locally or in-cluster for team hunting. Kestrel as a Service
AI-written summary · about
chapters (6)
- 0:00Cloud threat hunting intro
- 7:17Kestrel in containers
- 12:40Multi-user threat hunting setup
- 18:00AI threat hunting enhancements
- 20:33AI process suspiciousness demo
- 24:15Q&A
related talks
40mThe Game of Cyber Threat Hunting: The Return of the Fun
39mCloud Native Threat Intelligence for...
21mNext-Gen K8s Threat Hunting: GenAI & eBPF
30mDIY Pen-Testing for Your Kubernetes Cluster
17mSponsored keynote: Can AI handle the complexity of Kubernetes and cloud-native environments?
12mKeynote: K8s Security Safari: Hunting Threats in the Wild Wild Cloud
25mBeyond Human Scale: AI and Automation as Force Multipliers in Cyber Threat Intelligence
43mThreat hunting in the cloud