WEBVTT
00:00:12.080 --> 00:00:19.920
Welcome back to Detection Dispatch, the detection engineering and the threat hunting show that showcases the real humans behind the craft.
00:00:20.079 --> 00:00:23.760
Today we're doing something that we don't really get into very often.
00:00:23.920 --> 00:00:33.520
We're getting into a real honest review of a detection engineering certification, which is quite literally one of the only ones that there actually are out there.
00:00:33.679 --> 00:00:40.880
Like if you know, you know certs built for detection engineering specifically are super, super rare.
00:00:41.039 --> 00:00:43.679
I could count them like on one hand, type of rare.
00:00:43.840 --> 00:00:47.039
So when one does exist, of course, all of us have a lot of questions.
00:00:47.200 --> 00:00:47.840
Is it legit?
00:00:47.920 --> 00:00:48.880
Is it hands-on?
00:00:49.359 --> 00:00:52.159
Is it for more beginner focused?
00:00:52.399 --> 00:00:54.240
Is it for people actually doing the work?
00:00:54.399 --> 00:00:56.159
Is it worth your time and money?
00:00:56.399 --> 00:01:02.479
Are we going and we are going to answer all of that today with someone who just went through it himself?
00:01:02.640 --> 00:01:05.840
And he's going to give us the T on if it's worth it.
00:01:06.159 --> 00:01:08.319
Welcome to the show, Tobias.
00:01:09.040 --> 00:01:10.239
I'm glad to be here.
00:01:10.319 --> 00:01:11.280
Thanks for having me.
00:01:11.599 --> 00:01:19.519
It's pretty crazy that you were just saying you you just saw one of my videos, and now you're on the other side in my video.
00:01:20.400 --> 00:01:30.480
And it's crazy because before I seen the video that I watched, I was saying your name all over LinkedIn in regards to detection engineering.
00:01:30.719 --> 00:01:33.359
I'm like, wow, this is this is crazy.
00:01:33.680 --> 00:01:40.079
There's I I feel like that's my hyper-focused niche, which is it a good thing, is it a bad thing?
00:01:40.239 --> 00:01:44.239
I always get a little sad that I don't have the views that like John Hammond does.
00:01:44.319 --> 00:01:47.280
But I'm like, do is there like he's got millions of views?
00:01:47.359 --> 00:01:50.560
But I'm like, is there millions of detection engineers out there?
00:01:50.879 --> 00:01:51.920
Probably not.
00:01:52.560 --> 00:01:56.719
Especially not, they're definitely not a lot of them making uh content about it.
00:01:57.040 --> 00:01:59.840
Hey, I think you're like the uh the front runner for that.
00:02:00.159 --> 00:02:02.719
Well, I I hope that you're not tired of me yet.
00:02:02.879 --> 00:02:05.040
And I am I'm so glad to have you on.
00:02:05.280 --> 00:02:13.520
I know you're I love having folks in all aspects of of the craft and in all journeys of life in the space.
00:02:13.599 --> 00:02:15.840
And I especially those who work in MDR.
00:02:15.919 --> 00:02:18.719
I know you work in in the MDR side of things.
00:02:18.800 --> 00:02:26.879
And I love, I do love MDR because you see so many different diverse environments in literally like an eight-hour shift.
00:02:27.360 --> 00:02:28.000
Yeah.
00:02:28.400 --> 00:02:31.919
You definitely it's definitely a great place to be.
00:02:32.159 --> 00:02:38.319
I've never worked in an internal SOC, but from what I'm what I hear, I think I'm glad that I'm an MDR.
00:02:39.280 --> 00:02:47.199
Well, you don't work, maybe you haven't worked for one, but now you you see so many because you're like an extended version of all of your customer socks.
00:02:47.680 --> 00:02:48.159
Yeah.
00:02:48.479 --> 00:02:57.360
Um being an MDR is like, you know, you get to see um a lot of different activity.
00:02:57.439 --> 00:03:02.879
You get to see a lot of misconfigurations, some good practices, some not so good.
00:03:03.120 --> 00:03:07.439
So it's like the uh it's a very good place to be, I'd say.
00:03:07.919 --> 00:03:10.639
Especially with someone so early in their career, too.
00:03:10.800 --> 00:03:13.439
You it would just how how long have you been in the space?
00:03:13.759 --> 00:03:16.080
Um it'll be four years in February.
00:03:16.400 --> 00:03:17.280
Four years.
00:03:17.439 --> 00:03:18.080
I I don't know.
00:03:18.159 --> 00:03:26.639
I feel like you should take that kind of like dog years, where it's four years in the in the industry, but if it's an MDR specifically, it's probably more than that.
00:03:26.960 --> 00:03:28.560
It's kind of like a startup.
00:03:29.840 --> 00:03:31.919
I I bet the pressure is on, though.
00:03:32.080 --> 00:03:36.000
I bet it's a lot, I bet it's intense, and I bet it's like y'all have to move fast.
00:03:37.199 --> 00:03:37.680
Yeah.
00:03:37.919 --> 00:03:42.000
Um, because I've worked at this is my second MDR company.
00:03:42.240 --> 00:03:50.639
So I've seen I've worked in a smaller MDR company and now a bigger one that has tons and tons of customers.
00:03:50.800 --> 00:03:53.439
So, you know, it's it's very fast-paced.
00:03:53.840 --> 00:03:57.759
And yet you still found the time to take this certification.
00:03:59.039 --> 00:03:59.680
Yeah.
00:04:00.000 --> 00:04:08.560
Um, I'm one of those kind of guys that, you know, after five is when the day really starts for me, you know, especially with studying.
00:04:08.800 --> 00:04:12.400
Because I started in so in the sock.
00:04:12.639 --> 00:04:15.840
So I didn't get to do IT hub desk or anything like that.
00:04:15.919 --> 00:04:21.839
So when I got in the the cyber, I landed right in the sock, I felt like I had so much catching up to do.
00:04:22.079 --> 00:04:24.319
So that's why I'm just always on go.
00:04:24.399 --> 00:04:30.160
Like, sometimes it's it can be a good thing or sometimes it can be a bad thing, because you know, sometimes I don't know how to rest.
00:04:30.319 --> 00:04:32.079
So, but yeah.
00:04:33.120 --> 00:04:39.360
It's it's so important to to detach for especially after after your shift, though.
00:04:39.759 --> 00:04:40.720
Yeah, for sure.
00:04:40.879 --> 00:04:41.519
For sure.
00:04:41.759 --> 00:04:50.959
Sometimes I'll, you know, sometimes I'll take a breather, but immediately afterwards, sometimes I have to get right to the gym just to to keep it going.
00:04:51.040 --> 00:04:56.000
Cause you know, I do 10-hour shifts, so eight to six, you know, it's pretty much all day.
00:04:56.079 --> 00:05:00.240
And then, you know, I can't stay up too late because I have to be back in the sock, you know, in the morning.
00:05:00.319 --> 00:05:06.800
So it's uh So does that mean you have one one day free, like during the week?
00:05:06.959 --> 00:05:08.959
Like do you do four days a week?
00:05:09.519 --> 00:05:11.120
Four days on, three days off.
00:05:11.680 --> 00:05:12.079
I see.
00:05:12.319 --> 00:05:12.560
Okay.
00:05:13.120 --> 00:05:13.680
Wow.
00:05:13.839 --> 00:05:14.160
Wow.
00:05:14.480 --> 00:05:15.199
So it's nice.
00:05:15.279 --> 00:05:16.959
I I love having three days off.
00:05:17.040 --> 00:05:18.160
It is really nice.
00:05:18.480 --> 00:05:18.800
It is.
00:05:19.120 --> 00:05:19.360
It is.
00:05:19.839 --> 00:05:20.959
It's a great schedule.
00:05:21.279 --> 00:05:26.480
I was gonna say, I was like, the 10-hour days don't seem that bad because I'm already kind of working 10-hour days too.
00:05:26.560 --> 00:05:34.720
And then we also just set up pager duty, so we have to be we we have to be available and responding to alerts within 15 minutes.
00:05:36.399 --> 00:05:36.879
Yeah.
00:05:37.680 --> 00:05:40.639
Are you are y'all on on call or pager duty at all?
00:05:40.959 --> 00:05:43.839
Um lucky.
00:05:44.240 --> 00:05:45.920
Lucky, lucky lucky.
00:05:46.160 --> 00:05:54.560
Well, this exam important to note disclaimer then I that the exam is under NDA, and we definitely respect that here.
00:05:55.759 --> 00:06:17.839
So we're obviously not going to talk about what's specifically in the test, but let what we should talk about sort of the environment that you kind of created to prepare yourself to take it, the training, the labs, the prep, and and really, I mean, for for other folks like like yourself to know if it's actually worth their time.
00:06:18.000 --> 00:06:30.639
So I'm I'm I'm really happy and and I know that you wrote a a really great article about this, but this is more like of an informal discussion on it for for folks that wanna that wanna really get into it.
00:06:33.360 --> 00:06:40.959
So my first question is I I mean, clearly there's no detection engineering certs out there.
00:06:41.120 --> 00:06:46.800
So picking one one with your very limited time had to be, had to be very like finely selected.
00:06:46.959 --> 00:06:51.759
What did was there anything that tipped it that made you want to want to go after it specifically?
00:06:51.920 --> 00:06:54.480
What were you what were you hoping to get out of it?
00:06:56.879 --> 00:07:05.360
So I did a lot of research on different certifications and trainings that I feel could have been of value.
00:07:05.519 --> 00:07:07.680
Like you said, it's not many out there.
00:07:07.839 --> 00:07:14.639
I've seen a few reviews on the C D the C D G or C D Da E, excuse me.
00:07:15.279 --> 00:07:16.560
You know the acronyms.
00:07:17.040 --> 00:07:17.680
Yeah.
00:07:18.800 --> 00:07:26.639
But I think that there was this one that I came across um from this from this guy on LinkedIn.
00:07:26.879 --> 00:07:30.560
He gave a pretty in-depth um review on it.
00:07:30.879 --> 00:07:35.279
And I was like, this could be something that I'll probably invest in.
00:07:35.519 --> 00:07:39.120
Um luckily my org paid for it for me.
00:07:39.759 --> 00:07:44.240
But I probably I was so interested in it that I probably still would have paid out of pocket.
00:07:44.480 --> 00:07:44.800
Okay.
00:07:45.680 --> 00:07:49.600
So that's kind of what, you know, got me into it.
00:07:49.759 --> 00:08:00.079
Before the certification, though, or after, or during the certification, I kind of realized that a lot of it, a lot of it I had kind of built in my home lab.
00:08:00.879 --> 00:08:06.639
So it was kind of like this is this can add structure to what I'm already doing.
00:08:06.959 --> 00:08:14.319
And it can it can give me more of a structured approach to the way that I create detections in my home lab.
00:08:14.480 --> 00:08:18.639
And it even gave me additional tools to use to be able to test them.
00:08:18.800 --> 00:08:24.079
And uh yeah, that's that's pretty much how I was able to decide and say, like, yeah, I'll do this one.
00:08:24.480 --> 00:08:32.559
Do you think that building your home lab, figuring it out on your own prepared you better for the exam, or it just sort of like accelerated it?
00:08:34.159 --> 00:08:46.480
Well, I guess you could kind of say both because I probably got interested into the detection engineering early 2025.
00:08:46.799 --> 00:08:50.080
So at that point, I had been in the SOC for about two years.
00:08:50.320 --> 00:08:57.279
So now I'm like, okay, you know, I got my experience um triaging and investigating.
00:08:57.679 --> 00:09:02.320
What area of security could I be interested in?
00:09:02.559 --> 00:09:09.519
And so my old manager at my last company, you know, I'm I sent him a message because he was the one that was creating all the detections.
00:09:09.679 --> 00:09:11.600
So I asked him, like, how did he do it?
00:09:11.759 --> 00:09:12.799
What language did he use?
00:09:12.960 --> 00:09:14.080
So he told me the language.
00:09:14.639 --> 00:09:16.879
K KQL, SPL, SQL?
00:09:18.080 --> 00:09:22.480
Um, I think it was the universal one.
00:09:22.799 --> 00:09:26.399
Yeah, yeah, and then just converted it from what he would tell me.
00:09:26.480 --> 00:09:28.399
Just created an Sigma and then converted.
00:09:28.799 --> 00:09:31.279
Um, so I was really interested in that.
00:09:31.360 --> 00:09:34.159
I'm like, man, how does he do that?
00:09:34.399 --> 00:09:48.000
So I'm one of those kind of people where, you know, if if if there are not many resources online, or if I don't, if I can't, if there's not an opportunity for me to do it in production, let me take this over to the lab.
00:09:48.399 --> 00:09:50.720
So let me see what I can build in the lab.
00:09:50.879 --> 00:09:56.320
And so I've had so many iterations of a detection engineering lab.
00:09:56.399 --> 00:09:58.000
I started on Waza, I think.
00:09:58.159 --> 00:10:01.440
That was the first SIM that I used for detections.
00:10:01.519 --> 00:10:08.080
You know, I've I've played around with Splunk and before that, but strictly to create detections, it was Waza.
00:10:10.799 --> 00:10:12.559
Waza was okay.
00:10:12.960 --> 00:10:20.080
Um, I eventually made my way to Elastic, which I love elastic.
00:10:20.320 --> 00:10:20.960
Yeah.
00:10:21.600 --> 00:10:25.840
I absolutely love Elastic from everything about it.
00:10:26.240 --> 00:10:35.600
I was like, let me figure I think I I think my first detection that I created was like a password spray detection or something like that.
00:10:36.159 --> 00:10:44.240
And then I would, I would like simulate it on a what on the VM and then see if it can fire.
00:10:44.720 --> 00:10:49.600
And that really, once, once I was able to actually get it working, it let a fire under me.
00:10:49.679 --> 00:10:51.679
I was like, oh, this is how.
00:10:52.000 --> 00:10:52.639
This is how.
00:10:52.799 --> 00:10:57.519
And then, you know, working as an analyst, I already knew how to go investigate it.
00:10:57.759 --> 00:11:02.720
So it was like, it was kind of like a just a circle, like a, you know, like a full circle moment.
00:11:03.039 --> 00:11:03.679
Yeah.
00:11:04.080 --> 00:11:08.720
So from then on, it, it just, that's pretty much how that began.
00:11:09.039 --> 00:11:15.600
It's a bit of an adrenaline thing to, to, to work on that very iterative workflow.
00:11:15.759 --> 00:11:16.960
To because you gotta tweak it.
00:11:17.039 --> 00:11:23.120
You gotta keep kind of tweaking it, keep replaying it, right, until it really actually fires.
00:11:23.519 --> 00:11:25.360
Because it's it's always there's always a problem.
00:11:25.519 --> 00:11:30.399
There's always either your VM in your lab didn't actually run it correctly.
00:11:30.480 --> 00:11:34.879
So there, for it didn't pass it to the agent, or is it a problem coming in?
00:11:35.120 --> 00:11:36.159
Is the data in?
00:11:36.399 --> 00:11:37.919
Okay, the data's coming in.
00:11:38.000 --> 00:11:43.440
If it's not and it's still not firing, then probably like the logic, a problem with the logic, like just working backwards.
00:11:43.519 --> 00:11:45.440
That's so it's like a puzzle.
00:11:46.159 --> 00:11:48.240
That's the best way that I can describe it.
00:11:48.320 --> 00:11:50.000
It's literally like a puzzle.
00:11:50.320 --> 00:11:56.159
And now where I am with my lab, I test them with atomic red team.
00:11:56.320 --> 00:11:56.639
Yeah.
00:11:57.519 --> 00:11:59.120
I use Caldera?
00:11:59.759 --> 00:12:00.240
Yep.
00:12:00.399 --> 00:12:00.960
Yep.
00:12:01.200 --> 00:12:03.679
I use a plethora of different tools.
00:12:03.919 --> 00:12:17.039
And when that whenever I use chainsaw to try to see if it works and if it was detected, whatever the whatever I was trying to detect, it'll tell me if it worked, or it'll say zero rules detected or something like that.
00:12:17.200 --> 00:12:20.240
And I'm like, wow, what what what was wrong with my logic?
00:12:20.399 --> 00:12:24.159
Where do I have to backpedal to see what I'm missing?
00:12:24.320 --> 00:12:26.240
Because I know this activity is in the logs.
00:12:26.320 --> 00:12:30.240
I know it's there, but it has to be something wrong with my logic.
00:12:30.480 --> 00:12:32.240
Yeah, the rule itself.
00:12:32.639 --> 00:12:33.279
Exactly.
00:12:33.519 --> 00:12:45.440
So it's a sometimes it can be frustrating, but when you finally figure it out and you finally get that rule to fire and it finally works, to me, it's like it's all orbiting.
00:12:46.320 --> 00:12:52.000
I like how you specifically said that this assert teaches you the structure.
00:12:52.240 --> 00:12:53.840
Detection engineering as a discipline.
00:12:54.000 --> 00:12:57.440
It it's not necessarily helping you with the language, like you said.
00:12:57.519 --> 00:13:02.000
It's it's not really helping you build Sigma or or how to, it's not a syntax course, pretty much.
00:13:02.080 --> 00:13:12.720
And I think that's really important to distinguish that writing a rule is just a normal Tuesday, but it's just a part of the detection engineering lifecycle.
00:13:12.879 --> 00:13:14.320
It's not the whole thing, right?
00:13:14.480 --> 00:13:22.799
So if you walk us through the arc of the training per se, like how would you say that that is built on from section to section?
00:13:22.879 --> 00:13:26.879
Like, how does it, how, what is the structure that you talk about?
00:13:27.519 --> 00:13:31.279
As far as I'll say this from my experience with it.
00:13:31.519 --> 00:13:39.759
Um there were sections that I skipped over.
00:13:39.919 --> 00:13:45.679
Um, and then I made I jumped directly to the stuff that I felt was relevant for me, what I was trying to learn.
00:13:48.159 --> 00:14:00.879
Like reading threat reports and um seeing what you can find in the threat report to be able to map out, you know, the coverage for it, um, and and then build the detection.
00:14:01.039 --> 00:14:13.919
It it does touch a bit on um the rule and rule structure and and breaking down what each of the the Sigma R rule, what it means at each phase and different things like that.
00:14:14.080 --> 00:14:22.799
And once I had that, because I was more so wanting to know like what it what am I missing?
00:14:22.960 --> 00:14:26.320
How could I take what I'm already doing and make it better?
00:14:26.639 --> 00:14:26.799
Yeah.
00:14:27.120 --> 00:14:35.919
So overall, I can honestly say this certification took me over that hump as far as what I wanted out of the certification.
00:14:36.080 --> 00:14:48.480
There were things in the certification that I felt were it kind of just depends on where you are and what angle you're coming at, if in terms of if this is worth it for you.
00:14:48.720 --> 00:14:55.200
I mean, detection engineering in itself, it's not really a junior thing.
00:14:55.440 --> 00:15:03.759
It's more so of you've been in security for a little while, you maybe worked as an analyst, or you maybe even at a different angle from that.
00:15:04.000 --> 00:15:11.120
So you know what these, you know what these rules are when they're firing, you you know what to do, where to even where to start at least.
00:15:11.360 --> 00:15:20.159
So it it has a lot of foundational stuff, like on the basic level, which is cool, but it it kind of just depends on what angle you're coming from.
00:15:20.320 --> 00:15:22.799
And I've had a lot of people ask me, hey, do you think it's worth it?
00:15:23.039 --> 00:15:28.639
And I would have to say to that, is like it's highly, highly, highly specialized.
00:15:29.120 --> 00:15:39.919
So it's like, I think that either you have to be creating rules and maybe a day-to-day, and maybe want to get better at the rules that you're already creating and maybe have some structure to that.
00:15:40.559 --> 00:15:48.799
Um, or you absolutely have a passion for creating rules, testing them, and actually wanting to detect the bad guys.
00:15:49.759 --> 00:16:02.080
So it I mean, it combines all of that workflow of understanding the threat, writing a rule around it, testing it, validating, deploying it.
00:16:02.159 --> 00:16:06.320
Like that is the core to what we do.
00:16:07.600 --> 00:16:15.840
And would you say you said you skipped some of the foundational what what would you what we what are you defining as foundational, like reading a threat report?
00:16:15.919 --> 00:16:17.120
Like that's pretty foundational.
00:16:17.519 --> 00:16:18.320
No, no, no, no.
00:16:18.480 --> 00:16:21.759
Mean like uh operating system basics.
00:16:22.320 --> 00:16:23.279
Got it, got it.
00:16:23.519 --> 00:16:33.360
Or so more so of the the stuff that you probably should know when you get into security or at the beginning of your journey or something.
00:16:33.759 --> 00:16:36.799
Like the comp TIA, Security A plus that that stuff.
00:16:37.200 --> 00:16:37.519
Yeah.
00:16:37.759 --> 00:16:38.080
Okay.
00:16:38.720 --> 00:16:45.039
What what would you say was the most valuable then part of the training arc or the all of the sections?
00:16:46.159 --> 00:16:51.279
Yeah, because I I I wanted to get to the meat and potatoes of it.
00:16:52.000 --> 00:16:58.720
I I would have to say um pretty much, oh man, this was one of my favorite sections.
00:16:59.600 --> 00:17:00.320
The GitHub.
00:17:00.480 --> 00:17:11.200
The GitHub for like having that detectionist code architecture and then you committing the rules to that was probab that was my favorite, that was my favorite section.
00:17:11.279 --> 00:17:16.640
Um, and then you know, you got the the Sigma, the Yara, and tuning.
00:17:16.880 --> 00:17:21.440
Those off the top of my head from what I can remember, those were my favorite at least.
00:17:21.759 --> 00:17:30.480
Was that because it was genuinely like new to you or it or it reinforced or put to practice what what y'all have been doing?
00:17:31.759 --> 00:17:39.119
So it's kind of because it kind of gives you a little bit of what's happening on the back end.
00:17:39.279 --> 00:17:50.319
You know, because depending on how your the organization may have everything set up, some organizations don't have a role called detection engineer.
00:17:50.720 --> 00:17:53.519
That may be a senior analyst's function.
00:17:53.599 --> 00:17:56.240
We'll we'll create rules or something like that.
00:17:56.400 --> 00:18:11.920
But this shows, hey, in a mature organization that implements detectionist code, a detectionist core architecture, this is how it happens, and it'll get funneled down to me as an analyst to where I can see it.
00:18:12.000 --> 00:18:17.759
So I get the alert, but it shows the back end, okay, here's how this is created.
00:18:17.920 --> 00:18:20.880
This is what it what it was created from, how it was tested.
00:18:21.119 --> 00:18:24.160
And now it's on you to go in and validate this.
00:18:24.240 --> 00:18:30.960
Hey, is this malicious activity or is this something that it's not really something that we need to worry about?
00:18:31.119 --> 00:18:37.759
So it kind of uh gave me a big perspective as far as the back end goes.
00:18:38.480 --> 00:18:45.680
So if you were to say, like, what what more structure would you say it added to your workflow?
00:18:46.400 --> 00:18:52.240
Like, how do you go about detection engineering now, after like since you've taken the course?
00:18:53.440 --> 00:19:17.200
Um I'll say it gave me structure in terms of like um for one, I would say just getting better at understanding the syntax of of Sigma and then um maybe converting it and converting that into a query that can be that that can you know be pushed into a um a sim.
00:19:17.920 --> 00:19:24.559
It gave me that kind of that kind of structure just to under like I was saying a little few minutes ago about the the back end.
00:19:24.720 --> 00:19:37.519
But as far as the way that I go to create detections, I think the way that I do it, uh like I said, I've created so many iterations of of of detections, detections in my lab.
00:19:38.400 --> 00:19:52.319
Um like, for example, I remember early on, I would create or launch operations in Caldera, and then I would go threat hunt to see what happened, and then uh let me see if I can just build a detection for that.
00:19:52.400 --> 00:19:56.160
And then let me run the operation again to see if my rule will fire for it.
00:19:56.400 --> 00:19:56.960
Yeah.
00:19:57.200 --> 00:19:58.720
That's kind of how I was doing it.
00:19:58.880 --> 00:20:07.599
And that's kind of a bit of kind of how I do it now, but tuning, tuning was one of those big, big things.
00:20:07.839 --> 00:20:17.759
It was one of those huge things, actually, because you know, some people think, hey, we got this rule, it's created, let's push it to pride and forget about it.
00:20:18.000 --> 00:20:22.720
And creating the rule in itself, that's that's early.
00:20:22.960 --> 00:20:29.920
You have to make sure, there's so many other things that you have to make sure with this rule that it's not it's not drowning analysts.
00:20:30.000 --> 00:20:31.920
It actually catches what it's supposed to.
00:20:32.160 --> 00:20:36.480
It's so many different things that you have to to keep in mind when you're creating these rules.
00:20:36.559 --> 00:20:40.480
So it's kind of like a kind of like you know the game whack-a-mole.
00:20:40.720 --> 00:20:41.279
Yeah.
00:20:41.599 --> 00:20:42.640
It's kind of like that.
00:20:42.720 --> 00:20:44.640
That's kind of how I would, you know, would say.
00:20:45.359 --> 00:20:45.759
It is.
00:20:45.920 --> 00:20:48.160
It's one of those things you can't just set it and forget it.
00:20:48.400 --> 00:20:56.319
And I feel like what often people do is they build a rule, they tune out the false positives.
00:20:56.559 --> 00:21:02.559
Maybe it's okay for now, but then you know, things are changing like internally in the organizations.
00:21:02.799 --> 00:21:10.400
Uh the log source format is is also drifting a bit, and it's that has all these different points in the pipeline.
00:21:10.480 --> 00:21:11.440
It can go wrong.
00:21:11.759 --> 00:21:15.039
And eventually it's it's not gonna work anymore.
00:21:15.200 --> 00:21:17.519
And so then you got to fix that, you know.
00:21:17.680 --> 00:21:24.960
But then also, are we ever going back to check on those dormant rules that just haven't fired for a while?
00:21:25.119 --> 00:21:34.240
Like, do you do we have some kind of reminder or like a 30-day check or 90-day check to to go back and and and see what rules haven't fired in a while?
00:21:34.400 --> 00:21:37.279
Maybe, maybe it's time to to take a to take a look at them again.
00:21:37.519 --> 00:21:40.720
I feel like we don't really know not a lot of folks are doing that.
00:21:41.279 --> 00:21:43.200
I I would have to agree.
00:21:44.799 --> 00:21:50.240
Because it's it's one of those things where, you know, behaviors change.
00:21:50.559 --> 00:21:54.319
So this rule could have caught this activity at some point.
00:21:54.480 --> 00:21:58.640
That's now it's changed just a little bit and maybe it may be.
00:21:59.200 --> 00:21:59.759
Six months from now.
00:22:00.480 --> 00:22:01.200
Exactly.
00:22:01.359 --> 00:22:05.359
And so, you know, you want to keep up with the rules that you create.
00:22:07.200 --> 00:22:07.519
Yeah.
00:22:07.599 --> 00:22:12.000
And that's something that I feel like we enforce in our in our jobs.
00:22:12.160 --> 00:22:17.119
Cause in our labs, that is not something that we get to practice a lot with.
00:22:17.359 --> 00:22:20.000
We get our labs are the playground, right?
00:22:20.240 --> 00:22:29.599
For building the rule, the beginning part of it, testing the rule, creating the environment around it to run an adversary emulation, to generate the real telemetry, build a detection.
00:22:29.759 --> 00:22:30.319
Okay, cool.
00:22:30.480 --> 00:22:39.519
But then our labs don't capture the dynamic nature of internal business landscape change or external threat changes either.
00:22:39.759 --> 00:22:45.440
So that's like the the tuning part is where our real jobs really like sink in.
00:22:45.599 --> 00:22:47.359
But that's when like that's reality.
00:22:47.519 --> 00:22:52.240
It's like I wish you could practice more tuning in certifications like this, you know?
00:22:52.559 --> 00:22:52.799
Yeah.
00:22:53.039 --> 00:23:10.160
And I think I think that if Century continues to build on that certification and maybe add some of that to it, honestly, I think they they could probably have the best detection engineering certification in the in the industry.
00:23:10.720 --> 00:23:11.599
So that's your own.
00:23:13.599 --> 00:23:13.839
Yeah.
00:23:14.000 --> 00:23:17.039
They already, because it's already, it's already great.
00:23:17.200 --> 00:23:18.319
It's already great.
00:23:18.480 --> 00:23:28.000
But if they could hit on, you know, those additional pieces, I I don't think um, I think it would be hard for other vendors to compete with AMA.
00:23:28.640 --> 00:23:34.559
Would you say the same thing for a less less experienced detection engineer?
00:23:34.720 --> 00:23:37.279
Because four years is is well into the craft.
00:23:37.359 --> 00:23:39.200
Like would you say some like an entry level?
00:23:39.279 --> 00:23:41.839
Is are they a good fit a fit for this?
00:23:43.759 --> 00:23:49.279
Um I'm gonna be honest, I'm gonna have to say no.
00:23:49.839 --> 00:23:50.160
Okay.
00:23:50.640 --> 00:23:52.240
That's that's very honest.
00:23:52.880 --> 00:24:23.279
I think that I'm gonna say coming from the angle of a sock analyst or MDR analyst, I think that you should be able to get your experience in a fast-paced environment like that, looking at different alert types, different environments, seeing what's what could be normal, what could be not, and then being able to build on that experience and having that experience as the foundation.
00:24:23.519 --> 00:24:28.400
But you I would say probably two years is is is a good point from there.
00:24:28.960 --> 00:24:34.160
Then maybe you jump into DE or maybe start to do some of these trainings or whatever.
00:24:34.240 --> 00:24:37.920
But you know, at the same time, everybody learns at their own pace.
00:24:38.079 --> 00:24:48.160
Um, but I would say two years in an environment to where you can really get your hands dirty is I would say that's that would be Yeah.
00:24:48.400 --> 00:24:48.799
Yeah.
00:24:48.960 --> 00:24:51.119
So okay, so entry level, no.
00:24:51.359 --> 00:24:55.759
So you skipped some of some of these fundamentals at the beginning.
00:24:56.400 --> 00:25:01.359
What that that's something like they would not, they should not skip.
00:25:01.519 --> 00:25:02.559
Or maybe a pretest.
00:25:02.640 --> 00:25:04.480
Like they should have a little bit of a pretest.
00:25:06.240 --> 00:25:08.400
Probably it should have a little bit of a pretest.
00:25:08.559 --> 00:25:24.799
If they took this course and they didn't have as much experience, I would definitely say take the take the training and complete every module in the training from Windows basics to Linux basics to pretty much everything.
00:25:25.200 --> 00:25:26.720
Leave no stone unturned.
00:25:27.039 --> 00:25:27.359
Yeah.
00:25:27.599 --> 00:25:29.359
No, that that's really good advice.
00:25:29.599 --> 00:25:36.799
Now, the best part about certs in general is the hands-on lab portion of it.
00:25:36.880 --> 00:25:41.839
I mean, it's you'll you're just gonna learn far better than anything memorization-based, like Comp TIA.
00:25:41.920 --> 00:25:44.799
It's it's a memorization game, completely a memorization game.
00:25:44.880 --> 00:25:55.440
And and even the way that they structure the questions is it sucks so bad because it's like two answers are very correct, but you have to answer the most correct, right?
00:25:55.759 --> 00:25:59.839
And that's just not really testing your hands-on work, right?
00:26:00.000 --> 00:26:09.359
Your ability to really kind of figure things out, uh, like your your thinking, your the way you approach problems or problem solve, I guess is the right word.
00:26:09.519 --> 00:26:16.720
Uh, so as far as the playground environment, did that truly feel closer to detection work, would you say?
00:26:16.799 --> 00:26:18.079
Like your day-to-day.
00:26:20.880 --> 00:26:24.319
So I'll be completely honest with my experience.
00:26:24.480 --> 00:26:24.720
Yeah.
00:26:25.119 --> 00:26:31.279
First, my first shot at the exam, I failed.
00:26:31.599 --> 00:26:32.079
Oh no.
00:26:32.559 --> 00:26:34.160
I missed several questions.
00:26:34.319 --> 00:26:35.359
It it kinda hurt.
00:26:35.440 --> 00:26:39.039
It kinda hurt, but that just it just turned the heat up a little bit more.
00:26:39.519 --> 00:26:41.680
Sometimes that's the heat that you need.
00:26:42.319 --> 00:26:54.880
Yeah, and and I see I had to take notes of everything that I didn't do and resources that I didn't take advantage of, so that okay, here's I mean, I literally took notes of my phone.
00:26:55.039 --> 00:26:57.839
You didn't do this, you didn't do this, you could be better at this.
00:26:58.079 --> 00:27:03.200
So I and once I cleared my mind from the exam, because you know it's a long exam.
00:27:03.440 --> 00:27:04.000
Wait, how long?
00:27:04.160 --> 00:27:04.880
How long?
00:27:05.359 --> 00:27:07.759
Um, I think you get 24 hours.
00:27:08.000 --> 00:27:10.799
24 hours, okay, with all access to resources.
00:27:10.960 --> 00:27:13.039
Like you can you can reference whatever.
00:27:14.160 --> 00:27:14.559
Mm-hmm.
00:27:14.880 --> 00:27:15.200
Okay.
00:27:16.640 --> 00:27:21.519
Um so I took the notes, went over the notes.
00:27:21.839 --> 00:27:24.160
The playground was one thing that I didn't do.
00:27:24.319 --> 00:27:27.920
Because I'm thinking I've did this kind of work in my lab.
00:27:28.319 --> 00:27:29.359
Um I didn't know.
00:27:29.519 --> 00:27:31.279
You were a little bit overly confident.
00:27:31.440 --> 00:27:32.400
You went into it confident.
00:27:32.640 --> 00:27:33.920
You're like, no, I got this.
00:27:34.559 --> 00:27:35.119
For sure.
00:27:35.279 --> 00:27:38.400
I I'll be honest and admit I was overly confident.
00:27:38.720 --> 00:27:42.319
And then when I got in that exam, I was like.
00:27:42.720 --> 00:27:44.400
You have to run and find out.
00:27:44.720 --> 00:27:46.720
I was like, what am I looking at here?
00:27:49.200 --> 00:27:56.960
So that second time, when I was preparing for the second go-round, I absolutely took the um playground, I took it serious.
00:27:58.960 --> 00:28:05.119
And I will say, this is as much as I can say because of NDA purposes, of course.
00:28:05.359 --> 00:28:10.559
If you are in the process of taking this exam, absolutely do the playground.
00:28:11.039 --> 00:28:11.920
That's all I can say.
00:28:12.079 --> 00:28:13.359
I absolutely do the playground.
00:28:13.920 --> 00:28:17.200
Well, I I love learning from other people's mistakes.
00:28:17.279 --> 00:28:18.559
I think that's the best way to learn.
00:28:18.720 --> 00:28:28.400
And I also a lot of organizations also are catching on to the fact that there's a really high rate of passing when they fail the first time.
00:28:28.559 --> 00:28:35.039
Cause yeah, that level of rigor, but also you just now know how the the the test is structured, you know what to expect.
00:28:35.279 --> 00:28:40.799
So now what a lot of a lot of organizations, like the California Institute of Technology or something like that.
00:28:40.960 --> 00:28:42.240
Don't don't quote me on that one.
00:28:42.480 --> 00:28:57.599
But one of the one of the one of the California techie schools, they are now offering courses where you can do trainings and also it comes with the certification included that the exam passes and like multiple unlimited attempts to take it.
00:28:57.759 --> 00:29:02.799
Because they know like that's you're you're likely gonna pass it the second time, like or or even the third.
00:29:03.119 --> 00:29:03.599
Yeah.
00:29:03.920 --> 00:29:17.680
And you know, I I think that going back to the format of exams, honestly, I think that it doesn't get any better than a practical exam.
00:29:17.920 --> 00:29:25.039
Because if you study long enough, you can memorize, you know, different things for the security plus, CY plus, whatever.
00:29:25.119 --> 00:29:29.599
Any of these multiple choice exams, you can you can memorize those things.
00:29:29.920 --> 00:29:35.279
But with the practical exams, you have to show improve.
00:29:35.759 --> 00:29:40.880
So, yes, you know the answer, but can you go get the answer and can you present it?
00:29:41.039 --> 00:29:43.920
And can you come out on top in an actual environment?
00:29:44.079 --> 00:29:45.680
Can you actually go get the answer?
00:29:45.920 --> 00:29:51.519
And this is where companies like Security Blue Team, you know, it's it's just unmatched.
00:29:51.599 --> 00:29:55.359
So I know I think TCM security, they have other like hands-on.
00:29:55.920 --> 00:29:56.400
Yeah, you know.
00:29:56.880 --> 00:29:58.799
Yeah, but I I I like this one better.
00:29:58.880 --> 00:30:00.400
I've I've seen some of the TCM stuff.
00:30:00.480 --> 00:30:03.279
It's a little bit it's a little bit too entry-level.
00:30:03.759 --> 00:30:04.079
Okay.
00:30:04.559 --> 00:30:05.200
Yeah.
00:30:06.000 --> 00:30:06.559
I got you.
00:30:07.519 --> 00:30:08.960
In my experience, yeah.
00:30:09.440 --> 00:30:12.160
I haven't taken any of their certifications.
00:30:12.400 --> 00:30:21.119
I'll probably take a course or two, but probably I'm not at the current where I am currently, I'm not really interested in any of the certifications they have to offer.
00:30:21.200 --> 00:30:32.319
Um, but just the practical nature of these exams is just I would choose practical over if I if I never had to take a multiple choice again, you know, I probably wouldn't.
00:30:32.880 --> 00:30:41.759
But you know, having to renew certifications from secur from uh comp T, you know, I'm gonna have to take another multiple choice at some point.
00:30:42.000 --> 00:30:43.119
I'm sh I'm sure.
00:30:43.279 --> 00:30:43.839
I'm sure.
00:30:43.920 --> 00:30:45.759
Or or the CISSP.
00:30:46.079 --> 00:30:49.039
I failed CCSP the first time.
00:30:50.079 --> 00:30:51.039
Yeah, it was hard.
00:30:51.839 --> 00:30:52.960
It was very hard.
00:30:54.720 --> 00:30:56.480
How long did you study for it?
00:30:56.799 --> 00:30:59.200
I to be honest, not that long.
00:30:59.359 --> 00:31:02.240
I kind of thought I was going to as well like you.
00:31:02.319 --> 00:31:04.400
Like I I thought I was gonna I was gonna pass it.
00:31:04.559 --> 00:31:06.559
And I thought I didn't need to study that long.
00:31:06.640 --> 00:31:15.680
And it was one of those where I did take the course for it, and not to put blame on anyone, but my instructor was very boring.
00:31:16.799 --> 00:31:21.200
It was they were just so bad, so so bad.
00:31:21.359 --> 00:31:27.519
So we wouldn't even I I don't think that yeah, he was lecturing, but it wasn't really like going in.
00:31:27.680 --> 00:31:28.079
Yeah.
00:31:28.240 --> 00:31:36.799
But I in my mind I was like, well, I took the course, I I read the quizzes, I was doing a bunch of quizzes over and over and over again, and it just didn't work.
00:31:36.960 --> 00:31:37.519
But you know what?
00:31:37.599 --> 00:31:48.160
At the time, I didn't do you know how now in Gemini or in Claude, you could basically give, you know, Claude your study guide, your study material, and just be like, quiz me.
00:31:48.559 --> 00:31:51.039
And and I wish, I wish that.
00:31:51.200 --> 00:31:54.559
I mean, at the time, I mean, how did we even pass school without these tools?
00:31:54.720 --> 00:31:56.400
Like now I would have done that.
00:31:56.799 --> 00:31:57.680
Oh man.
00:31:58.240 --> 00:31:58.880
Yeah.
00:31:59.599 --> 00:32:04.000
The the the generations now, they have it so good.
00:32:04.160 --> 00:32:06.559
They do there's so many resources.
00:32:06.799 --> 00:32:10.960
Man, it's don't get me started on like the writing the papers and stuff.
00:32:11.279 --> 00:32:15.680
Man, but it it's yeah, it's crazy.
00:32:16.079 --> 00:32:16.640
I know.
00:32:16.799 --> 00:32:24.480
And but then again, I am also very grateful that I didn't need these AI tools to pass my classes.
00:32:24.640 --> 00:32:26.000
And and that in that we did.
00:32:26.079 --> 00:32:27.200
We that's what we had to do.
00:32:27.359 --> 00:32:38.240
We had to wire up all of our labs and look through config and look through documentation and do the hard work before Claude literally told us how to do it step by step by step by step.
00:32:38.400 --> 00:32:40.640
And I do think that people are better off for it.
00:32:40.799 --> 00:32:50.640
Those who had to go on Stack Overflow and and go through, you know, go through Googling the answers yourself, because just in the process of cer researching, you learned so much.
00:32:52.000 --> 00:32:52.400
Yeah.
00:32:52.799 --> 00:32:53.920
We'll have to agree.
00:32:54.079 --> 00:32:55.839
I would definitely have to agree.
00:32:56.720 --> 00:33:02.880
Was there any mistakes in your lab that because we we always learn from our mistakes the best?
00:33:02.960 --> 00:33:04.400
Like that's the best kind of experience.
00:33:04.559 --> 00:33:11.519
Uh were there a mis was there a mistake that really taught you the most and like you that you constantly reminisce about?
00:33:18.079 --> 00:33:25.440
I don't think so just because I really took advantage of breaking and fixing things in my lab.
00:33:25.599 --> 00:33:31.440
If it didn't, if it didn't work, if it didn't work, well why why doesn't it work?
00:33:31.599 --> 00:33:42.079
What what in the logs can tell me why um the container that runs Elastic isn't isn't starting and now I can't connect to the sim or whatever.
00:33:42.319 --> 00:33:45.759
You know, I I I think it all had to happen for a reason.
00:33:46.000 --> 00:33:54.960
So I think that um, I just it's a lab, you know, it's it's there for if things work, great.
00:33:55.279 --> 00:34:12.480
But I like to say when you're like in the journey of trying to learn something, the beginning is important, the end is important, but that middle part is the most important because the bumping your head, the descriptions, the why won't this rule fire?
00:34:12.719 --> 00:34:20.880
The how can I play devil's advocate to see if the threat actor was able to deviate this activity in some kind of way?
00:34:21.039 --> 00:34:22.159
Would it still work?
00:34:22.639 --> 00:34:23.039
Yeah.
00:34:23.280 --> 00:34:25.440
So it's it's yeah.
00:34:29.199 --> 00:34:33.280
The I've of course I want to get into the your your study rhythm.
00:34:33.440 --> 00:34:38.239
Uh you right away, you were like, how long well, how long did you study for the CCSV?
00:34:38.639 --> 00:34:41.280
How how long did you study for this one?
00:34:43.360 --> 00:34:48.639
Um what did the study rhythm look like?
00:34:48.800 --> 00:34:53.039
Was it like every day after your you said your your your day starts after five?
00:34:53.119 --> 00:34:55.440
Like was it every day after five one hour?
00:34:55.519 --> 00:34:59.920
Or was it like looking at YouTube videos at the gym?
00:35:00.159 --> 00:35:00.800
Like, I don't know.
00:35:00.880 --> 00:35:03.360
Well, what what do you what what did that look like?
00:35:04.079 --> 00:35:11.920
Yeah, so there would be days where at work, once I made sure it was okay with my teammates and it was maybe slow.
00:35:12.320 --> 00:35:13.199
Hey, can I study?
00:35:13.760 --> 00:35:15.280
Are you guys okay if I study?
00:35:15.440 --> 00:35:17.280
So sometimes I'm studying while I'm at work.
00:35:17.440 --> 00:35:23.840
Um and then when I get off work, you know, I go to the gym and then I'll study when I get home, study some notes that I take in.
00:35:24.000 --> 00:35:30.159
I have I also have one of those detection engineering books from PACT that we're talking about earlier.
00:35:30.400 --> 00:35:34.880
So I would look over that, and I would also have Chat GPT.
00:35:35.280 --> 00:35:35.840
Of course.
00:35:36.239 --> 00:35:43.440
Um help me, help me with some, some like basically create questions like Yeah, what does this rule need?
00:35:43.519 --> 00:35:47.599
Why wouldn't maybe why wouldn't this rule fire or would this rule be detected?
00:35:47.679 --> 00:35:49.679
You know, just to to help get me in that mode.
00:35:49.760 --> 00:36:00.559
But I think it kind of took me I want to say two and a half months, but once I failed the first time, I couldn't take it again for like, I think it was seven days or two weeks or something like that.
00:36:00.719 --> 00:36:04.400
So I think it may have gotten to that three-month period.
00:36:04.559 --> 00:36:10.559
Um and then once I passed, that's pretty much everything that I I I literally studied every day.
00:36:10.800 --> 00:36:27.440
If I didn't get a day to study like actual material, I'm in the lab trying to emulate something and figure, figure out a new rule or um just going over the structure of a of a Sigma rule, the Yara rule, um, so yes.
00:36:27.920 --> 00:36:28.719
That was pretty much what I'm saying.
00:36:29.039 --> 00:36:32.320
You ran you ran the lab like multiple times.
00:36:33.199 --> 00:36:34.000
Yeah, yeah.
00:36:34.239 --> 00:36:34.880
Yeah.
00:36:35.840 --> 00:36:39.440
So for this one, I kind of created a simple setup.
00:36:39.519 --> 00:36:48.559
Um, because uh, like I said, I have the server rack where I have one lab with a old laptop that I use for college or I use in college.
00:36:48.800 --> 00:37:07.440
But on my other computer that I have, um I just downloaded the Topic Red Team Chainsaw and got the sys monologues and then used DS Code to create the segment rules in there, and I would practice it in that way instead of having to run full-fledged operations in Caldera.
00:37:07.679 --> 00:37:16.880
I like both, um, but I I'll have to say it's it's really easy to run um that operation in atomic retine.
00:37:17.440 --> 00:37:19.039
It's it's so much easier.
00:37:19.280 --> 00:37:35.679
I think Caldera, I think organizations could take great advantage of Caldera to run actual simulated threats, like whatever for whatever threat active targets their their um their uh the business function that they're in.
00:37:36.480 --> 00:37:49.360
I find the the counter-argument I heard today on a call was that yeah, it's great to it's all well and dandy to run adversary emulation, to run adversary emulation.
00:37:49.519 --> 00:38:00.960
And yet some people think that the open source Caldera and Atomic Red Team is is not good enough because the attackers already see that we're using that.
00:38:01.119 --> 00:38:16.880
And and so it's like we should either make that a little bit more kind of private, just a blue teamers in I don't know, private channels, and not have it be so out in the open, but and that they're not gonna probably take those routes that we're now testing.
00:38:17.039 --> 00:38:18.960
So it's it's a whole thing.
00:38:23.039 --> 00:38:27.840
I would say that it could be a starting point for orgs.
00:38:28.159 --> 00:38:28.559
Yeah.
00:38:28.800 --> 00:38:34.480
Like, do we have the the proper detections in place to be able to detect anything?
00:38:34.559 --> 00:38:39.599
Because I think some of these SAMS and EDRs have like maybe out-of-the-box detections.
00:38:40.159 --> 00:38:40.559
Yes.
00:38:41.199 --> 00:38:46.639
Some of them may be good, some of them may not be, but it all has to be tailored to your environment.
00:38:46.880 --> 00:38:55.039
If you work in accounting or if if the business function is banking and then another customer or another business is is insurance.
00:38:55.360 --> 00:39:00.079
You can be targeted by two completely different types of threat actors with with different TTPs.
00:39:00.320 --> 00:39:08.960
So it's like you have to have some way of testing your capabilities to detect these threat actors in your environment.
00:39:09.360 --> 00:39:09.840
100%.
00:39:10.239 --> 00:39:12.960
Because they're they're like they're going to try, right?
00:39:13.039 --> 00:39:16.239
They're gonna they're gonna try to wiggle on that doorknob.
00:39:16.400 --> 00:39:21.920
And if you don't have that six, you know, secure control in place, then you're you're pop.
00:39:22.239 --> 00:39:24.800
You can't not do it because it's out there in the open.
00:39:24.880 --> 00:39:26.320
They're still gonna try anyway.
00:39:26.480 --> 00:39:26.800
Yeah.
00:39:27.440 --> 00:39:28.880
It's only a matter of time.
00:39:29.119 --> 00:39:44.960
So they're gonna, they're still gonna try, but you know, you still have to deal those mechanisms to catch them and have the right personnel that, hey, this looks like this activity, this looks like a precursor to ransomware.
00:39:45.039 --> 00:39:48.880
If we don't take action, we're probably gonna have ransomware in a few hours.
00:39:49.039 --> 00:39:59.840
You know, you have to have to have a combination of both the good detection engineers and the good analysts who can who can look at this and you know have a good idea of what's going on early on.
00:40:00.880 --> 00:40:02.239
Yes, absolutely.
00:40:02.400 --> 00:40:04.239
I fullheartily agree with that.
00:40:04.400 --> 00:40:07.280
And I I do appreciate everything you shared with us.
00:40:07.440 --> 00:40:14.800
I think that has been really helpful, especially to someone who's been thinking about or considering taking this course.
00:40:14.960 --> 00:40:21.920
And we've established that maybe someone's taking someone who's taking their first security course, maybe that's not going to be the one for them.
00:40:22.079 --> 00:40:24.719
But who would you say this is perfect for?
00:40:25.039 --> 00:40:57.199
I would say this discourse through and through is perfect for maybe that tier two or tier three in a organization that is already creating rules, but they maybe want more structure, or they maybe want to get better at tuning the rule or looking at threat reports, or even adding adversary emulation in there, you know, figuring out, you know, is this does this rule work and what did it detect this?
00:40:57.440 --> 00:41:08.159
So I would say it's good for those higher-ups, those higher-up tiers of analysts, or even existing engineers who also creating rules is a part of their job.
00:41:08.400 --> 00:41:32.239
And even the even the person that's curious about detection engineering read some few books and they like it, but they maybe haven't just taken any initiative towards, you know, diving down that rabbit hole deeper because I think that this course for that specific person, if they start to take this course, I think they will be sold all the way on the if they're already leaning towards that.
00:41:32.559 --> 00:41:58.239
As far as the beginner or someone early on, I would say live a little bit more as an analyst, get your experience up, um, take part in those advanced um detections that fire and understand understand the nature of what's going on and if it's if it's actually something.
00:41:58.480 --> 00:42:07.599
Do that for a little while, writing the rules that detect this type this type of activity interests you, then at that point, then I think you should you should do this training.
00:42:08.000 --> 00:42:09.840
That's a words of wisdom right there.
00:42:10.000 --> 00:42:11.519
I really appreciate that.
00:42:11.840 --> 00:42:19.519
And if you are looking for additional material to get more, more into the craft.
00:42:20.320 --> 00:42:25.679
PACT is releasing a detection engineering summit over the weekend.
00:42:25.760 --> 00:42:30.639
I believe it's going to be in January, like the last couple weeks of January.
00:42:30.960 --> 00:42:39.760
Uh more to come on that, as well as detection engineering and threat hunting conference, the Deathcon is coming up November 13th and 14th.
00:42:39.920 --> 00:42:43.760
Datadog Detect as well, November 2nd.
00:42:44.000 --> 00:42:50.400
So lots of uh lots of events coming up soon, both as remote virtual formats and in person.
00:42:50.639 --> 00:42:52.079
Uh, definitely check those out.
00:42:52.239 --> 00:42:55.360
Get involved with the community to try a hands-on lab practice.
00:42:55.440 --> 00:42:56.559
Also, threat hunting labs.
00:42:56.639 --> 00:42:57.840
Oh my gosh, by Costas.
00:42:58.000 --> 00:42:59.119
Have you looked, have you looked into that one?
00:42:59.199 --> 00:43:00.719
I forgot to talk about that one.
00:43:01.119 --> 00:43:06.239
I have not, but that is something that I wanted to add in for my future training.
00:43:06.639 --> 00:43:09.199
Threat hunting lab, this was one of the newer ones.
00:43:09.360 --> 00:43:15.440
And I do believe they do focus on, they do focus on more cloud native-y types of labs.
00:43:15.599 --> 00:43:26.559
Because I find that oftentimes these labs from like MITR Ingenuity, the purple MAD one, is they're very old school, very old school, like working on 2017 Threat Intel.
00:43:26.960 --> 00:43:27.280
Yeah.
00:43:27.679 --> 00:43:34.559
Yeah, like there's some things that Windows isn't even shipping with anymore that you're that you're like practicing in that lab.
00:43:35.840 --> 00:43:36.480
Yeah.
00:43:37.199 --> 00:43:37.679
Speed.
00:43:38.000 --> 00:43:39.599
They gotta catch up to speed.
00:43:39.840 --> 00:43:41.039
So get involved.
00:43:41.119 --> 00:43:58.159
I think the best thing that I am taking with me, thanks to you, Tobias, is that it's not just about this badge, it's just about this discipline, this engineering as a discipline, uh, understanding the behavior, the world around it, to build it, test it, validate, ship it, improve it.
00:43:58.400 --> 00:44:02.639
That is a whole structured and scientific craft in and of itself.
00:44:02.719 --> 00:44:07.440
And that's something that I don't, I think people underestimate in detection engineering.
00:44:07.599 --> 00:44:07.920
Yeah.
00:44:08.159 --> 00:44:09.840
But that's the best part about it.
00:44:10.320 --> 00:44:10.960
For sure.
00:44:11.199 --> 00:44:12.079
For sure.
00:44:12.400 --> 00:44:13.760
I'm gonna have to agree.
00:44:14.159 --> 00:44:17.599
If you're thinking about taking it, know where you're starting from.
00:44:17.760 --> 00:44:22.079
We got some incredible advice, and obviously, thanks to you.
00:44:22.480 --> 00:44:26.159
So if this helped anybody, send this to an analyst.
00:44:26.320 --> 00:44:29.840
And this has been this episode of Detection Dispatch.
00:44:29.920 --> 00:44:30.880
Keep building, keep sharing.
00:44:30.960 --> 00:44:32.480
I'll catch you all in the next one.
00:00:12.080 --> 00:00:19.920
Welcome back to Detection Dispatch, the detection engineering and the threat hunting show that showcases the real humans behind the craft.
00:00:20.079 --> 00:00:23.760
Today we're doing something that we don't really get into very often.
00:00:23.920 --> 00:00:33.520
We're getting into a real honest review of a detection engineering certification, which is quite literally one of the only ones that there actually are out there.
00:00:33.679 --> 00:00:40.880
Like if you know, you know certs built for detection engineering specifically are super, super rare.
00:00:41.039 --> 00:00:43.679
I could count them like on one hand, type of rare.
00:00:43.840 --> 00:00:47.039
So when one does exist, of course, all of us have a lot of questions.
00:00:47.200 --> 00:00:47.840
Is it legit?
00:00:47.920 --> 00:00:48.880
Is it hands-on?
00:00:49.359 --> 00:00:52.159
Is it for more beginner focused?
00:00:52.399 --> 00:00:54.240
Is it for people actually doing the work?
00:00:54.399 --> 00:00:56.159
Is it worth your time and money?
00:00:56.399 --> 00:01:02.479
Are we going and we are going to answer all of that today with someone who just went through it himself?
00:01:02.640 --> 00:01:05.840
And he's going to give us the T on if it's worth it.
00:01:06.159 --> 00:01:08.319
Welcome to the show, Tobias.
00:01:09.040 --> 00:01:10.239
I'm glad to be here.
00:01:10.319 --> 00:01:11.280
Thanks for having me.
00:01:11.599 --> 00:01:19.519
It's pretty crazy that you were just saying you you just saw one of my videos, and now you're on the other side in my video.
00:01:20.400 --> 00:01:30.480
And it's crazy because before I seen the video that I watched, I was saying your name all over LinkedIn in regards to detection engineering.
00:01:30.719 --> 00:01:33.359
I'm like, wow, this is this is crazy.
00:01:33.680 --> 00:01:40.079
There's I I feel like that's my hyper-focused niche, which is it a good thing, is it a bad thing?
00:01:40.239 --> 00:01:44.239
I always get a little sad that I don't have the views that like John Hammond does.
00:01:44.319 --> 00:01:47.280
But I'm like, do is there like he's got millions of views?
00:01:47.359 --> 00:01:50.560
But I'm like, is there millions of detection engineers out there?
00:01:50.879 --> 00:01:51.920
Probably not.
00:01:52.560 --> 00:01:56.719
Especially not, they're definitely not a lot of them making uh content about it.
00:01:57.040 --> 00:01:59.840
Hey, I think you're like the uh the front runner for that.
00:02:00.159 --> 00:02:02.719
Well, I I hope that you're not tired of me yet.
00:02:02.879 --> 00:02:05.040
And I am I'm so glad to have you on.
00:02:05.280 --> 00:02:13.520
I know you're I love having folks in all aspects of of the craft and in all journeys of life in the space.
00:02:13.599 --> 00:02:15.840
And I especially those who work in MDR.
00:02:15.919 --> 00:02:18.719
I know you work in in the MDR side of things.
00:02:18.800 --> 00:02:26.879
And I love, I do love MDR because you see so many different diverse environments in literally like an eight-hour shift.
00:02:27.360 --> 00:02:28.000
Yeah.
00:02:28.400 --> 00:02:31.919
You definitely it's definitely a great place to be.
00:02:32.159 --> 00:02:38.319
I've never worked in an internal SOC, but from what I'm what I hear, I think I'm glad that I'm an MDR.
00:02:39.280 --> 00:02:47.199
Well, you don't work, maybe you haven't worked for one, but now you you see so many because you're like an extended version of all of your customer socks.
00:02:47.680 --> 00:02:48.159
Yeah.
00:02:48.479 --> 00:02:57.360
Um being an MDR is like, you know, you get to see um a lot of different activity.
00:02:57.439 --> 00:03:02.879
You get to see a lot of misconfigurations, some good practices, some not so good.
00:03:03.120 --> 00:03:07.439
So it's like the uh it's a very good place to be, I'd say.
00:03:07.919 --> 00:03:10.639
Especially with someone so early in their career, too.
00:03:10.800 --> 00:03:13.439
You it would just how how long have you been in the space?
00:03:13.759 --> 00:03:16.080
Um it'll be four years in February.
00:03:16.400 --> 00:03:17.280
Four years.
00:03:17.439 --> 00:03:18.080
I I don't know.
00:03:18.159 --> 00:03:26.639
I feel like you should take that kind of like dog years, where it's four years in the in the industry, but if it's an MDR specifically, it's probably more than that.
00:03:26.960 --> 00:03:28.560
It's kind of like a startup.
00:03:29.840 --> 00:03:31.919
I I bet the pressure is on, though.
00:03:32.080 --> 00:03:36.000
I bet it's a lot, I bet it's intense, and I bet it's like y'all have to move fast.
00:03:37.199 --> 00:03:37.680
Yeah.
00:03:37.919 --> 00:03:42.000
Um, because I've worked at this is my second MDR company.
00:03:42.240 --> 00:03:50.639
So I've seen I've worked in a smaller MDR company and now a bigger one that has tons and tons of customers.
00:03:50.800 --> 00:03:53.439
So, you know, it's it's very fast-paced.
00:03:53.840 --> 00:03:57.759
And yet you still found the time to take this certification.
00:03:59.039 --> 00:03:59.680
Yeah.
00:04:00.000 --> 00:04:08.560
Um, I'm one of those kind of guys that, you know, after five is when the day really starts for me, you know, especially with studying.
00:04:08.800 --> 00:04:12.400
Because I started in so in the sock.
00:04:12.639 --> 00:04:15.840
So I didn't get to do IT hub desk or anything like that.
00:04:15.919 --> 00:04:21.839
So when I got in the the cyber, I landed right in the sock, I felt like I had so much catching up to do.
00:04:22.079 --> 00:04:24.319
So that's why I'm just always on go.
00:04:24.399 --> 00:04:30.160
Like, sometimes it's it can be a good thing or sometimes it can be a bad thing, because you know, sometimes I don't know how to rest.
00:04:30.319 --> 00:04:32.079
So, but yeah.
00:04:33.120 --> 00:04:39.360
It's it's so important to to detach for especially after after your shift, though.
00:04:39.759 --> 00:04:40.720
Yeah, for sure.
00:04:40.879 --> 00:04:41.519
For sure.
00:04:41.759 --> 00:04:50.959
Sometimes I'll, you know, sometimes I'll take a breather, but immediately afterwards, sometimes I have to get right to the gym just to to keep it going.
00:04:51.040 --> 00:04:56.000
Cause you know, I do 10-hour shifts, so eight to six, you know, it's pretty much all day.
00:04:56.079 --> 00:05:00.240
And then, you know, I can't stay up too late because I have to be back in the sock, you know, in the morning.
00:05:00.319 --> 00:05:06.800
So it's uh So does that mean you have one one day free, like during the week?
00:05:06.959 --> 00:05:08.959
Like do you do four days a week?
00:05:09.519 --> 00:05:11.120
Four days on, three days off.
00:05:11.680 --> 00:05:12.079
I see.
00:05:12.319 --> 00:05:12.560
Okay.
00:05:13.120 --> 00:05:13.680
Wow.
00:05:13.839 --> 00:05:14.160
Wow.
00:05:14.480 --> 00:05:15.199
So it's nice.
00:05:15.279 --> 00:05:16.959
I I love having three days off.
00:05:17.040 --> 00:05:18.160
It is really nice.
00:05:18.480 --> 00:05:18.800
It is.
00:05:19.120 --> 00:05:19.360
It is.
00:05:19.839 --> 00:05:20.959
It's a great schedule.
00:05:21.279 --> 00:05:26.480
I was gonna say, I was like, the 10-hour days don't seem that bad because I'm already kind of working 10-hour days too.
00:05:26.560 --> 00:05:34.720
And then we also just set up pager duty, so we have to be we we have to be available and responding to alerts within 15 minutes.
00:05:36.399 --> 00:05:36.879
Yeah.
00:05:37.680 --> 00:05:40.639
Are you are y'all on on call or pager duty at all?
00:05:40.959 --> 00:05:43.839
Um lucky.
00:05:44.240 --> 00:05:45.920
Lucky, lucky lucky.
00:05:46.160 --> 00:05:54.560
Well, this exam important to note disclaimer then I that the exam is under NDA, and we definitely respect that here.
00:05:55.759 --> 00:06:17.839
So we're obviously not going to talk about what's specifically in the test, but let what we should talk about sort of the environment that you kind of created to prepare yourself to take it, the training, the labs, the prep, and and really, I mean, for for other folks like like yourself to know if it's actually worth their time.
00:06:18.000 --> 00:06:30.639
So I'm I'm I'm really happy and and I know that you wrote a a really great article about this, but this is more like of an informal discussion on it for for folks that wanna that wanna really get into it.
00:06:33.360 --> 00:06:40.959
So my first question is I I mean, clearly there's no detection engineering certs out there.
00:06:41.120 --> 00:06:46.800
So picking one one with your very limited time had to be, had to be very like finely selected.
00:06:46.959 --> 00:06:51.759
What did was there anything that tipped it that made you want to want to go after it specifically?
00:06:51.920 --> 00:06:54.480
What were you what were you hoping to get out of it?
00:06:56.879 --> 00:07:05.360
So I did a lot of research on different certifications and trainings that I feel could have been of value.
00:07:05.519 --> 00:07:07.680
Like you said, it's not many out there.
00:07:07.839 --> 00:07:14.639
I've seen a few reviews on the C D the C D G or C D Da E, excuse me.
00:07:15.279 --> 00:07:16.560
You know the acronyms.
00:07:17.040 --> 00:07:17.680
Yeah.
00:07:18.800 --> 00:07:26.639
But I think that there was this one that I came across um from this from this guy on LinkedIn.
00:07:26.879 --> 00:07:30.560
He gave a pretty in-depth um review on it.
00:07:30.879 --> 00:07:35.279
And I was like, this could be something that I'll probably invest in.
00:07:35.519 --> 00:07:39.120
Um luckily my org paid for it for me.
00:07:39.759 --> 00:07:44.240
But I probably I was so interested in it that I probably still would have paid out of pocket.
00:07:44.480 --> 00:07:44.800
Okay.
00:07:45.680 --> 00:07:49.600
So that's kind of what, you know, got me into it.
00:07:49.759 --> 00:08:00.079
Before the certification, though, or after, or during the certification, I kind of realized that a lot of it, a lot of it I had kind of built in my home lab.
00:08:00.879 --> 00:08:06.639
So it was kind of like this is this can add structure to what I'm already doing.
00:08:06.959 --> 00:08:14.319
And it can it can give me more of a structured approach to the way that I create detections in my home lab.
00:08:14.480 --> 00:08:18.639
And it even gave me additional tools to use to be able to test them.
00:08:18.800 --> 00:08:24.079
And uh yeah, that's that's pretty much how I was able to decide and say, like, yeah, I'll do this one.
00:08:24.480 --> 00:08:32.559
Do you think that building your home lab, figuring it out on your own prepared you better for the exam, or it just sort of like accelerated it?
00:08:34.159 --> 00:08:46.480
Well, I guess you could kind of say both because I probably got interested into the detection engineering early 2025.
00:08:46.799 --> 00:08:50.080
So at that point, I had been in the SOC for about two years.
00:08:50.320 --> 00:08:57.279
So now I'm like, okay, you know, I got my experience um triaging and investigating.
00:08:57.679 --> 00:09:02.320
What area of security could I be interested in?
00:09:02.559 --> 00:09:09.519
And so my old manager at my last company, you know, I'm I sent him a message because he was the one that was creating all the detections.
00:09:09.679 --> 00:09:11.600
So I asked him, like, how did he do it?
00:09:11.759 --> 00:09:12.799
What language did he use?
00:09:12.960 --> 00:09:14.080
So he told me the language.
00:09:14.639 --> 00:09:16.879
K KQL, SPL, SQL?
00:09:18.080 --> 00:09:22.480
Um, I think it was the universal one.
00:09:22.799 --> 00:09:26.399
Yeah, yeah, and then just converted it from what he would tell me.
00:09:26.480 --> 00:09:28.399
Just created an Sigma and then converted.
00:09:28.799 --> 00:09:31.279
Um, so I was really interested in that.
00:09:31.360 --> 00:09:34.159
I'm like, man, how does he do that?
00:09:34.399 --> 00:09:48.000
So I'm one of those kind of people where, you know, if if if there are not many resources online, or if I don't, if I can't, if there's not an opportunity for me to do it in production, let me take this over to the lab.
00:09:48.399 --> 00:09:50.720
So let me see what I can build in the lab.
00:09:50.879 --> 00:09:56.320
And so I've had so many iterations of a detection engineering lab.
00:09:56.399 --> 00:09:58.000
I started on Waza, I think.
00:09:58.159 --> 00:10:01.440
That was the first SIM that I used for detections.
00:10:01.519 --> 00:10:08.080
You know, I've I've played around with Splunk and before that, but strictly to create detections, it was Waza.
00:10:10.799 --> 00:10:12.559
Waza was okay.
00:10:12.960 --> 00:10:20.080
Um, I eventually made my way to Elastic, which I love elastic.
00:10:20.320 --> 00:10:20.960
Yeah.
00:10:21.600 --> 00:10:25.840
I absolutely love Elastic from everything about it.
00:10:26.240 --> 00:10:35.600
I was like, let me figure I think I I think my first detection that I created was like a password spray detection or something like that.
00:10:36.159 --> 00:10:44.240
And then I would, I would like simulate it on a what on the VM and then see if it can fire.
00:10:44.720 --> 00:10:49.600
And that really, once, once I was able to actually get it working, it let a fire under me.
00:10:49.679 --> 00:10:51.679
I was like, oh, this is how.
00:10:52.000 --> 00:10:52.639
This is how.
00:10:52.799 --> 00:10:57.519
And then, you know, working as an analyst, I already knew how to go investigate it.
00:10:57.759 --> 00:11:02.720
So it was like, it was kind of like a just a circle, like a, you know, like a full circle moment.
00:11:03.039 --> 00:11:03.679
Yeah.
00:11:04.080 --> 00:11:08.720
So from then on, it, it just, that's pretty much how that began.
00:11:09.039 --> 00:11:15.600
It's a bit of an adrenaline thing to, to, to work on that very iterative workflow.
00:11:15.759 --> 00:11:16.960
To because you gotta tweak it.
00:11:17.039 --> 00:11:23.120
You gotta keep kind of tweaking it, keep replaying it, right, until it really actually fires.
00:11:23.519 --> 00:11:25.360
Because it's it's always there's always a problem.
00:11:25.519 --> 00:11:30.399
There's always either your VM in your lab didn't actually run it correctly.
00:11:30.480 --> 00:11:34.879
So there, for it didn't pass it to the agent, or is it a problem coming in?
00:11:35.120 --> 00:11:36.159
Is the data in?
00:11:36.399 --> 00:11:37.919
Okay, the data's coming in.
00:11:38.000 --> 00:11:43.440
If it's not and it's still not firing, then probably like the logic, a problem with the logic, like just working backwards.
00:11:43.519 --> 00:11:45.440
That's so it's like a puzzle.
00:11:46.159 --> 00:11:48.240
That's the best way that I can describe it.
00:11:48.320 --> 00:11:50.000
It's literally like a puzzle.
00:11:50.320 --> 00:11:56.159
And now where I am with my lab, I test them with atomic red team.
00:11:56.320 --> 00:11:56.639
Yeah.
00:11:57.519 --> 00:11:59.120
I use Caldera?
00:11:59.759 --> 00:12:00.240
Yep.
00:12:00.399 --> 00:12:00.960
Yep.
00:12:01.200 --> 00:12:03.679
I use a plethora of different tools.
00:12:03.919 --> 00:12:17.039
And when that whenever I use chainsaw to try to see if it works and if it was detected, whatever the whatever I was trying to detect, it'll tell me if it worked, or it'll say zero rules detected or something like that.
00:12:17.200 --> 00:12:20.240
And I'm like, wow, what what what was wrong with my logic?
00:12:20.399 --> 00:12:24.159
Where do I have to backpedal to see what I'm missing?
00:12:24.320 --> 00:12:26.240
Because I know this activity is in the logs.
00:12:26.320 --> 00:12:30.240
I know it's there, but it has to be something wrong with my logic.
00:12:30.480 --> 00:12:32.240
Yeah, the rule itself.
00:12:32.639 --> 00:12:33.279
Exactly.
00:12:33.519 --> 00:12:45.440
So it's a sometimes it can be frustrating, but when you finally figure it out and you finally get that rule to fire and it finally works, to me, it's like it's all orbiting.
00:12:46.320 --> 00:12:52.000
I like how you specifically said that this assert teaches you the structure.
00:12:52.240 --> 00:12:53.840
Detection engineering as a discipline.
00:12:54.000 --> 00:12:57.440
It it's not necessarily helping you with the language, like you said.
00:12:57.519 --> 00:13:02.000
It's it's not really helping you build Sigma or or how to, it's not a syntax course, pretty much.
00:13:02.080 --> 00:13:12.720
And I think that's really important to distinguish that writing a rule is just a normal Tuesday, but it's just a part of the detection engineering lifecycle.
00:13:12.879 --> 00:13:14.320
It's not the whole thing, right?
00:13:14.480 --> 00:13:22.799
So if you walk us through the arc of the training per se, like how would you say that that is built on from section to section?
00:13:22.879 --> 00:13:26.879
Like, how does it, how, what is the structure that you talk about?
00:13:27.519 --> 00:13:31.279
As far as I'll say this from my experience with it.
00:13:31.519 --> 00:13:39.759
Um there were sections that I skipped over.
00:13:39.919 --> 00:13:45.679
Um, and then I made I jumped directly to the stuff that I felt was relevant for me, what I was trying to learn.
00:13:48.159 --> 00:14:00.879
Like reading threat reports and um seeing what you can find in the threat report to be able to map out, you know, the coverage for it, um, and and then build the detection.
00:14:01.039 --> 00:14:13.919
It it does touch a bit on um the rule and rule structure and and breaking down what each of the the Sigma R rule, what it means at each phase and different things like that.
00:14:14.080 --> 00:14:22.799
And once I had that, because I was more so wanting to know like what it what am I missing?
00:14:22.960 --> 00:14:26.320
How could I take what I'm already doing and make it better?
00:14:26.639 --> 00:14:26.799
Yeah.
00:14:27.120 --> 00:14:35.919
So overall, I can honestly say this certification took me over that hump as far as what I wanted out of the certification.
00:14:36.080 --> 00:14:48.480
There were things in the certification that I felt were it kind of just depends on where you are and what angle you're coming at, if in terms of if this is worth it for you.
00:14:48.720 --> 00:14:55.200
I mean, detection engineering in itself, it's not really a junior thing.
00:14:55.440 --> 00:15:03.759
It's more so of you've been in security for a little while, you maybe worked as an analyst, or you maybe even at a different angle from that.
00:15:04.000 --> 00:15:11.120
So you know what these, you know what these rules are when they're firing, you you know what to do, where to even where to start at least.
00:15:11.360 --> 00:15:20.159
So it it has a lot of foundational stuff, like on the basic level, which is cool, but it it kind of just depends on what angle you're coming from.
00:15:20.320 --> 00:15:22.799
And I've had a lot of people ask me, hey, do you think it's worth it?
00:15:23.039 --> 00:15:28.639
And I would have to say to that, is like it's highly, highly, highly specialized.
00:15:29.120 --> 00:15:39.919
So it's like, I think that either you have to be creating rules and maybe a day-to-day, and maybe want to get better at the rules that you're already creating and maybe have some structure to that.
00:15:40.559 --> 00:15:48.799
Um, or you absolutely have a passion for creating rules, testing them, and actually wanting to detect the bad guys.
00:15:49.759 --> 00:16:02.080
So it I mean, it combines all of that workflow of understanding the threat, writing a rule around it, testing it, validating, deploying it.
00:16:02.159 --> 00:16:06.320
Like that is the core to what we do.
00:16:07.600 --> 00:16:15.840
And would you say you said you skipped some of the foundational what what would you what we what are you defining as foundational, like reading a threat report?
00:16:15.919 --> 00:16:17.120
Like that's pretty foundational.
00:16:17.519 --> 00:16:18.320
No, no, no, no.
00:16:18.480 --> 00:16:21.759
Mean like uh operating system basics.
00:16:22.320 --> 00:16:23.279
Got it, got it.
00:16:23.519 --> 00:16:33.360
Or so more so of the the stuff that you probably should know when you get into security or at the beginning of your journey or something.
00:16:33.759 --> 00:16:36.799
Like the comp TIA, Security A plus that that stuff.
00:16:37.200 --> 00:16:37.519
Yeah.
00:16:37.759 --> 00:16:38.080
Okay.
00:16:38.720 --> 00:16:45.039
What what would you say was the most valuable then part of the training arc or the all of the sections?
00:16:46.159 --> 00:16:51.279
Yeah, because I I I wanted to get to the meat and potatoes of it.
00:16:52.000 --> 00:16:58.720
I I would have to say um pretty much, oh man, this was one of my favorite sections.
00:16:59.600 --> 00:17:00.320
The GitHub.
00:17:00.480 --> 00:17:11.200
The GitHub for like having that detectionist code architecture and then you committing the rules to that was probab that was my favorite, that was my favorite section.
00:17:11.279 --> 00:17:16.640
Um, and then you know, you got the the Sigma, the Yara, and tuning.
00:17:16.880 --> 00:17:21.440
Those off the top of my head from what I can remember, those were my favorite at least.
00:17:21.759 --> 00:17:30.480
Was that because it was genuinely like new to you or it or it reinforced or put to practice what what y'all have been doing?
00:17:31.759 --> 00:17:39.119
So it's kind of because it kind of gives you a little bit of what's happening on the back end.
00:17:39.279 --> 00:17:50.319
You know, because depending on how your the organization may have everything set up, some organizations don't have a role called detection engineer.
00:17:50.720 --> 00:17:53.519
That may be a senior analyst's function.
00:17:53.599 --> 00:17:56.240
We'll we'll create rules or something like that.
00:17:56.400 --> 00:18:11.920
But this shows, hey, in a mature organization that implements detectionist code, a detectionist core architecture, this is how it happens, and it'll get funneled down to me as an analyst to where I can see it.
00:18:12.000 --> 00:18:17.759
So I get the alert, but it shows the back end, okay, here's how this is created.
00:18:17.920 --> 00:18:20.880
This is what it what it was created from, how it was tested.
00:18:21.119 --> 00:18:24.160
And now it's on you to go in and validate this.
00:18:24.240 --> 00:18:30.960
Hey, is this malicious activity or is this something that it's not really something that we need to worry about?
00:18:31.119 --> 00:18:37.759
So it kind of uh gave me a big perspective as far as the back end goes.
00:18:38.480 --> 00:18:45.680
So if you were to say, like, what what more structure would you say it added to your workflow?
00:18:46.400 --> 00:18:52.240
Like, how do you go about detection engineering now, after like since you've taken the course?
00:18:53.440 --> 00:19:17.200
Um I'll say it gave me structure in terms of like um for one, I would say just getting better at understanding the syntax of of Sigma and then um maybe converting it and converting that into a query that can be that that can you know be pushed into a um a sim.
00:19:17.920 --> 00:19:24.559
It gave me that kind of that kind of structure just to under like I was saying a little few minutes ago about the the back end.
00:19:24.720 --> 00:19:37.519
But as far as the way that I go to create detections, I think the way that I do it, uh like I said, I've created so many iterations of of of detections, detections in my lab.
00:19:38.400 --> 00:19:52.319
Um like, for example, I remember early on, I would create or launch operations in Caldera, and then I would go threat hunt to see what happened, and then uh let me see if I can just build a detection for that.
00:19:52.400 --> 00:19:56.160
And then let me run the operation again to see if my rule will fire for it.
00:19:56.400 --> 00:19:56.960
Yeah.
00:19:57.200 --> 00:19:58.720
That's kind of how I was doing it.
00:19:58.880 --> 00:20:07.599
And that's kind of a bit of kind of how I do it now, but tuning, tuning was one of those big, big things.
00:20:07.839 --> 00:20:17.759
It was one of those huge things, actually, because you know, some people think, hey, we got this rule, it's created, let's push it to pride and forget about it.
00:20:18.000 --> 00:20:22.720
And creating the rule in itself, that's that's early.
00:20:22.960 --> 00:20:29.920
You have to make sure, there's so many other things that you have to make sure with this rule that it's not it's not drowning analysts.
00:20:30.000 --> 00:20:31.920
It actually catches what it's supposed to.
00:20:32.160 --> 00:20:36.480
It's so many different things that you have to to keep in mind when you're creating these rules.
00:20:36.559 --> 00:20:40.480
So it's kind of like a kind of like you know the game whack-a-mole.
00:20:40.720 --> 00:20:41.279
Yeah.
00:20:41.599 --> 00:20:42.640
It's kind of like that.
00:20:42.720 --> 00:20:44.640
That's kind of how I would, you know, would say.
00:20:45.359 --> 00:20:45.759
It is.
00:20:45.920 --> 00:20:48.160
It's one of those things you can't just set it and forget it.
00:20:48.400 --> 00:20:56.319
And I feel like what often people do is they build a rule, they tune out the false positives.
00:20:56.559 --> 00:21:02.559
Maybe it's okay for now, but then you know, things are changing like internally in the organizations.
00:21:02.799 --> 00:21:10.400
Uh the log source format is is also drifting a bit, and it's that has all these different points in the pipeline.
00:21:10.480 --> 00:21:11.440
It can go wrong.
00:21:11.759 --> 00:21:15.039
And eventually it's it's not gonna work anymore.
00:21:15.200 --> 00:21:17.519
And so then you got to fix that, you know.
00:21:17.680 --> 00:21:24.960
But then also, are we ever going back to check on those dormant rules that just haven't fired for a while?
00:21:25.119 --> 00:21:34.240
Like, do you do we have some kind of reminder or like a 30-day check or 90-day check to to go back and and and see what rules haven't fired in a while?
00:21:34.400 --> 00:21:37.279
Maybe, maybe it's time to to take a to take a look at them again.
00:21:37.519 --> 00:21:40.720
I feel like we don't really know not a lot of folks are doing that.
00:21:41.279 --> 00:21:43.200
I I would have to agree.
00:21:44.799 --> 00:21:50.240
Because it's it's one of those things where, you know, behaviors change.
00:21:50.559 --> 00:21:54.319
So this rule could have caught this activity at some point.
00:21:54.480 --> 00:21:58.640
That's now it's changed just a little bit and maybe it may be.
00:21:59.200 --> 00:21:59.759
Six months from now.
00:22:00.480 --> 00:22:01.200
Exactly.
00:22:01.359 --> 00:22:05.359
And so, you know, you want to keep up with the rules that you create.
00:22:07.200 --> 00:22:07.519
Yeah.
00:22:07.599 --> 00:22:12.000
And that's something that I feel like we enforce in our in our jobs.
00:22:12.160 --> 00:22:17.119
Cause in our labs, that is not something that we get to practice a lot with.
00:22:17.359 --> 00:22:20.000
We get our labs are the playground, right?
00:22:20.240 --> 00:22:29.599
For building the rule, the beginning part of it, testing the rule, creating the environment around it to run an adversary emulation, to generate the real telemetry, build a detection.
00:22:29.759 --> 00:22:30.319
Okay, cool.
00:22:30.480 --> 00:22:39.519
But then our labs don't capture the dynamic nature of internal business landscape change or external threat changes either.
00:22:39.759 --> 00:22:45.440
So that's like the the tuning part is where our real jobs really like sink in.
00:22:45.599 --> 00:22:47.359
But that's when like that's reality.
00:22:47.519 --> 00:22:52.240
It's like I wish you could practice more tuning in certifications like this, you know?
00:22:52.559 --> 00:22:52.799
Yeah.
00:22:53.039 --> 00:23:10.160
And I think I think that if Century continues to build on that certification and maybe add some of that to it, honestly, I think they they could probably have the best detection engineering certification in the in the industry.
00:23:10.720 --> 00:23:11.599
So that's your own.
00:23:13.599 --> 00:23:13.839
Yeah.
00:23:14.000 --> 00:23:17.039
They already, because it's already, it's already great.
00:23:17.200 --> 00:23:18.319
It's already great.
00:23:18.480 --> 00:23:28.000
But if they could hit on, you know, those additional pieces, I I don't think um, I think it would be hard for other vendors to compete with AMA.
00:23:28.640 --> 00:23:34.559
Would you say the same thing for a less less experienced detection engineer?
00:23:34.720 --> 00:23:37.279
Because four years is is well into the craft.
00:23:37.359 --> 00:23:39.200
Like would you say some like an entry level?
00:23:39.279 --> 00:23:41.839
Is are they a good fit a fit for this?
00:23:43.759 --> 00:23:49.279
Um I'm gonna be honest, I'm gonna have to say no.
00:23:49.839 --> 00:23:50.160
Okay.
00:23:50.640 --> 00:23:52.240
That's that's very honest.
00:23:52.880 --> 00:24:23.279
I think that I'm gonna say coming from the angle of a sock analyst or MDR analyst, I think that you should be able to get your experience in a fast-paced environment like that, looking at different alert types, different environments, seeing what's what could be normal, what could be not, and then being able to build on that experience and having that experience as the foundation.
00:24:23.519 --> 00:24:28.400
But you I would say probably two years is is is a good point from there.
00:24:28.960 --> 00:24:34.160
Then maybe you jump into DE or maybe start to do some of these trainings or whatever.
00:24:34.240 --> 00:24:37.920
But you know, at the same time, everybody learns at their own pace.
00:24:38.079 --> 00:24:48.160
Um, but I would say two years in an environment to where you can really get your hands dirty is I would say that's that would be Yeah.
00:24:48.400 --> 00:24:48.799
Yeah.
00:24:48.960 --> 00:24:51.119
So okay, so entry level, no.
00:24:51.359 --> 00:24:55.759
So you skipped some of some of these fundamentals at the beginning.
00:24:56.400 --> 00:25:01.359
What that that's something like they would not, they should not skip.
00:25:01.519 --> 00:25:02.559
Or maybe a pretest.
00:25:02.640 --> 00:25:04.480
Like they should have a little bit of a pretest.
00:25:06.240 --> 00:25:08.400
Probably it should have a little bit of a pretest.
00:25:08.559 --> 00:25:24.799
If they took this course and they didn't have as much experience, I would definitely say take the take the training and complete every module in the training from Windows basics to Linux basics to pretty much everything.
00:25:25.200 --> 00:25:26.720
Leave no stone unturned.
00:25:27.039 --> 00:25:27.359
Yeah.
00:25:27.599 --> 00:25:29.359
No, that that's really good advice.
00:25:29.599 --> 00:25:36.799
Now, the best part about certs in general is the hands-on lab portion of it.
00:25:36.880 --> 00:25:41.839
I mean, it's you'll you're just gonna learn far better than anything memorization-based, like Comp TIA.
00:25:41.920 --> 00:25:44.799
It's it's a memorization game, completely a memorization game.
00:25:44.880 --> 00:25:55.440
And and even the way that they structure the questions is it sucks so bad because it's like two answers are very correct, but you have to answer the most correct, right?
00:25:55.759 --> 00:25:59.839
And that's just not really testing your hands-on work, right?
00:26:00.000 --> 00:26:09.359
Your ability to really kind of figure things out, uh, like your your thinking, your the way you approach problems or problem solve, I guess is the right word.
00:26:09.519 --> 00:26:16.720
Uh, so as far as the playground environment, did that truly feel closer to detection work, would you say?
00:26:16.799 --> 00:26:18.079
Like your day-to-day.
00:26:20.880 --> 00:26:24.319
So I'll be completely honest with my experience.
00:26:24.480 --> 00:26:24.720
Yeah.
00:26:25.119 --> 00:26:31.279
First, my first shot at the exam, I failed.
00:26:31.599 --> 00:26:32.079
Oh no.
00:26:32.559 --> 00:26:34.160
I missed several questions.
00:26:34.319 --> 00:26:35.359
It it kinda hurt.
00:26:35.440 --> 00:26:39.039
It kinda hurt, but that just it just turned the heat up a little bit more.
00:26:39.519 --> 00:26:41.680
Sometimes that's the heat that you need.
00:26:42.319 --> 00:26:54.880
Yeah, and and I see I had to take notes of everything that I didn't do and resources that I didn't take advantage of, so that okay, here's I mean, I literally took notes of my phone.
00:26:55.039 --> 00:26:57.839
You didn't do this, you didn't do this, you could be better at this.
00:26:58.079 --> 00:27:03.200
So I and once I cleared my mind from the exam, because you know it's a long exam.
00:27:03.440 --> 00:27:04.000
Wait, how long?
00:27:04.160 --> 00:27:04.880
How long?
00:27:05.359 --> 00:27:07.759
Um, I think you get 24 hours.
00:27:08.000 --> 00:27:10.799
24 hours, okay, with all access to resources.
00:27:10.960 --> 00:27:13.039
Like you can you can reference whatever.
00:27:14.160 --> 00:27:14.559
Mm-hmm.
00:27:14.880 --> 00:27:15.200
Okay.
00:27:16.640 --> 00:27:21.519
Um so I took the notes, went over the notes.
00:27:21.839 --> 00:27:24.160
The playground was one thing that I didn't do.
00:27:24.319 --> 00:27:27.920
Because I'm thinking I've did this kind of work in my lab.
00:27:28.319 --> 00:27:29.359
Um I didn't know.
00:27:29.519 --> 00:27:31.279
You were a little bit overly confident.
00:27:31.440 --> 00:27:32.400
You went into it confident.
00:27:32.640 --> 00:27:33.920
You're like, no, I got this.
00:27:34.559 --> 00:27:35.119
For sure.
00:27:35.279 --> 00:27:38.400
I I'll be honest and admit I was overly confident.
00:27:38.720 --> 00:27:42.319
And then when I got in that exam, I was like.
00:27:42.720 --> 00:27:44.400
You have to run and find out.
00:27:44.720 --> 00:27:46.720
I was like, what am I looking at here?
00:27:49.200 --> 00:27:56.960
So that second time, when I was preparing for the second go-round, I absolutely took the um playground, I took it serious.
00:27:58.960 --> 00:28:05.119
And I will say, this is as much as I can say because of NDA purposes, of course.
00:28:05.359 --> 00:28:10.559
If you are in the process of taking this exam, absolutely do the playground.
00:28:11.039 --> 00:28:11.920
That's all I can say.
00:28:12.079 --> 00:28:13.359
I absolutely do the playground.
00:28:13.920 --> 00:28:17.200
Well, I I love learning from other people's mistakes.
00:28:17.279 --> 00:28:18.559
I think that's the best way to learn.
00:28:18.720 --> 00:28:28.400
And I also a lot of organizations also are catching on to the fact that there's a really high rate of passing when they fail the first time.
00:28:28.559 --> 00:28:35.039
Cause yeah, that level of rigor, but also you just now know how the the the test is structured, you know what to expect.
00:28:35.279 --> 00:28:40.799
So now what a lot of a lot of organizations, like the California Institute of Technology or something like that.
00:28:40.960 --> 00:28:42.240
Don't don't quote me on that one.
00:28:42.480 --> 00:28:57.599
But one of the one of the one of the California techie schools, they are now offering courses where you can do trainings and also it comes with the certification included that the exam passes and like multiple unlimited attempts to take it.
00:28:57.759 --> 00:29:02.799
Because they know like that's you're you're likely gonna pass it the second time, like or or even the third.
00:29:03.119 --> 00:29:03.599
Yeah.
00:29:03.920 --> 00:29:17.680
And you know, I I think that going back to the format of exams, honestly, I think that it doesn't get any better than a practical exam.
00:29:17.920 --> 00:29:25.039
Because if you study long enough, you can memorize, you know, different things for the security plus, CY plus, whatever.
00:29:25.119 --> 00:29:29.599
Any of these multiple choice exams, you can you can memorize those things.
00:29:29.920 --> 00:29:35.279
But with the practical exams, you have to show improve.
00:29:35.759 --> 00:29:40.880
So, yes, you know the answer, but can you go get the answer and can you present it?
00:29:41.039 --> 00:29:43.920
And can you come out on top in an actual environment?
00:29:44.079 --> 00:29:45.680
Can you actually go get the answer?
00:29:45.920 --> 00:29:51.519
And this is where companies like Security Blue Team, you know, it's it's just unmatched.
00:29:51.599 --> 00:29:55.359
So I know I think TCM security, they have other like hands-on.
00:29:55.920 --> 00:29:56.400
Yeah, you know.
00:29:56.880 --> 00:29:58.799
Yeah, but I I I like this one better.
00:29:58.880 --> 00:30:00.400
I've I've seen some of the TCM stuff.
00:30:00.480 --> 00:30:03.279
It's a little bit it's a little bit too entry-level.
00:30:03.759 --> 00:30:04.079
Okay.
00:30:04.559 --> 00:30:05.200
Yeah.
00:30:06.000 --> 00:30:06.559
I got you.
00:30:07.519 --> 00:30:08.960
In my experience, yeah.
00:30:09.440 --> 00:30:12.160
I haven't taken any of their certifications.
00:30:12.400 --> 00:30:21.119
I'll probably take a course or two, but probably I'm not at the current where I am currently, I'm not really interested in any of the certifications they have to offer.
00:30:21.200 --> 00:30:32.319
Um, but just the practical nature of these exams is just I would choose practical over if I if I never had to take a multiple choice again, you know, I probably wouldn't.
00:30:32.880 --> 00:30:41.759
But you know, having to renew certifications from secur from uh comp T, you know, I'm gonna have to take another multiple choice at some point.
00:30:42.000 --> 00:30:43.119
I'm sh I'm sure.
00:30:43.279 --> 00:30:43.839
I'm sure.
00:30:43.920 --> 00:30:45.759
Or or the CISSP.
00:30:46.079 --> 00:30:49.039
I failed CCSP the first time.
00:30:50.079 --> 00:30:51.039
Yeah, it was hard.
00:30:51.839 --> 00:30:52.960
It was very hard.
00:30:54.720 --> 00:30:56.480
How long did you study for it?
00:30:56.799 --> 00:30:59.200
I to be honest, not that long.
00:30:59.359 --> 00:31:02.240
I kind of thought I was going to as well like you.
00:31:02.319 --> 00:31:04.400
Like I I thought I was gonna I was gonna pass it.
00:31:04.559 --> 00:31:06.559
And I thought I didn't need to study that long.
00:31:06.640 --> 00:31:15.680
And it was one of those where I did take the course for it, and not to put blame on anyone, but my instructor was very boring.
00:31:16.799 --> 00:31:21.200
It was they were just so bad, so so bad.
00:31:21.359 --> 00:31:27.519
So we wouldn't even I I don't think that yeah, he was lecturing, but it wasn't really like going in.
00:31:27.680 --> 00:31:28.079
Yeah.
00:31:28.240 --> 00:31:36.799
But I in my mind I was like, well, I took the course, I I read the quizzes, I was doing a bunch of quizzes over and over and over again, and it just didn't work.
00:31:36.960 --> 00:31:37.519
But you know what?
00:31:37.599 --> 00:31:48.160
At the time, I didn't do you know how now in Gemini or in Claude, you could basically give, you know, Claude your study guide, your study material, and just be like, quiz me.
00:31:48.559 --> 00:31:51.039
And and I wish, I wish that.
00:31:51.200 --> 00:31:54.559
I mean, at the time, I mean, how did we even pass school without these tools?
00:31:54.720 --> 00:31:56.400
Like now I would have done that.
00:31:56.799 --> 00:31:57.680
Oh man.
00:31:58.240 --> 00:31:58.880
Yeah.
00:31:59.599 --> 00:32:04.000
The the the generations now, they have it so good.
00:32:04.160 --> 00:32:06.559
They do there's so many resources.
00:32:06.799 --> 00:32:10.960
Man, it's don't get me started on like the writing the papers and stuff.
00:32:11.279 --> 00:32:15.680
Man, but it it's yeah, it's crazy.
00:32:16.079 --> 00:32:16.640
I know.
00:32:16.799 --> 00:32:24.480
And but then again, I am also very grateful that I didn't need these AI tools to pass my classes.
00:32:24.640 --> 00:32:26.000
And and that in that we did.
00:32:26.079 --> 00:32:27.200
We that's what we had to do.
00:32:27.359 --> 00:32:38.240
We had to wire up all of our labs and look through config and look through documentation and do the hard work before Claude literally told us how to do it step by step by step by step.
00:32:38.400 --> 00:32:40.640
And I do think that people are better off for it.
00:32:40.799 --> 00:32:50.640
Those who had to go on Stack Overflow and and go through, you know, go through Googling the answers yourself, because just in the process of cer researching, you learned so much.
00:32:52.000 --> 00:32:52.400
Yeah.
00:32:52.799 --> 00:32:53.920
We'll have to agree.
00:32:54.079 --> 00:32:55.839
I would definitely have to agree.
00:32:56.720 --> 00:33:02.880
Was there any mistakes in your lab that because we we always learn from our mistakes the best?
00:33:02.960 --> 00:33:04.400
Like that's the best kind of experience.
00:33:04.559 --> 00:33:11.519
Uh were there a mis was there a mistake that really taught you the most and like you that you constantly reminisce about?
00:33:18.079 --> 00:33:25.440
I don't think so just because I really took advantage of breaking and fixing things in my lab.
00:33:25.599 --> 00:33:31.440
If it didn't, if it didn't work, if it didn't work, well why why doesn't it work?
00:33:31.599 --> 00:33:42.079
What what in the logs can tell me why um the container that runs Elastic isn't isn't starting and now I can't connect to the sim or whatever.
00:33:42.319 --> 00:33:45.759
You know, I I I think it all had to happen for a reason.
00:33:46.000 --> 00:33:54.960
So I think that um, I just it's a lab, you know, it's it's there for if things work, great.
00:33:55.279 --> 00:34:12.480
But I like to say when you're like in the journey of trying to learn something, the beginning is important, the end is important, but that middle part is the most important because the bumping your head, the descriptions, the why won't this rule fire?
00:34:12.719 --> 00:34:20.880
The how can I play devil's advocate to see if the threat actor was able to deviate this activity in some kind of way?
00:34:21.039 --> 00:34:22.159
Would it still work?
00:34:22.639 --> 00:34:23.039
Yeah.
00:34:23.280 --> 00:34:25.440
So it's it's yeah.
00:34:29.199 --> 00:34:33.280
The I've of course I want to get into the your your study rhythm.
00:34:33.440 --> 00:34:38.239
Uh you right away, you were like, how long well, how long did you study for the CCSV?
00:34:38.639 --> 00:34:41.280
How how long did you study for this one?
00:34:43.360 --> 00:34:48.639
Um what did the study rhythm look like?
00:34:48.800 --> 00:34:53.039
Was it like every day after your you said your your your day starts after five?
00:34:53.119 --> 00:34:55.440
Like was it every day after five one hour?
00:34:55.519 --> 00:34:59.920
Or was it like looking at YouTube videos at the gym?
00:35:00.159 --> 00:35:00.800
Like, I don't know.
00:35:00.880 --> 00:35:03.360
Well, what what do you what what did that look like?
00:35:04.079 --> 00:35:11.920
Yeah, so there would be days where at work, once I made sure it was okay with my teammates and it was maybe slow.
00:35:12.320 --> 00:35:13.199
Hey, can I study?
00:35:13.760 --> 00:35:15.280
Are you guys okay if I study?
00:35:15.440 --> 00:35:17.280
So sometimes I'm studying while I'm at work.
00:35:17.440 --> 00:35:23.840
Um and then when I get off work, you know, I go to the gym and then I'll study when I get home, study some notes that I take in.
00:35:24.000 --> 00:35:30.159
I have I also have one of those detection engineering books from PACT that we're talking about earlier.
00:35:30.400 --> 00:35:34.880
So I would look over that, and I would also have Chat GPT.
00:35:35.280 --> 00:35:35.840
Of course.
00:35:36.239 --> 00:35:43.440
Um help me, help me with some, some like basically create questions like Yeah, what does this rule need?
00:35:43.519 --> 00:35:47.599
Why wouldn't maybe why wouldn't this rule fire or would this rule be detected?
00:35:47.679 --> 00:35:49.679
You know, just to to help get me in that mode.
00:35:49.760 --> 00:36:00.559
But I think it kind of took me I want to say two and a half months, but once I failed the first time, I couldn't take it again for like, I think it was seven days or two weeks or something like that.
00:36:00.719 --> 00:36:04.400
So I think it may have gotten to that three-month period.
00:36:04.559 --> 00:36:10.559
Um and then once I passed, that's pretty much everything that I I I literally studied every day.
00:36:10.800 --> 00:36:27.440
If I didn't get a day to study like actual material, I'm in the lab trying to emulate something and figure, figure out a new rule or um just going over the structure of a of a Sigma rule, the Yara rule, um, so yes.
00:36:27.920 --> 00:36:28.719
That was pretty much what I'm saying.
00:36:29.039 --> 00:36:32.320
You ran you ran the lab like multiple times.
00:36:33.199 --> 00:36:34.000
Yeah, yeah.
00:36:34.239 --> 00:36:34.880
Yeah.
00:36:35.840 --> 00:36:39.440
So for this one, I kind of created a simple setup.
00:36:39.519 --> 00:36:48.559
Um, because uh, like I said, I have the server rack where I have one lab with a old laptop that I use for college or I use in college.
00:36:48.800 --> 00:37:07.440
But on my other computer that I have, um I just downloaded the Topic Red Team Chainsaw and got the sys monologues and then used DS Code to create the segment rules in there, and I would practice it in that way instead of having to run full-fledged operations in Caldera.
00:37:07.679 --> 00:37:16.880
I like both, um, but I I'll have to say it's it's really easy to run um that operation in atomic retine.
00:37:17.440 --> 00:37:19.039
It's it's so much easier.
00:37:19.280 --> 00:37:35.679
I think Caldera, I think organizations could take great advantage of Caldera to run actual simulated threats, like whatever for whatever threat active targets their their um their uh the business function that they're in.
00:37:36.480 --> 00:37:49.360
I find the the counter-argument I heard today on a call was that yeah, it's great to it's all well and dandy to run adversary emulation, to run adversary emulation.
00:37:49.519 --> 00:38:00.960
And yet some people think that the open source Caldera and Atomic Red Team is is not good enough because the attackers already see that we're using that.
00:38:01.119 --> 00:38:16.880
And and so it's like we should either make that a little bit more kind of private, just a blue teamers in I don't know, private channels, and not have it be so out in the open, but and that they're not gonna probably take those routes that we're now testing.
00:38:17.039 --> 00:38:18.960
So it's it's a whole thing.
00:38:23.039 --> 00:38:27.840
I would say that it could be a starting point for orgs.
00:38:28.159 --> 00:38:28.559
Yeah.
00:38:28.800 --> 00:38:34.480
Like, do we have the the proper detections in place to be able to detect anything?
00:38:34.559 --> 00:38:39.599
Because I think some of these SAMS and EDRs have like maybe out-of-the-box detections.
00:38:40.159 --> 00:38:40.559
Yes.
00:38:41.199 --> 00:38:46.639
Some of them may be good, some of them may not be, but it all has to be tailored to your environment.
00:38:46.880 --> 00:38:55.039
If you work in accounting or if if the business function is banking and then another customer or another business is is insurance.
00:38:55.360 --> 00:39:00.079
You can be targeted by two completely different types of threat actors with with different TTPs.
00:39:00.320 --> 00:39:08.960
So it's like you have to have some way of testing your capabilities to detect these threat actors in your environment.
00:39:09.360 --> 00:39:09.840
100%.
00:39:10.239 --> 00:39:12.960
Because they're they're like they're going to try, right?
00:39:13.039 --> 00:39:16.239
They're gonna they're gonna try to wiggle on that doorknob.
00:39:16.400 --> 00:39:21.920
And if you don't have that six, you know, secure control in place, then you're you're pop.
00:39:22.239 --> 00:39:24.800
You can't not do it because it's out there in the open.
00:39:24.880 --> 00:39:26.320
They're still gonna try anyway.
00:39:26.480 --> 00:39:26.800
Yeah.
00:39:27.440 --> 00:39:28.880
It's only a matter of time.
00:39:29.119 --> 00:39:44.960
So they're gonna, they're still gonna try, but you know, you still have to deal those mechanisms to catch them and have the right personnel that, hey, this looks like this activity, this looks like a precursor to ransomware.
00:39:45.039 --> 00:39:48.880
If we don't take action, we're probably gonna have ransomware in a few hours.
00:39:49.039 --> 00:39:59.840
You know, you have to have to have a combination of both the good detection engineers and the good analysts who can who can look at this and you know have a good idea of what's going on early on.
00:40:00.880 --> 00:40:02.239
Yes, absolutely.
00:40:02.400 --> 00:40:04.239
I fullheartily agree with that.
00:40:04.400 --> 00:40:07.280
And I I do appreciate everything you shared with us.
00:40:07.440 --> 00:40:14.800
I think that has been really helpful, especially to someone who's been thinking about or considering taking this course.
00:40:14.960 --> 00:40:21.920
And we've established that maybe someone's taking someone who's taking their first security course, maybe that's not going to be the one for them.
00:40:22.079 --> 00:40:24.719
But who would you say this is perfect for?
00:40:25.039 --> 00:40:57.199
I would say this discourse through and through is perfect for maybe that tier two or tier three in a organization that is already creating rules, but they maybe want more structure, or they maybe want to get better at tuning the rule or looking at threat reports, or even adding adversary emulation in there, you know, figuring out, you know, is this does this rule work and what did it detect this?
00:40:57.440 --> 00:41:08.159
So I would say it's good for those higher-ups, those higher-up tiers of analysts, or even existing engineers who also creating rules is a part of their job.
00:41:08.400 --> 00:41:32.239
And even the even the person that's curious about detection engineering read some few books and they like it, but they maybe haven't just taken any initiative towards, you know, diving down that rabbit hole deeper because I think that this course for that specific person, if they start to take this course, I think they will be sold all the way on the if they're already leaning towards that.
00:41:32.559 --> 00:41:58.239
As far as the beginner or someone early on, I would say live a little bit more as an analyst, get your experience up, um, take part in those advanced um detections that fire and understand understand the nature of what's going on and if it's if it's actually something.
00:41:58.480 --> 00:42:07.599
Do that for a little while, writing the rules that detect this type this type of activity interests you, then at that point, then I think you should you should do this training.
00:42:08.000 --> 00:42:09.840
That's a words of wisdom right there.
00:42:10.000 --> 00:42:11.519
I really appreciate that.
00:42:11.840 --> 00:42:19.519
And if you are looking for additional material to get more, more into the craft.
00:42:20.320 --> 00:42:25.679
PACT is releasing a detection engineering summit over the weekend.
00:42:25.760 --> 00:42:30.639
I believe it's going to be in January, like the last couple weeks of January.
00:42:30.960 --> 00:42:39.760
Uh more to come on that, as well as detection engineering and threat hunting conference, the Deathcon is coming up November 13th and 14th.
00:42:39.920 --> 00:42:43.760
Datadog Detect as well, November 2nd.
00:42:44.000 --> 00:42:50.400
So lots of uh lots of events coming up soon, both as remote virtual formats and in person.
00:42:50.639 --> 00:42:52.079
Uh, definitely check those out.
00:42:52.239 --> 00:42:55.360
Get involved with the community to try a hands-on lab practice.
00:42:55.440 --> 00:42:56.559
Also, threat hunting labs.
00:42:56.639 --> 00:42:57.840
Oh my gosh, by Costas.
00:42:58.000 --> 00:42:59.119
Have you looked, have you looked into that one?
00:42:59.199 --> 00:43:00.719
I forgot to talk about that one.
00:43:01.119 --> 00:43:06.239
I have not, but that is something that I wanted to add in for my future training.
00:43:06.639 --> 00:43:09.199
Threat hunting lab, this was one of the newer ones.
00:43:09.360 --> 00:43:15.440
And I do believe they do focus on, they do focus on more cloud native-y types of labs.
00:43:15.599 --> 00:43:26.559
Because I find that oftentimes these labs from like MITR Ingenuity, the purple MAD one, is they're very old school, very old school, like working on 2017 Threat Intel.
00:43:26.960 --> 00:43:27.280
Yeah.
00:43:27.679 --> 00:43:34.559
Yeah, like there's some things that Windows isn't even shipping with anymore that you're that you're like practicing in that lab.
00:43:35.840 --> 00:43:36.480
Yeah.
00:43:37.199 --> 00:43:37.679
Speed.
00:43:38.000 --> 00:43:39.599
They gotta catch up to speed.
00:43:39.840 --> 00:43:41.039
So get involved.
00:43:41.119 --> 00:43:58.159
I think the best thing that I am taking with me, thanks to you, Tobias, is that it's not just about this badge, it's just about this discipline, this engineering as a discipline, uh, understanding the behavior, the world around it, to build it, test it, validate, ship it, improve it.
00:43:58.400 --> 00:44:02.639
That is a whole structured and scientific craft in and of itself.
00:44:02.719 --> 00:44:07.440
And that's something that I don't, I think people underestimate in detection engineering.
00:44:07.599 --> 00:44:07.920
Yeah.
00:44:08.159 --> 00:44:09.840
But that's the best part about it.
00:44:10.320 --> 00:44:10.960
For sure.
00:44:11.199 --> 00:44:12.079
For sure.
00:44:12.400 --> 00:44:13.760
I'm gonna have to agree.
00:44:14.159 --> 00:44:17.599
If you're thinking about taking it, know where you're starting from.
00:44:17.760 --> 00:44:22.079
We got some incredible advice, and obviously, thanks to you.
00:44:22.480 --> 00:44:26.159
So if this helped anybody, send this to an analyst.
00:44:26.320 --> 00:44:29.840
And this has been this episode of Detection Dispatch.
00:44:29.920 --> 00:44:30.880
Keep building, keep sharing.
00:44:30.960 --> 00:44:32.480
I'll catch you all in the next one.
