Detecting and hunting evasive threats requires both fuzziness and precision. That's why SIEMs have not lived up to threat hunters' expectations, and why lean-forward teams adopt security data lakes and data science tools like python and Jupyter notebooks. But times move on, technology advances and the status quo of today becomes the legacy of tomorrow. Over the years, I've published a series of articles intended to demystify data science for security practitioners. I've written about graph analysis for visualizing cyber-attacks (https://lnkd.in/dn7BBFj), and more generally about AI in SecOps (https://lnkd.in/e6junCs5). The most powerful tool in a cyber defender's toolbox is knowledge, as you cannot use something you do not understand. That's why I am very excited about a series of articles for security folks I am writing with Auguria, Inc. in which together we will delve into the workings of vector databases and explain why we believe the next generation of SIEM-like solutions will be natively vector-based. 👉 https://lnkd.in/ekFKkGTt Stay tuned for Part II, where you can see how terrible I am at drawing. #aiincybersecurity #securityanalytics #siem #secops
Thank you for this. Very important subject.
What changes (for the better) with vector embeddings 🚫 Strict data normalization requirements 🕰️ massively inefficient searches ⬇️ time-to-value for threat research BUT! 🧮 I dare say we will still be tallying up things for many use cases, even if it’s just counts from the index in the vector db :)
oh man this is too much lmao
Looking forward for the series
Red team? :-)
Very good analogy!
Great to dive into this new area
SIEM is fine for this purpose
Never a dull meme moment on Oliver’s page
Staff Threat Intel Analyst, Adversary Tactics
4mo"Detecting and hunting evasive threats requires both fuzziness and precision. That's why SIEMs have not lived up to threat hunters' expectations,..." I'm sorry, but I'm probably missing the connection between those two statements. Why, exactly, have SIEMs not lived up to hunter's expectations?