Tips & Tricks To Reducing TTR
•
0 likes•988 views
Resolving an incident can be a complex process that takes a lot of time and many people. According to the 2014 State of On-call Report, most teams report that it take 10-30 minutes to resolve an incident on average, 5 people are needed to help with resolution. But it doesn't have to be that way. Jason Hand presents best practices and tips for surviving every stage of the firefight - from when an alert comes in to pulling reports after its over.
Report
Share
Report
Share
Download to read offline
Recommended
Managing Indicator Deprecation in ThreatConnect
The document discusses managing indicator deprecation in ThreatConnect. It explains that indicator deprecation is a system for automatically lowering an indicator's confidence rating over time based on configurable rules. This helps reflect an indicator's staleness and can automatically delete old indicators. The document provides examples of setting deprecation rules for different indicator types and sources, and best practices used by ThreatConnect's research team.
Episode IV: A New Scope
This presentation will lay out the latest improvements and features in the platform while highlighting the ways that you and your team will be able to benefit from them.
You'll learn:
- How to make analysts' lives easier
- How to unite and empower your threat intel team
- Evaluating the return on investment in threat intelligence
- New ways to visualize threat intel
- The value of using one platform for everything
Advanced Threat Hunting - Botconf 2017
The document discusses advanced threat hunting techniques. It covers defining threat intelligence and the intelligence process. It discusses the challenges of small teams with limited resources and time. It provides examples of doing threat hunting wrong and right, such as using revision control and deployment scripts. It also discusses prioritization techniques, automation, and key performance indicators. The presentation provides examples of sources of samples and success stories. Key lessons are to organize signatures, automate systems, separate queues by type, hold prioritization meetings, and contribute to open source.
SOC2016 - The Investigation Labyrinth
The document summarizes a presentation by Chris Sanders on analyzing the investigation process in digital forensics and incident response. Some key points:
1. Sanders argues that the field of digital security is undergoing a "cognitive revolution" to develop more structured and repeatable investigation methods.
2. He proposes using a scenario-based approach and investigation simulator to study how analysts navigate cases and make decisions. This could help identify ways to increase accuracy and speed.
3. Case studies analyzing novice and expert analysts found that novices rely more on intuition while experts employ more reflection and metacognition when investigating cases.
Art into Science 2017 - Investigation Theory: A Cognitive Approach
This presentation was delivered at Art into Science 2017 in Austin, TX. I discuss the ongoing cognitive crisis in information security, and present original research methods and results related to the investigation process.
Risk Management Metrics That Matter
Security risk management metrics and methodology. Includes examples of good and bad security metrics using a risk-based approach.
Chicago Security Meetup 08/2016
Security Metrics are often about the performance of information security professionals - traditional ones are centered around vulnerability close rates, timelines, or criticality ratings. But how does one measure if those metrics are the rights ones? How does one measure risk reduction, or how successful your metrics program is at operationalizing that which is necessary to prevent a breach? The data we'll explore defined the 2016 Verizon DBIR Vulnerabilities section.
This talk will borrow concepts from epidemiology, repeated game theory, classical and causal probability theory in order to demonstrate some inventive metrics for evaluating vulnerability management strategies. Not all vulnerabilities are at risk of being breached. Not all people are at risk for catching the flu. By analogy, we are trying to be effective at catching the "disease" of vulnerabilities which are susceptible to breaches, and not all are. How do we determine what is truly critical? How do we determine if we are effective at remediating what is truly critical? Because the incidence of disease is unknown, the absolute risk can not be calculated. This talk will introduce some concepts from other fields for dealing with infosec uncertainty.
Attackers are human too - and currently available data allows us to make some predictions about how they'll behave. And to predict is to prevent.
Data-Driven Threat Intelligence: Metrics on Indicator Dissemination and Sharing
This document discusses metrics for measuring threat intelligence indicator dissemination and sharing. It presents analysis using the Combine and TIQ-Test tools to evaluate novelty, aging, population overlap and uniqueness of indicators in inbound and outbound intelligence feeds. Key findings include that more data does not necessarily mean better, telemetry about attacks is more useful than raw indicators, and maturity in sharing communities impacts their effectiveness.
Recommended
Managing Indicator Deprecation in ThreatConnect
The document discusses managing indicator deprecation in ThreatConnect. It explains that indicator deprecation is a system for automatically lowering an indicator's confidence rating over time based on configurable rules. This helps reflect an indicator's staleness and can automatically delete old indicators. The document provides examples of setting deprecation rules for different indicator types and sources, and best practices used by ThreatConnect's research team.
Episode IV: A New Scope
This presentation will lay out the latest improvements and features in the platform while highlighting the ways that you and your team will be able to benefit from them.
You'll learn:
- How to make analysts' lives easier
- How to unite and empower your threat intel team
- Evaluating the return on investment in threat intelligence
- New ways to visualize threat intel
- The value of using one platform for everything
Advanced Threat Hunting - Botconf 2017
The document discusses advanced threat hunting techniques. It covers defining threat intelligence and the intelligence process. It discusses the challenges of small teams with limited resources and time. It provides examples of doing threat hunting wrong and right, such as using revision control and deployment scripts. It also discusses prioritization techniques, automation, and key performance indicators. The presentation provides examples of sources of samples and success stories. Key lessons are to organize signatures, automate systems, separate queues by type, hold prioritization meetings, and contribute to open source.
SOC2016 - The Investigation Labyrinth
The document summarizes a presentation by Chris Sanders on analyzing the investigation process in digital forensics and incident response. Some key points:
1. Sanders argues that the field of digital security is undergoing a "cognitive revolution" to develop more structured and repeatable investigation methods.
2. He proposes using a scenario-based approach and investigation simulator to study how analysts navigate cases and make decisions. This could help identify ways to increase accuracy and speed.
3. Case studies analyzing novice and expert analysts found that novices rely more on intuition while experts employ more reflection and metacognition when investigating cases.
Art into Science 2017 - Investigation Theory: A Cognitive Approach
This presentation was delivered at Art into Science 2017 in Austin, TX. I discuss the ongoing cognitive crisis in information security, and present original research methods and results related to the investigation process.
Risk Management Metrics That Matter
Security risk management metrics and methodology. Includes examples of good and bad security metrics using a risk-based approach.
Chicago Security Meetup 08/2016
Security Metrics are often about the performance of information security professionals - traditional ones are centered around vulnerability close rates, timelines, or criticality ratings. But how does one measure if those metrics are the rights ones? How does one measure risk reduction, or how successful your metrics program is at operationalizing that which is necessary to prevent a breach? The data we'll explore defined the 2016 Verizon DBIR Vulnerabilities section.
This talk will borrow concepts from epidemiology, repeated game theory, classical and causal probability theory in order to demonstrate some inventive metrics for evaluating vulnerability management strategies. Not all vulnerabilities are at risk of being breached. Not all people are at risk for catching the flu. By analogy, we are trying to be effective at catching the "disease" of vulnerabilities which are susceptible to breaches, and not all are. How do we determine what is truly critical? How do we determine if we are effective at remediating what is truly critical? Because the incidence of disease is unknown, the absolute risk can not be calculated. This talk will introduce some concepts from other fields for dealing with infosec uncertainty.
Attackers are human too - and currently available data allows us to make some predictions about how they'll behave. And to predict is to prevent.
Data-Driven Threat Intelligence: Metrics on Indicator Dissemination and Sharing
This document discusses metrics for measuring threat intelligence indicator dissemination and sharing. It presents analysis using the Combine and TIQ-Test tools to evaluate novelty, aging, population overlap and uniqueness of indicators in inbound and outbound intelligence feeds. Key findings include that more data does not necessarily mean better, telemetry about attacks is more useful than raw indicators, and maturity in sharing communities impacts their effectiveness.
Predicting Exploitability
Data driven decision making can be retrospective, real-time, or predictive. We use Amazon Machine Learning to predict the probability that a vulnerability will become exploited, using only the data available when a vulnerability is released.
Threat Intelligence Baseada em Dados: Métricas de Disseminação e Compartilham...
Sessão apresentada no Mind The Sec no dia 26 de Agosto de 2015.
Esta sessão vai fazer uma exploração tecnológica bem-humorada de feeds de threat intelligence abertos e comerciais que têm sido tratados pelo mercado de segurança como a nova panacéia para resolver os desafios de monitoramento e resposta a incidentes. Mesmo que nem todo o mercado de threat intelligence possa ser reduzido a feeds de indicadores, eles têm atraído atenção suficiente do mercado para merecer uma análise científica e factual para que os tomadores de decisão possam maximizar os resultados obtidos com os dados disponíveis.
Nos últimos 18 meses, a Niddel vem coletando indicadores de threat intelligence de múltiplas fontes, visando entender o ecossistema e desenvolver métricas de eficiência e qualidade para avaliar os diferentes feeds. Serão apresentadas análises factuais e baseadas em dados do viés estatístico, sobreposição, representatividade, idade de indicadores e unicidade entre diferentes feeds. Todos os dados utilizados será publicado e o código para geração dos gráficos está disponível em projetos open source chamados Combine e TIQ-Test. Estas são as mesmas técnicas e análises por trás da contribuição da Niddel no Verizon Data Breach Incident Report (DBIR) de 2015, um dos mais respeitados relatórios de segurança da informação do mundo.
Esta apresentação também irá apresentar dados agregados de uso de comunidades de compartilhamento de threat intelligence, de forma a identificar os padrões reais de uso e as preocupações e benefícios que os gestores podem esperar deste tipo de iniciativa.
Amateur Hour: Why APTs Are The Least Of Your Worries
The document discusses why advanced persistent threats (APTs) should not be the main focus of security worries. It notes that statistics show many vulnerabilities that are exploited are older ones for which patches already exist. The document advocates focusing on remediating known vulnerabilities within 30-40 days when the risk of exploitation is highest, rather than within the typical 100-120 days companies take on average. It argues securing the basics of configuration management, patching, and continuous deployment should be automated to raise the bar for attackers and make it necessary for them to be both advanced and persistent.
RSA 2017 - Predicting Exploitability - With Predictions
Data driven decision making can be retrospective, real-time, or predictive. We use Amazon Machine Learning to predict the probability that a vulnerability will become exploited, using only the data available when a vulnerability is released.
From Threat Intelligence to Defense Cleverness: A Data Science Approach (#tid...
This session will center on a market-centric and technological exploration of commercial and open-source threat intelligence feeds that are becoming common to be offered as a way to improve the defense capabilities of organizations.
While not all Threat Intelligence can be represented as "indicator feeds", this space has enough market attention that it deserves a proper scientific, evidence-based investigation so that practitioners and decision makers can maximize the results they are able to get for the data they have available.
The presentation will consist of a data-driven analysis of a cross-section of threat intelligence feeds (both open-source and commercial) to measure their statistical bias, overlap, and representability of the unknown population of breaches worldwide. All the statistical code written and research data used (from the publicly available feeds) will be made available in the spirit of reproducible research. The tool itself will be able to be used by attendees to perform the same type of tests on their own data (called tiq-test).
Some of the important questions and answers that emerge in this presentation include:
"Are Threat Intelligence Feeds a statistical good measure of the population of 'bad stuff' happening out there? Is there even such a thing?"
"How tuned to YOUR specific threat surface are those feeds?"
"Can we actually make good use of them even if the threats they describe have no overlap with the actual incidents you have been seeing in your environment? (hint: probably not)"
We will provide an open-source tool for attendees to extract, normalize and export data from threat intelligence feeds to use in their internal projects and systems. It will be pre-configured with current publicly available network feeds and easily extensible for private or commercial feeds (called combine).
The Security Industry is Suffering from Fragmentation, What Can Your Organiza...
This presentation discusses why and how security programs are dying. The fragmentation of people, processes, and technology. How to defrag people, processes, and technology. Then what your organization can do to resolve this.
Determining the Fit and Impact of CTI Indicators on Your Monitoring Pipeline ...
Implementing an appropriate data processing pipeline to make good use of your indicators of compromise is a problem that has been successfully addressed over the last few years. Even with all the push of automation and orchestration, a fundamental question remains: WHICH data should I be ingesting in my detection pipelines? There is no lack of data available, shared or not, paid or not. But how to keep my CTI IR team from spinning their wheels on a pile of CTI mud?
This talk will discuss statistical analysis you can do with the CTI indicators you collect and your own network telemetry to define:
- FIT: How appropriate does the CTI data apply to your own traffic. CTI vendors always talk about vertical specific threats, but is that measurable and verifiable?
- IMPACT: How much was your true positive detections assisted by matches and link analysis derived from those CTI feeds
- COVERAGE: Is your current mix of CTI feeds providing "intelligence" on the current threats that you should actually be concerned with?
Those concepts will be introduced and explained with minimal math background needed, and pseudo-code (and real-code!) will be provided to assist organizations to perform those experiments on their own environment. We hope those tools will help attendees to better evaluate the quality of the CTI feeds they ingest from their open sources, paid providers and sharing communities.
DevOpsDaysRiga 2018: Antonio Pigna - Put the brAIn into your DevOps workflow
Artificial Intelligence (AI) becomes more and more an element of differentiation to manage the increasing complexity of information. What steps you should do to get your infrastructure AI ready? The presentation will focus on the opportunities of using AI to make DevOps ecosystem efficient. Presentation is going to be lead by Antonio Pigna, Automation Architect @ Accenture, based in Naples, Italy.
Beyond Matching: Applying Data Science Techniques to IOC-based Detection
This document discusses applying data science techniques to indicator of compromise (IOC)-based detection. It describes challenges with using IOCs, including quality issues and high volume. The document proposes using data enrichment and aggregation to identify relationships between IOCs and measure their "maliciousness ratio" and "rating". This provides context to better determine if an IOC represents a true compromise. The approach aims to make threat intelligence more useful at scale.
Data-Driven Threat Intelligence: Useful Methods and Measurements for Handling...
This session will consist of a technological exploration of commercial and open-source threat intelligence feeds that are commonly offered as a way to improve the capabilities of incident response teams. While not all Threat Intelligence can be represented as "indicator feeds", this space has enough market attention that it deserves a proper scientific, evidence-based investigation so that practitioners and decision makers can maximize the results they are able to get for the data they have available.
We will present a data-driven analysis of a cross-section of threat intelligence feeds (both open-source and commercial) to measure their statistical bias, overlap, and representability of the unknown population of breaches worldwide, in addition to some tidbits as indicator age and uniqueness across feeds. All the statistical code written and research data used (from the publicly available feeds) will be made available in the spirit of reproducible research. The tool itself (tiq-test) will be able to be used by attendees to perform the same type of tests on their own data.
We will also provide an additional open-source tool (combine) for attendees to extract, normalize and export data from threat intelligence feeds to use in their internal projects and systems. It will be pre-configured with a good mix of current publicly available network feeds and easily extensible for private or commercial feeds.
Sharing is Caring: Understanding and Measuring Threat Intelligence Sharing Ef...
For the last 18 months, MLSec Project and Niddel collaborated to collect threat intelligence indicator data from multiple sources in order to make sense of the ecosystem and try to find a measure of efficiency or quality in these feeds. This initiative culminated in the creation of Combine and TIQ-test, two of the open source projects from MLSec Project. These projects have been improved upon for the last year, and are able to gather and compare data from multiple Threat Intelligence sources on the Internet.
Alex Sieira and his team have gathered aggregated usage information from intelligence sharing communities in order to determine if the added interest and "push" towards sharing is really being followed by the companies and if its adoption is putting us on the right track to close these gaps. He proposes a new set of metrics on the same vein as TIQ-test to help you understand what a "healthy" threat intelligence sharing community looks like.
To better illustrate the points and metrics, Alex will be conducting part of this analysis using usage data from some high-profile threat intelligence platforms and sharing communities that have been kind enough to contribute with usage data for this research.
You have a SIEM! And now?
This document discusses improving security information and event management (SIEM) systems. It notes that while SIEMs are now common, they often focus only on detecting incidents reactively rather than proactively predicting attacks. The document recommends a more proactive approach that combines anomaly detection, threat intelligence, and asset mapping to identify early warning signs and deviations from normal behavior. This helps move beyond simply reacting to known indicators to anticipating potential threats.
Measuring the IQ of your Threat Intelligence Feeds (#tiqtest)
Follow along with the R Markdown file at http://rpubs.com/alexcpsec/tiq-test-Summer2014-2
Source code available at:
https://github.com/mlsecproject/tiq-test
https://github.com/mlsecproject/tiq-test-Summer2014
https://github.com/mlsecproject/combine
---------
Full Abstract:
Threat Intelligence feeds are now being touted as the saving grace for SIEM and log management deployments, and as a way to supercharge incident detection and even response practices. We have heard similar promises before as an industry, so it is only fair to try to investigate. Since the actual number of breaches and attacks worldwide is unknown, it is impossible to measure how good threat intelligence feeds really are, right? Enter a new scientific breakthrough developed over the last 300 years: statistics!
This presentation will consist of a data-driven analysis of a cross-section of threat intelligence feeds (both open-source and commercial) to measure their statistical bias, overlap, and representability of the unknown population of breaches worldwide. Are they a statistical good measure of the population of "bad stuff" happening out there? Is there even such a thing? How tuned to your specific threat surface are those feeds anyway? Regardless, can we actually make good use of them even if the threats they describe have no overlap with the actual incidents you have been seeing in your environment?
We will provide an open-source tool for attendees to extract, normalize and export data from threat intelligence feeds to use in their internal projects and systems. It will be pre-configured with current OSINT network feed and easily extensible for private or commercial feeds. All the statistical code written and research data used (from the open-source feeds) will be made available in the spirit of reproducible research. The tool itself will be able to be used by attendees to perform the same type of tests on their own data.
Join Alex and Kyle on a journey through the actual real-world usability of threat intelligence to find out which mix of open source and private feeds are right for your organization.
O'Reilly Security New York - Predicting Exploitability Final
Security is all about reacting. It’s time to make some predictions. Michael Roytman explains how Kenna Security used the AWS Machine Learning platform to train a binary classifier for vulnerabilities, allowing the company to predict whether or not a vulnerability will become exploitable.
Michael offers an overview of the process. Kenna enriches the data with more specific, nondefinitional-level data. 500 million live vulnerabilities and their associated close rates inform the epidemiological data, as well as “in the wild” threat data from AlienVault’s OTX and SecureWorks’s CTU, Reversing Labs, and ISC SANS. The company uses 70% of the national vulnerability database as its training dataset and generates over 20,000 predictions on the remainder of the vulnerabilities. It then measures specificity and sensitivity, positive predictive value, and false positive and false negative rates before arriving at an optimal decision cutoff for the problem.
Grace Hopper Open Source Day Findings | Thorn & Cloudera Cares
The document discusses exploring dark web data through visualization and network analysis. It poses questions about visualizing site activity, building networks of users and content, identifying the most mentioned users, relationships between prolific posters and mentioned users, spatiotemporal history of popular content, and relationships between highly mentioned users. The document is a set of prompts for dark web data analysis using Cloudera tools.
Enabling effective hunt teaming and incident response
This document provides an overview of enabling effective hunt teaming and incident response with limited resources. It defines hunt teaming as proactively assuming compromise, finding compromised hosts, determining how they were compromised through forensics, and implementing preventative and detective controls. Incident response is defined as reactively noticing an incident, stopping any active threats, and learning from the incident to implement improved controls. The document discusses how most attacks actually occur based on data from breaches, and provides examples of low-cost tools and techniques that can be used for persistence and program execution tracking, centralized logging, and data exfiltration detection.
[cb22] Keynote: Underwhelmed: Making Sense of the Overwhelming Challenge of C...
As the security industry has grown we've seen every aspect of our world become more complicated and more overwhelming. We're consistently promised solutions and technology to make our lives easier, to stop the attacker, to catch them quicker, to automate the pain away, but the reality falls flat. Frankly, it's underwhelming. Understanding where your program stands today, where you should spend time and resources, and how best to reduce risk to your organization are key aspects of any program. Join us to discuss and discover what some of the largest organizations in the world are doing to try to make sense of it all, and how they got there.
Blameless Post-mortems: Everything You Ever Wanted to Know
This document discusses the importance of conducting post-mortems, or reviews of incidents like outages, in order to learn from mistakes and improve processes. Post-mortems are meetings where stakeholders discuss what happened during an incident, what worked and what didn't, to collect information and reduce the impact of future incidents. They provide benefits like organizational learning, improved estimating and scheduling, continuous improvement, and team building. Creating an open and blame-free environment is key for effective post-mortems. Checklists and documentation of timelines, remediation plans, and conversations can help make post-mortem reviews actionable.
Filar seymour oreilly_bot_story_
This document discusses the design of an intelligent assistant named Artemis to help security analysts with their workflow. It describes conducting user research to understand pain points of different security roles. The findings showed analysts lack context for alerts and have repetitive tasks. The document outlines requirements for Artemis, including understanding natural language, providing context-driven investigations, educating users, recommending next steps, and expediting collections using workflows. It provides examples of how Artemis could assist analysts and help optimize their time by automating common tasks. In the end, the goal is to design tools that better utilize analyst resources and are easier for a diverse range of users.
Apache Storm based Real Time Analytics for Recommending Trending Topics and S...
Apache Storm based Real Time Analytics for Recommending Trending Topics and Sentiment Analysis on Cloud Compouting Environment
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
We’ll be exploring some of the more advanced capabilities of Phantom and also discussing the security framework from MITRE “ATT&CK” and it’s valued use when integrating it with Splunk Enterprise! We’ll also have two SplunkTrust members available for some general Q&A in our own ‘Meet the Experts’.
- Splunk Phantom Workbook Automation - SOAR (Security Orchestration, Automation & Response)
-- Tom Wise (Phantom Security Solutions Engineer & Trainer)
- Threat Hunting, Or: How I Learned to Stop Worrying & Love ATT&CK
-- Cian Heasley / Fraser Dumayne (Security Engineers)
- Meet the Experts with SplunkTrust
-- Harry McLaren (Senior Splunk Consultant)
-- Tom Wise (Splunk Consultant, Phantom Security Solutions Engineer & Trainer)
IBM impact-final-reviewed1
The document discusses a healthcare alliance's proposed solution to improve infection prevention and reduce costs associated with healthcare-associated infections (HAIs). It outlines the business problem of meeting regulatory requirements around HAI occurrences and costs. The proposed solution involves a software tool called SafetyAdvisor that uses real-time rule detection to identify patients at risk and help prevent outbreaks. The tool provides automated infection surveillance, control and medication management to help pharmacists and increase efficiency. It also discusses the user interface, integrating the tool with existing systems, and customer stories praising improved productivity and earlier intervention.
More Related Content
What's hot
Predicting Exploitability
Data driven decision making can be retrospective, real-time, or predictive. We use Amazon Machine Learning to predict the probability that a vulnerability will become exploited, using only the data available when a vulnerability is released.
Threat Intelligence Baseada em Dados: Métricas de Disseminação e Compartilham...
Sessão apresentada no Mind The Sec no dia 26 de Agosto de 2015.
Esta sessão vai fazer uma exploração tecnológica bem-humorada de feeds de threat intelligence abertos e comerciais que têm sido tratados pelo mercado de segurança como a nova panacéia para resolver os desafios de monitoramento e resposta a incidentes. Mesmo que nem todo o mercado de threat intelligence possa ser reduzido a feeds de indicadores, eles têm atraído atenção suficiente do mercado para merecer uma análise científica e factual para que os tomadores de decisão possam maximizar os resultados obtidos com os dados disponíveis.
Nos últimos 18 meses, a Niddel vem coletando indicadores de threat intelligence de múltiplas fontes, visando entender o ecossistema e desenvolver métricas de eficiência e qualidade para avaliar os diferentes feeds. Serão apresentadas análises factuais e baseadas em dados do viés estatístico, sobreposição, representatividade, idade de indicadores e unicidade entre diferentes feeds. Todos os dados utilizados será publicado e o código para geração dos gráficos está disponível em projetos open source chamados Combine e TIQ-Test. Estas são as mesmas técnicas e análises por trás da contribuição da Niddel no Verizon Data Breach Incident Report (DBIR) de 2015, um dos mais respeitados relatórios de segurança da informação do mundo.
Esta apresentação também irá apresentar dados agregados de uso de comunidades de compartilhamento de threat intelligence, de forma a identificar os padrões reais de uso e as preocupações e benefícios que os gestores podem esperar deste tipo de iniciativa.
Amateur Hour: Why APTs Are The Least Of Your Worries
The document discusses why advanced persistent threats (APTs) should not be the main focus of security worries. It notes that statistics show many vulnerabilities that are exploited are older ones for which patches already exist. The document advocates focusing on remediating known vulnerabilities within 30-40 days when the risk of exploitation is highest, rather than within the typical 100-120 days companies take on average. It argues securing the basics of configuration management, patching, and continuous deployment should be automated to raise the bar for attackers and make it necessary for them to be both advanced and persistent.
RSA 2017 - Predicting Exploitability - With Predictions
Data driven decision making can be retrospective, real-time, or predictive. We use Amazon Machine Learning to predict the probability that a vulnerability will become exploited, using only the data available when a vulnerability is released.
From Threat Intelligence to Defense Cleverness: A Data Science Approach (#tid...
This session will center on a market-centric and technological exploration of commercial and open-source threat intelligence feeds that are becoming common to be offered as a way to improve the defense capabilities of organizations.
While not all Threat Intelligence can be represented as "indicator feeds", this space has enough market attention that it deserves a proper scientific, evidence-based investigation so that practitioners and decision makers can maximize the results they are able to get for the data they have available.
The presentation will consist of a data-driven analysis of a cross-section of threat intelligence feeds (both open-source and commercial) to measure their statistical bias, overlap, and representability of the unknown population of breaches worldwide. All the statistical code written and research data used (from the publicly available feeds) will be made available in the spirit of reproducible research. The tool itself will be able to be used by attendees to perform the same type of tests on their own data (called tiq-test).
Some of the important questions and answers that emerge in this presentation include:
"Are Threat Intelligence Feeds a statistical good measure of the population of 'bad stuff' happening out there? Is there even such a thing?"
"How tuned to YOUR specific threat surface are those feeds?"
"Can we actually make good use of them even if the threats they describe have no overlap with the actual incidents you have been seeing in your environment? (hint: probably not)"
We will provide an open-source tool for attendees to extract, normalize and export data from threat intelligence feeds to use in their internal projects and systems. It will be pre-configured with current publicly available network feeds and easily extensible for private or commercial feeds (called combine).
The Security Industry is Suffering from Fragmentation, What Can Your Organiza...
This presentation discusses why and how security programs are dying. The fragmentation of people, processes, and technology. How to defrag people, processes, and technology. Then what your organization can do to resolve this.
Determining the Fit and Impact of CTI Indicators on Your Monitoring Pipeline ...
Implementing an appropriate data processing pipeline to make good use of your indicators of compromise is a problem that has been successfully addressed over the last few years. Even with all the push of automation and orchestration, a fundamental question remains: WHICH data should I be ingesting in my detection pipelines? There is no lack of data available, shared or not, paid or not. But how to keep my CTI IR team from spinning their wheels on a pile of CTI mud?
This talk will discuss statistical analysis you can do with the CTI indicators you collect and your own network telemetry to define:
- FIT: How appropriate does the CTI data apply to your own traffic. CTI vendors always talk about vertical specific threats, but is that measurable and verifiable?
- IMPACT: How much was your true positive detections assisted by matches and link analysis derived from those CTI feeds
- COVERAGE: Is your current mix of CTI feeds providing "intelligence" on the current threats that you should actually be concerned with?
Those concepts will be introduced and explained with minimal math background needed, and pseudo-code (and real-code!) will be provided to assist organizations to perform those experiments on their own environment. We hope those tools will help attendees to better evaluate the quality of the CTI feeds they ingest from their open sources, paid providers and sharing communities.
DevOpsDaysRiga 2018: Antonio Pigna - Put the brAIn into your DevOps workflow
Artificial Intelligence (AI) becomes more and more an element of differentiation to manage the increasing complexity of information. What steps you should do to get your infrastructure AI ready? The presentation will focus on the opportunities of using AI to make DevOps ecosystem efficient. Presentation is going to be lead by Antonio Pigna, Automation Architect @ Accenture, based in Naples, Italy.
Beyond Matching: Applying Data Science Techniques to IOC-based Detection
This document discusses applying data science techniques to indicator of compromise (IOC)-based detection. It describes challenges with using IOCs, including quality issues and high volume. The document proposes using data enrichment and aggregation to identify relationships between IOCs and measure their "maliciousness ratio" and "rating". This provides context to better determine if an IOC represents a true compromise. The approach aims to make threat intelligence more useful at scale.
Data-Driven Threat Intelligence: Useful Methods and Measurements for Handling...
This session will consist of a technological exploration of commercial and open-source threat intelligence feeds that are commonly offered as a way to improve the capabilities of incident response teams. While not all Threat Intelligence can be represented as "indicator feeds", this space has enough market attention that it deserves a proper scientific, evidence-based investigation so that practitioners and decision makers can maximize the results they are able to get for the data they have available.
We will present a data-driven analysis of a cross-section of threat intelligence feeds (both open-source and commercial) to measure their statistical bias, overlap, and representability of the unknown population of breaches worldwide, in addition to some tidbits as indicator age and uniqueness across feeds. All the statistical code written and research data used (from the publicly available feeds) will be made available in the spirit of reproducible research. The tool itself (tiq-test) will be able to be used by attendees to perform the same type of tests on their own data.
We will also provide an additional open-source tool (combine) for attendees to extract, normalize and export data from threat intelligence feeds to use in their internal projects and systems. It will be pre-configured with a good mix of current publicly available network feeds and easily extensible for private or commercial feeds.
Sharing is Caring: Understanding and Measuring Threat Intelligence Sharing Ef...
For the last 18 months, MLSec Project and Niddel collaborated to collect threat intelligence indicator data from multiple sources in order to make sense of the ecosystem and try to find a measure of efficiency or quality in these feeds. This initiative culminated in the creation of Combine and TIQ-test, two of the open source projects from MLSec Project. These projects have been improved upon for the last year, and are able to gather and compare data from multiple Threat Intelligence sources on the Internet.
Alex Sieira and his team have gathered aggregated usage information from intelligence sharing communities in order to determine if the added interest and "push" towards sharing is really being followed by the companies and if its adoption is putting us on the right track to close these gaps. He proposes a new set of metrics on the same vein as TIQ-test to help you understand what a "healthy" threat intelligence sharing community looks like.
To better illustrate the points and metrics, Alex will be conducting part of this analysis using usage data from some high-profile threat intelligence platforms and sharing communities that have been kind enough to contribute with usage data for this research.
You have a SIEM! And now?
This document discusses improving security information and event management (SIEM) systems. It notes that while SIEMs are now common, they often focus only on detecting incidents reactively rather than proactively predicting attacks. The document recommends a more proactive approach that combines anomaly detection, threat intelligence, and asset mapping to identify early warning signs and deviations from normal behavior. This helps move beyond simply reacting to known indicators to anticipating potential threats.
Measuring the IQ of your Threat Intelligence Feeds (#tiqtest)
Follow along with the R Markdown file at http://rpubs.com/alexcpsec/tiq-test-Summer2014-2
Source code available at:
https://github.com/mlsecproject/tiq-test
https://github.com/mlsecproject/tiq-test-Summer2014
https://github.com/mlsecproject/combine
---------
Full Abstract:
Threat Intelligence feeds are now being touted as the saving grace for SIEM and log management deployments, and as a way to supercharge incident detection and even response practices. We have heard similar promises before as an industry, so it is only fair to try to investigate. Since the actual number of breaches and attacks worldwide is unknown, it is impossible to measure how good threat intelligence feeds really are, right? Enter a new scientific breakthrough developed over the last 300 years: statistics!
This presentation will consist of a data-driven analysis of a cross-section of threat intelligence feeds (both open-source and commercial) to measure their statistical bias, overlap, and representability of the unknown population of breaches worldwide. Are they a statistical good measure of the population of "bad stuff" happening out there? Is there even such a thing? How tuned to your specific threat surface are those feeds anyway? Regardless, can we actually make good use of them even if the threats they describe have no overlap with the actual incidents you have been seeing in your environment?
We will provide an open-source tool for attendees to extract, normalize and export data from threat intelligence feeds to use in their internal projects and systems. It will be pre-configured with current OSINT network feed and easily extensible for private or commercial feeds. All the statistical code written and research data used (from the open-source feeds) will be made available in the spirit of reproducible research. The tool itself will be able to be used by attendees to perform the same type of tests on their own data.
Join Alex and Kyle on a journey through the actual real-world usability of threat intelligence to find out which mix of open source and private feeds are right for your organization.
O'Reilly Security New York - Predicting Exploitability Final
Security is all about reacting. It’s time to make some predictions. Michael Roytman explains how Kenna Security used the AWS Machine Learning platform to train a binary classifier for vulnerabilities, allowing the company to predict whether or not a vulnerability will become exploitable.
Michael offers an overview of the process. Kenna enriches the data with more specific, nondefinitional-level data. 500 million live vulnerabilities and their associated close rates inform the epidemiological data, as well as “in the wild” threat data from AlienVault’s OTX and SecureWorks’s CTU, Reversing Labs, and ISC SANS. The company uses 70% of the national vulnerability database as its training dataset and generates over 20,000 predictions on the remainder of the vulnerabilities. It then measures specificity and sensitivity, positive predictive value, and false positive and false negative rates before arriving at an optimal decision cutoff for the problem.
Grace Hopper Open Source Day Findings | Thorn & Cloudera Cares
The document discusses exploring dark web data through visualization and network analysis. It poses questions about visualizing site activity, building networks of users and content, identifying the most mentioned users, relationships between prolific posters and mentioned users, spatiotemporal history of popular content, and relationships between highly mentioned users. The document is a set of prompts for dark web data analysis using Cloudera tools.
Enabling effective hunt teaming and incident response
This document provides an overview of enabling effective hunt teaming and incident response with limited resources. It defines hunt teaming as proactively assuming compromise, finding compromised hosts, determining how they were compromised through forensics, and implementing preventative and detective controls. Incident response is defined as reactively noticing an incident, stopping any active threats, and learning from the incident to implement improved controls. The document discusses how most attacks actually occur based on data from breaches, and provides examples of low-cost tools and techniques that can be used for persistence and program execution tracking, centralized logging, and data exfiltration detection.
What's hot (16)
Threat Intelligence Baseada em Dados: Métricas de Disseminação e Compartilham...
Threat Intelligence Baseada em Dados: Métricas de Disseminação e Compartilham...
Amateur Hour: Why APTs Are The Least Of Your Worries
Amateur Hour: Why APTs Are The Least Of Your Worries
RSA 2017 - Predicting Exploitability - With Predictions
RSA 2017 - Predicting Exploitability - With Predictions
From Threat Intelligence to Defense Cleverness: A Data Science Approach (#tid...
From Threat Intelligence to Defense Cleverness: A Data Science Approach (#tid...
The Security Industry is Suffering from Fragmentation, What Can Your Organiza...
The Security Industry is Suffering from Fragmentation, What Can Your Organiza...
Determining the Fit and Impact of CTI Indicators on Your Monitoring Pipeline ...
Determining the Fit and Impact of CTI Indicators on Your Monitoring Pipeline ...
DevOpsDaysRiga 2018: Antonio Pigna - Put the brAIn into your DevOps workflow
DevOpsDaysRiga 2018: Antonio Pigna - Put the brAIn into your DevOps workflow
Beyond Matching: Applying Data Science Techniques to IOC-based Detection
Beyond Matching: Applying Data Science Techniques to IOC-based Detection
Data-Driven Threat Intelligence: Useful Methods and Measurements for Handling...
Data-Driven Threat Intelligence: Useful Methods and Measurements for Handling...
Sharing is Caring: Understanding and Measuring Threat Intelligence Sharing Ef...
Sharing is Caring: Understanding and Measuring Threat Intelligence Sharing Ef...
Measuring the IQ of your Threat Intelligence Feeds (#tiqtest)
Measuring the IQ of your Threat Intelligence Feeds (#tiqtest)
O'Reilly Security New York - Predicting Exploitability Final
O'Reilly Security New York - Predicting Exploitability Final
Grace Hopper Open Source Day Findings | Thorn & Cloudera Cares
Grace Hopper Open Source Day Findings | Thorn & Cloudera Cares
Enabling effective hunt teaming and incident response
Enabling effective hunt teaming and incident response
Similar to Tips & Tricks To Reducing TTR
[cb22] Keynote: Underwhelmed: Making Sense of the Overwhelming Challenge of C...
As the security industry has grown we've seen every aspect of our world become more complicated and more overwhelming. We're consistently promised solutions and technology to make our lives easier, to stop the attacker, to catch them quicker, to automate the pain away, but the reality falls flat. Frankly, it's underwhelming. Understanding where your program stands today, where you should spend time and resources, and how best to reduce risk to your organization are key aspects of any program. Join us to discuss and discover what some of the largest organizations in the world are doing to try to make sense of it all, and how they got there.
Blameless Post-mortems: Everything You Ever Wanted to Know
This document discusses the importance of conducting post-mortems, or reviews of incidents like outages, in order to learn from mistakes and improve processes. Post-mortems are meetings where stakeholders discuss what happened during an incident, what worked and what didn't, to collect information and reduce the impact of future incidents. They provide benefits like organizational learning, improved estimating and scheduling, continuous improvement, and team building. Creating an open and blame-free environment is key for effective post-mortems. Checklists and documentation of timelines, remediation plans, and conversations can help make post-mortem reviews actionable.
Filar seymour oreilly_bot_story_
This document discusses the design of an intelligent assistant named Artemis to help security analysts with their workflow. It describes conducting user research to understand pain points of different security roles. The findings showed analysts lack context for alerts and have repetitive tasks. The document outlines requirements for Artemis, including understanding natural language, providing context-driven investigations, educating users, recommending next steps, and expediting collections using workflows. It provides examples of how Artemis could assist analysts and help optimize their time by automating common tasks. In the end, the goal is to design tools that better utilize analyst resources and are easier for a diverse range of users.
Apache Storm based Real Time Analytics for Recommending Trending Topics and S...
Apache Storm based Real Time Analytics for Recommending Trending Topics and Sentiment Analysis on Cloud Compouting Environment
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
We’ll be exploring some of the more advanced capabilities of Phantom and also discussing the security framework from MITRE “ATT&CK” and it’s valued use when integrating it with Splunk Enterprise! We’ll also have two SplunkTrust members available for some general Q&A in our own ‘Meet the Experts’.
- Splunk Phantom Workbook Automation - SOAR (Security Orchestration, Automation & Response)
-- Tom Wise (Phantom Security Solutions Engineer & Trainer)
- Threat Hunting, Or: How I Learned to Stop Worrying & Love ATT&CK
-- Cian Heasley / Fraser Dumayne (Security Engineers)
- Meet the Experts with SplunkTrust
-- Harry McLaren (Senior Splunk Consultant)
-- Tom Wise (Splunk Consultant, Phantom Security Solutions Engineer & Trainer)
IBM impact-final-reviewed1
The document discusses a healthcare alliance's proposed solution to improve infection prevention and reduce costs associated with healthcare-associated infections (HAIs). It outlines the business problem of meeting regulatory requirements around HAI occurrences and costs. The proposed solution involves a software tool called SafetyAdvisor that uses real-time rule detection to identify patients at risk and help prevent outbreaks. The tool provides automated infection surveillance, control and medication management to help pharmacists and increase efficiency. It also discusses the user interface, integrating the tool with existing systems, and customer stories praising improved productivity and earlier intervention.
real time real talk
Businesses are inundated with options of vendors who provide analytical products. We're told in no uncertain terms that without real-time analytical capabilities we are being out- strategized, out-advertised and out-personalized with every passing second. "Real-time real talk" is a critical survey of real-time systems and their application in the areas of retail and marketing. We'll cut through the hype and get to the heart of what it means to be real-time, and explore some of the real-time systems being built today in the Nordstrom Data Lab.
Why the DoD Uses Advanced Network-traffic Analytics to Secure its Network
Advanced network-traffic analytics changed the way many of the largest agencies within the Department of Defense handle their cyber security efforts, and we've just published a whitepaper describing why and how. The paper provides important information about how an enterprise can significantly reduce damages caused by sophisticated attackers, including:[clear]
A description of the limitations of today’s security solutions and how advanced network-traffic analytics can help improve enterprise security.
Two case studies about how the Department of Defense benefits today from advanced analytics.
A high-level review of the technical architecture of an advanced network analytics solution and how it can be used to thwart attacks.
A discussion of how enterprises and their security teams will benefit from a network-traffic analytics approach to enterprise security.
Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...
Ethical Hacking Definitions: https://medium.com/@jorgeorchilles/ethical-hacking-definitions-9b9a6dad4988
Ethics isn't just permission: https://github.com/redteamethics/redteamethics
Petition to support ethical hackers: https://www.change.org/p/organizations-support-ethical-hackers
Vulnerability scanning tool used, Tenable Nessus: https://www.tenable.com/products/nessus
Exploitation framework used: https://www.metasploit.com/
Vulnerability Management is hard: https://medium.com/@jorgeorchilles/vulnerability-management-is-hard-how-do-you-prioritize-what-to-patch-1fc8e163d740
Example vulnerability discussed (CVE-2020-0796 SMBGhost/CoronaBlue):
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0796
https://nvd.nist.gov/vuln/detail/CVE-2020-0796
https://attackerkb.com/topics/2LCXe3EPAZ/cve-2020-0796---smbghost?referrer=home
Evolve from CVE to TTP with MITRE ATT&CK: https://attack.mitre.org/
Threat Intelligence with ATT&CK Navigator: https://mitre-attack.github.io/attack-navigator/enterprise/
Choosing the correct Command and Control Framework: https://www.thec2matrix.com/
Virtual machine with 8 command and controls tools: SANS Slingshot C2 Matrix Edition: https://howto.thec2matrix.com/slingshot-c2-matrix-edition
The Black Report - Hackers
The document provides an introduction and overview of the Nuix Black Report, which aims to take a unique perspective on cybersecurity threats by directly surveying hackers about their attack methodologies. It notes that typical cybersecurity reports analyze past incidents and trends, but this report seeks to understand the source of threats by asking attackers about their tactics and which defenses are most and least effective. The report found that perceptions of effective defenses often do not align with reality. It aims to illuminate which security measures actually improve protections based on hacker feedback. This perspective could provide new insights on how to best allocate security resources.
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Philippe Langlois, Verizon and Joshua Franklin, CIS
Powerful software linkedin
Most real world software development practices are reactive, focus on near term features and small sub set of quality metrics like latency and throughput. More often than not, this is suboptimal and results in Low ROI on effort and change resistant software. In this talk, I present a multi-dimensional view of system development, which will serve as a reference to categorize challenges, benefits and nuances. What, why, how and more of System Development are explained using this model. In this talk, I will present learnings, and tradeoffs where the above principles were applied in Linkedin multi-products and elsewhere. It would be useful to engineers and managers involved | interested in development of non-trivial systems
wendi_ppt
1) The document discusses using machine learning methods like Naive Bayes classification to analyze sentiment in news data from social media sources like Twitter to enhance trading strategies.
2) It provides an example of parsing Twitter data related to the SPY ETF using NLTK and Naive Bayes, achieving 79.2% accuracy on the training set and 36.3% on the test set.
3) The document also outlines some more advanced approaches to measuring sentiment like Stanford NLP and Vader sentiment and discusses ongoing research into improving news sentiment analysis methods.
Dream of the (blue) Effective Case Management System
Talk given by Robert Maxwell, Lead Incident Handler and Kelly McCracken, Director, CSIRT at Salesforce, at Techno Security, in June 2016
Effective IR Communication & Coordination using a Case Management System Description: Too often IR teams are left to managing incidents from email, personal folders, and shared drive. Salesforce's CSIRT will demonstrate how they have developed an effective case management system to increase the team's ability to effectively track, respond, manage, measure, and report on incidents from detection through the lessons learned phase of the incident response lifecycle.
Normal accidents and outpatient surgeries
The document discusses the importance of resilience and adaptability in complex systems. It quotes Sidney Dekker saying safety comes from people's ability to adapt to changes, not just avoiding errors. It then defines terms like continuous integration and resilience. It discusses how maintainability is better measured by MTTR (mean time to repair) than MTBF (mean time between failures). The rest of the document provides advice for operations engineers on building resilience through practices like automation, configuration management, monitoring, and incident response. It emphasizes the value of small, reproducible changes and collecting metrics to continuously improve.
CERT Australia Update, by Scott Brown [APNIC 38 / Network Abuse BoF]
CERT Australia Update, by Scott Brown. A presentation given at APNIC 38 during the Network Abuse BoF session.
Agil de volta as origens - 7 CSGPL
Apresentação sobre a origem do movimento ágil para o 7º Congresso Sergipano de Gerenciamento Projetos e Liderança.
What is reactive
The document discusses how being reactive is good. It argues that reactive principles like being asynchronous, non-blocking, elastic and resilient help engineers, businesses and enterprises capture opportunities. Being message-driven and responsive to events within the business and market allows systems to scale efficiently. The Lightbend Reactive Platform and tools like Akka and Play can be used to build fully reactive microservices systems that are responsive, elastic and resilient. Reactive architectures allow modernizing existing systems and responding to changes in technology, users and opportunities.
Neptune facebook autoremediation_talk
Talks by Neptune and Facebook on automated diagnosis and remediation at Scale.
https://www.meetup.com/Auto-Remediation-and-Event-Driven-Automation/
Video Retrieval for Multimedia Verification of Breaking News on Social Networks
This slideset presents an approach to automatically detecting breaking news events from social media streams, using event detection to collecting near real time relevant video documents from social networks regarding that breaking news. A visual analytics dashboard provides access to the results of the content processing pipeline, providing a rich interactive interface to explore emerging stories and select video material around those stories for verification.
Similar to Tips & Tricks To Reducing TTR (20)
[cb22] Keynote: Underwhelmed: Making Sense of the Overwhelming Challenge of C...
[cb22] Keynote: Underwhelmed: Making Sense of the Overwhelming Challenge of C...
Blameless Post-mortems: Everything You Ever Wanted to Know
Blameless Post-mortems: Everything You Ever Wanted to Know
Apache Storm based Real Time Analytics for Recommending Trending Topics and S...
Apache Storm based Real Time Analytics for Recommending Trending Topics and S...
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
Why the DoD Uses Advanced Network-traffic Analytics to Secure its Network
Why the DoD Uses Advanced Network-traffic Analytics to Secure its Network
Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...
Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
Dream of the (blue) Effective Case Management System
Dream of the (blue) Effective Case Management System
CERT Australia Update, by Scott Brown [APNIC 38 / Network Abuse BoF]
CERT Australia Update, by Scott Brown [APNIC 38 / Network Abuse BoF]
Video Retrieval for Multimedia Verification of Breaking News on Social Networks
Video Retrieval for Multimedia Verification of Breaking News on Social Networks
More from VictorOps
Failure as Success Devops Roadtrip Seattle 2016
'Failure' as 'Success': The Mindset, Methods, and Landmines
J. Paul Reed
Release Engineering Approaches
Simply ship. Every time.
http://release-approaches.com/
DevOps Roadtrip Final Speaking Deck
Jason Hand - DevOps Evangelist at VictorOps
Matt Augustine - CTO & Co-Founder at PlayFab
Courtney Kissler - VP of Retail at Starbucks
DevOps: A Practical Guide
DevOps involves development and operations engineers working together throughout the entire lifecycle of a service, from design to production support. This breaks down the traditional silos between development and operations teams. The document discusses DevOps practices like continuous integration, infrastructure as code, monitoring and metrics, and implementing processes to minimize the impact of disruptions and outages. It emphasizes adopting DevOps culture from the start and evolving practices over time in a way that makes sense for the business.
Crisis Communication Webinar
This document discusses lessons learned around crisis communication at VictorOps. It provides tips for establishing a cross-functional crisis communication process that includes agreeing on when and how often to communicate, what gets communicated, who manages the message, and where the message is shared. The goal is to control the messaging and build trust with users during times of crisis. An effective crisis communication process can help manage reputational impact and make communicating less burdensome when incidents occur.
The Importance of Minimum Viable Runbooks Webinar
The slides from our MVR webinar: what details to include, how it can help and steps to get started creating your own runbook.
DevOps Roadtrip - Denver
Move past the jargon. See how DevOps plays into incident management and resolution.
Join guest Forrester Analysts and experts from local Colorado companies for a ½ day event focused on the latest and greatest DevOps practices for those tasked with maintaining uptime.
VictorOps & Raygun: A Stunning Integration
See how our two services can make your job easier by allowing you to get alerted of errors via the Raygun / VictorOps integration.
ChatOps: The New Interface of DevOps
The document discusses the results of a study on the effects of exercise on memory and thinking abilities in older adults. The study found that regular exercise can help reduce the decline in thinking abilities that often occurs with age. Older adults who exercised regularly performed better on cognitive tests and brain scans showed they had greater activity in important areas for memory and learning compared to less active peers.
6 Steps to Creating a Minimum Viable Runbook Infographic
What to include and how to get started creating your minimum viable runbook.
Incident Lifecycle Infographic
Dealing with an outage is so much more than just getting notified that a server is down. From alerting to resolution, learn more about the incident lifecycle and how each phase contributes to MTTR.
Crisis Management & Why It's Important Infographic
For most companies, it's not if an outage happens, but when. See how much outages can cost you & why solving problems faster saves money.
Real World ChatOps
Jason Hand, DevOps Evangelist at VictorOps, and Michael Ansel, from Box, explain what ChatOps is, how it can help different teams in your organization, and where security comes into play. You'll learn tips to get started, tools needed and emerging best practices around the topic.
DevOps Culture Shift: Expanding On-Call Responsibilties
DevOps represents cultural change. Whether it’s the change of resistant engineers that don’t want to be on-call or the change of Operations teams to have more empathy towards their counterparts writing code, to the willingness of executives to embrace a culture of automation, measurement and sharing. Organizations must overcome the culture war to be able to approach the agility and productivity that organizations following a DevOps model gain. The faster they can get there, the faster these organizations can take the competitive edge away from traditional enterprises.
The Open-Source Monitoring Landscape
An overview of current projects in open source monitoring, surveying functional, time-series, and event monitoring.
Actors: Not Just for Movies Anymore
Clusters are getting bigger and bigger and machines are getting more and more powerful and yet we continue to use architectures that worked for websites built during the 90’s internet scale. Microservices vs. Monoliths glosses over a key architectural distinction in the way we build concurrency into our applications. We’ll define terms like concurrency and parallelism and learn how the key question in an architecture is message passing vs. shared mutable state. We’ll also look at concepts like Actors and CSP for creating a holistic messaging passing architecture that will let you truly scale your architecture.
An Introduction to Rearview - Time Series Based Monitoring
Jeff Simpson, senior software engineer at VictorOps, delivered this presentation at the Frontrange Alerting & Monitoring meetup...along with an awesome live demo.
Putting Devs On-Call: How to Empower Your Team
A main tenet of DevOps is bridging the gap between the Dev team and the Ops team. One way to accomplish this is to include devs in the on-call rotation. While this may sound difficult, it’s not impossible to do…as our guide demonstrates.
We profile four companies that have successfully transitioned their dev team to being on-call and their stories can provide examples for how you too can do it.
The Art & Zen of Managing Nagios with Puppet
Our Senior Director of IT, Mike Merideth, breaks down config management in the age of virtualization.
ChatOps Unplugged
Join DevOps Evangelist, Jason Hand, for a discussion on ChatOps and the movement to deploy, measure, and mitigate from a chat client.
With more and more teams implementing methods to trigger commands from within their favorite chat clients, the time it takes to perform specific and repetitive tasks has been dramatically reduced. In providing a real-time command history to others, we can share knowledge and learn from each other faster than ever before.
Post-mortem Fail
Everyone knows the importance of post-mortems but something seems to be keeping your team from actually doing them. Whether it’s a question of psychology or sociology, our guide provides six reasons why your post-mortem process might be failing. Read more to see how you can stop making these mistakes!
More from VictorOps (20)
6 Steps to Creating a Minimum Viable Runbook Infographic
6 Steps to Creating a Minimum Viable Runbook Infographic
Crisis Management & Why It's Important Infographic
Crisis Management & Why It's Important Infographic
DevOps Culture Shift: Expanding On-Call Responsibilties
DevOps Culture Shift: Expanding On-Call Responsibilties
An Introduction to Rearview - Time Series Based Monitoring
An Introduction to Rearview - Time Series Based Monitoring
Recently uploaded
Upturn India Technologies - Web development company in Nashik
Nashik's top web development company, Upturn India Technologies, crafts innovative digital solutions for your success. Partner with us and achieve your goals
WMF 2024 - Unlocking the Future of Data Powering Next-Gen AI with Vector Data...
Vector databases are transforming how we handle data, allowing us to search through text, images, and audio by converting them into vectors. Today, we'll dive into the basics of this exciting technology and discuss its potential to revolutionize our next-generation AI applications. We'll examine typical uses for these databases and the essential tools
developers need. Plus, we'll zoom in on the advanced capabilities of vector search and semantic caching in Java, showcasing these through a live demo with Redis libraries. Get ready to see how these powerful tools can change the game!
Baha Majid WCA4Z IBM Z Customer Council Boston June 2024.pdf
IBM watsonx Code Assistant for Z, our latest Generative AI-assisted mainframe application modernization solution. Mainframe (IBM Z) application modernization is a topic that every mainframe client is addressing to various degrees today, driven largely from digital transformation. With generative AI comes the opportunity to reimagine the mainframe application modernization experience. Infusing generative AI will enable speed and trust, help de-risk, and lower total costs associated with heavy-lifting application modernization initiatives. This document provides an overview of the IBM watsonx Code Assistant for Z which uses the power of generative AI to make it easier for developers to selectively modernize COBOL business services while maintaining mainframe qualities of service.
DECODING JAVA THREAD DUMPS: MASTER THE ART OF ANALYSIS
Are you ready to unlock the secrets hidden within Java thread dumps? Join us for a hands-on session where we'll delve into effective troubleshooting patterns to swiftly identify the root causes of production problems. Discover the right tools, techniques, and best practices while exploring *real-world case studies of major outages* in Fortune 500 enterprises. Engage in interactive lab exercises where you'll have the opportunity to troubleshoot thread dumps and uncover performance issues firsthand. Join us and become a master of Java thread dump analysis!
42 Ways to Generate Real Estate Leads - Sellxpert
Generate hot real estate leads with these simple strategies. 42 innovative ways to attract clients in the real estate industry.
What’s New in Odoo 17 – A Complete Roadmap
Odoo releases a new update every year. The latest version, Odoo 17, came out in October 2023. It brought many improvements to the user interface and user experience, along with new features in modules like accounting, marketing, manufacturing, websites, and more.
The Odoo 17 update has been a hot topic among startups, mid-sized businesses, large enterprises, and Odoo developers aiming to grow their businesses. Since it is now already the first quarter of 2024, you must have a clear idea of what Odoo 17 entails and what it can offer your business if you are still not aware of it.
This blog covers the features and functionalities. Explore the entire blog and get in touch with expert Odoo ERP consultants to leverage Odoo 17 and its features for your business too.
An Overview of Odoo ERP
Odoo ERP was first released as OpenERP software in February 2005. It is a suite of business applications used for ERP, CRM, eCommerce, websites, and project management. Ten years ago, the Odoo Enterprise edition was launched to help fund the Odoo Community version.
When you compare Odoo Community and Enterprise, the Enterprise edition offers exclusive features like mobile app access, Odoo Studio customisation, Odoo hosting, and unlimited functional support.
Today, Odoo is a well-known name used by companies of all sizes across various industries, including manufacturing, retail, accounting, marketing, healthcare, IT consulting, and R&D.
The latest version, Odoo 17, has been available since October 2023. Key highlights of this update include:
Enhanced user experience with improvements to the command bar, faster backend page loading, and multiple dashboard views.
Instant report generation, credit limit alerts for sales and invoices, separate OCR settings for invoice creation, and an auto-complete feature for forms in the accounting module.
Improved image handling and global attribute changes for mailing lists in email marketing.
A default auto-signature option and a refuse-to-sign option in HR modules.
Options to divide and merge manufacturing orders, track the status of manufacturing orders, and more in the MRP module.
Dark mode in Odoo 17.
Now that the Odoo 17 announcement is official, let’s look at what’s new in Odoo 17!
What is Odoo ERP 17?
Odoo 17 is the latest version of one of the world’s leading open-source enterprise ERPs. This version has come up with significant improvements explained here in this blog. Also, this new version aims to introduce features that enhance time-saving, efficiency, and productivity for users across various organisations.
Odoo 17, released at the Odoo Experience 2023, brought notable improvements to the user interface and added new functionalities with enhancements in performance, accessibility, data analysis, and management, further expanding its reach in the market.
Safelyio Toolbox Talk Softwate & App (How To Digitize Safety Meetings)
Consistent toolbox talks are critical for maintaining workplace safety, as they provide regular opportunities to address specific hazards and reinforce safe practices.
These brief, focused sessions ensure that safety is a continual conversation rather than a one-time event, which helps keep safety protocols fresh in employees' minds. Studies have shown that shorter, more frequent training sessions are more effective for retention and behavior change compared to longer, infrequent sessions.
Engaging workers regularly, toolbox talks promote a culture of safety, empower employees to voice concerns, and ultimately reduce the likelihood of accidents and injuries on site.
The traditional method of conducting safety talks with paper documents and lengthy meetings is not only time-consuming but also less effective. Manual tracking of attendance and compliance is prone to errors and inconsistencies, leading to gaps in safety communication and potential non-compliance with OSHA regulations. Switching to a digital solution like Safelyio offers significant advantages.
Safelyio automates the delivery and documentation of safety talks, ensuring consistency and accessibility. The microlearning approach breaks down complex safety protocols into manageable, bite-sized pieces, making it easier for employees to absorb and retain information.
This method minimizes disruptions to work schedules, eliminates the hassle of paperwork, and ensures that all safety communications are tracked and recorded accurately. Ultimately, using a digital platform like Safelyio enhances engagement, compliance, and overall safety performance on site. https://safelyio.com/
Kubernetes at Scale: Going Multi-Cluster with Istio
Divine Odazie and Jubril Oyetunji share tips on Going Multi-Cluster with Istio Service Mesh at DevOpsDays Houston.
Alluxio Webinar | 10x Faster Trino Queries on Your Data Platform
Alluxio Webinar
June. 18, 2024
For more Alluxio Events: https://www.alluxio.io/events/
Speaker:
- Jianjian Xie (Staff Software Engineer, Alluxio)
As Trino users increasingly rely on cloud object storage for retrieving data, speed and cloud cost have become major challenges. The separation of compute and storage creates latency challenges when querying datasets; scanning data between storage and compute tiers becomes I/O bound. On the other hand, cloud API costs related to GET/LIST operations and cross-region data transfer add up quickly.
The newly introduced Trino file system cache by Alluxio aims to overcome the above challenges. In this session, Jianjian will dive into Trino data caching strategies, the latest test results, and discuss the multi-level caching architecture. This architecture makes Trino 10x faster for data lakes of any scale, from GB to EB.
What you will learn:
- Challenges relating to the speed and costs of running Trino in the cloud
- The new Trino file system cache feature overview, including the latest development status and test results
- A multi-level cache framework for maximized speed, including Trino file system cache and Alluxio distributed cache
- Real-world cases, including a large online payment firm and a top ridesharing company
- The future roadmap of Trino file system cache and Trino-Alluxio integration
Operational ease MuleSoft and Salesforce Service Cloud Solution v1.0.pptx
Operational ease MuleSoft and Salesforce Service Cloud Solution v1.0
All you need to know about Spring Boot and GraalVM
All you need to know about Spring Boot and GraalVM 🐰
Everything You Need to Know About X-Sign: The eSign Functionality of XfilesPr...
Wondering how X-Sign gained popularity in a quick time span? This eSign functionality of XfilesPro DocuPrime has many advancements to offer for Salesforce users. Explore them now!
TMU毕业证书精仿办理
多伦多都会大学毕业证成绩单(留信网认证)【176555708微信】不能毕业办理假文凭回国找工作
【多伦多都会大学毕业证成绩单仿制】（176555708微信☀️）伪造研究生学位证书TMU毕业证文凭,多伦多都会大学文凭证书学籍信息入库,多伦多都会大学学位证书留学高校学位证书补办
【TMU毕业证【微信176555708】多伦多都会大学文凭学历】【微信176555708】【多伦多都会大学文凭学历证书】【多伦多都会大学毕业证书与成绩单样本图片】毕业证书补办 Fake Degree做学费单【毕业证明信-推荐信】成绩单，录取通知书，Offer，在读证明，雅思托福成绩单，真实大使馆教育部认证，回国人员证明，留信网认证。网上存档永久可查！
How Can Hiring A Mobile App Development Company Help Your Business Grow?
ToXSL Technologies is an award-winning Mobile App Development Company in Dubai that helps businesses reshape their digital possibilities with custom app services. As a top app development company in Dubai, we offer highly engaging iOS & Android app solutions. https://rb.gy/necdnt
Orca: Nocode Graphical Editor for Container Orchestration
Tool demo on CEDI/SISTEDES/JISBD2024 at A Coruña, Spain. 2024.06.18
"Orca: Nocode Graphical Editor for Container Orchestration"
by Pedro J. Molina PhD. from Metadev
Why Apache Kafka Clusters Are Like Galaxies (And Other Cosmic Kafka Quandarie...
Closing talk for the Performance Engineering track at Community Over Code EU (Bratislava, Slovakia, June 5 2024) https://eu.communityovercode.org/sessions/2024/why-apache-kafka-clusters-are-like-galaxies-and-other-cosmic-kafka-quandaries-explored/ Instaclustr (now part of NetApp) manages 100s of Apache Kafka clusters of many different sizes, for a variety of use cases and customers. For the last 7 years I’ve been focused outwardly on exploring Kafka application development challenges, but recently I decided to look inward and see what I could discover about the performance, scalability and resource characteristics of the Kafka clusters themselves. Using a suite of Performance Engineering techniques, I will reveal some surprising discoveries about cosmic Kafka mysteries in our data centres, related to: cluster sizes and distribution (using Zipf’s Law), horizontal vs. vertical scalability, and predicting Kafka performance using metrics, modelling and regression techniques. These insights are relevant to Kafka developers and operators.
Measures in SQL (SIGMOD 2024, Santiago, Chile)
SQL has attained widespread adoption, but Business Intelligence tools still use their own higher level languages based upon a multidimensional paradigm. Composable calculations are what is missing from SQL, and we propose a new kind of column, called a measure, that attaches a calculation to a table. Like regular tables, tables with measures are composable and closed when used in queries.
SQL-with-measures has the power, conciseness and reusability of multidimensional languages but retains SQL semantics. Measure invocations can be expanded in place to simple, clear SQL.
To define the evaluation semantics for measures, we introduce context-sensitive expressions (a way to evaluate multidimensional expressions that is consistent with existing SQL semantics), a concept called evaluation context, and several operations for setting and modifying the evaluation context.
A talk at SIGMOD, June 9–15, 2024, Santiago, Chile
Authors: Julian Hyde (Google) and John Fremlin (Google)
https://doi.org/10.1145/3626246.3653374
Enhanced Screen Flows UI/UX using SLDS with Tom Kitt
Join us for an engaging session led by Flow Champion, Tom Kitt. This session will dive into a technique of enhancing the user interfaces and user experiences within Screen Flows using the Salesforce Lightning Design System (SLDS). This technique uses Native functionality, with No Apex Code, No Custom Components and No Managed Packages required.
Liberarsi dai framework con i Web Component.pptx
In Italian
Presentazione sulle feature e l'utilizzo dei Web Component nell sviluppo di pagine e applicazioni web. Racconto delle ragioni storiche dell'avvento dei Web Component. Evidenziazione dei vantaggi e delle sfide poste, indicazione delle best practices, con particolare accento sulla possibilità di usare web component per facilitare la migrazione delle proprie applicazioni verso nuovi stack tecnologici.
The Rising Future of CPaaS in the Middle East 2024
Explore "The Rising Future of CPaaS in the Middle East in 2024" with this comprehensive PPT presentation. Discover how Communication Platforms as a Service (CPaaS) is transforming communication across various sectors in the Middle East.
Recently uploaded (20)
Upturn India Technologies - Web development company in Nashik
Upturn India Technologies - Web development company in Nashik
WMF 2024 - Unlocking the Future of Data Powering Next-Gen AI with Vector Data...
WMF 2024 - Unlocking the Future of Data Powering Next-Gen AI with Vector Data...
Baha Majid WCA4Z IBM Z Customer Council Boston June 2024.pdf
Baha Majid WCA4Z IBM Z Customer Council Boston June 2024.pdf
DECODING JAVA THREAD DUMPS: MASTER THE ART OF ANALYSIS
DECODING JAVA THREAD DUMPS: MASTER THE ART OF ANALYSIS
Safelyio Toolbox Talk Softwate & App (How To Digitize Safety Meetings)
Safelyio Toolbox Talk Softwate & App (How To Digitize Safety Meetings)
Kubernetes at Scale: Going Multi-Cluster with Istio
Kubernetes at Scale: Going Multi-Cluster with Istio
Alluxio Webinar | 10x Faster Trino Queries on Your Data Platform
Alluxio Webinar | 10x Faster Trino Queries on Your Data Platform
Operational ease MuleSoft and Salesforce Service Cloud Solution v1.0.pptx
Operational ease MuleSoft and Salesforce Service Cloud Solution v1.0.pptx
All you need to know about Spring Boot and GraalVM
All you need to know about Spring Boot and GraalVM
Everything You Need to Know About X-Sign: The eSign Functionality of XfilesPr...
Everything You Need to Know About X-Sign: The eSign Functionality of XfilesPr...
How Can Hiring A Mobile App Development Company Help Your Business Grow?
How Can Hiring A Mobile App Development Company Help Your Business Grow?
Orca: Nocode Graphical Editor for Container Orchestration
Orca: Nocode Graphical Editor for Container Orchestration
Why Apache Kafka Clusters Are Like Galaxies (And Other Cosmic Kafka Quandarie...
Why Apache Kafka Clusters Are Like Galaxies (And Other Cosmic Kafka Quandarie...
Enhanced Screen Flows UI/UX using SLDS with Tom Kitt
Enhanced Screen Flows UI/UX using SLDS with Tom Kitt
The Rising Future of CPaaS in the Middle East 2024
The Rising Future of CPaaS in the Middle East 2024
Tips & Tricks To Reducing TTR
- 1. Jason Hand – DevOps Evangelist Tips & Tricks to Reduce TTR for the Next Incident @jasonhand
- 2. Time to Resolution (TTR) • The total amount of time taken to resolve an incident • MTTR – Mean Time To Resolution* – summary over time – measurement used to describe the most "typical" value in a set of values – the lower the better *Resolve = Repair = Recover
- 5. Alerting “zero 1me” aler1ng pla6orm to find people instantly can only really effect average TTR by a very small percentage No1fy on-‐call members
- 6. Victor’s Tips “Include useful content & context in the alerts.” “Use custom no8fica8ons to dis8nguish cri8cal alerts.”
- 7. Triage Assign degrees of urgency to incidents
- 8. Victor’s Tips “Get the right alerts to the right people through rou8ng.” “Establish a single source of truth for all ac8vi8es of an incident.”
- 9. Investigation • Log in • Check the logs • Analyze metrics • Review wikis • Discuss w/ team
- 10. Victor’s Tips “Collaborate & Share.” “Connect with the right resources and team members.”
- 11. Identification“Everything will be beKer if I fix this one thing.”
- 12. Victor’s Tips “Provide quick access to accurate metrics & runbooks.”
- 13. Resolution Self-‐documen1ng what teams do to solve the problem Bidirec1onal integra1on with your favorite chat client and the VictorOps 1meline Team members performing system ac1ons to fix the problem(s)
- 14. Victor’s Tips “Be vocal & share what is taking place.”
- 15. DocumentationWrite down and talk about what we did Runbook
- 16. Victor’s Tips “Conduct (blameless) post-‐mortems.”
- 17. Tips & Tricks to Reduce TTR for the Next Incident Summary
- 18. “Conduct (blameless) post-‐mortems.” “Be vocal & share what is taking place.” “Provide quick access to accurate metrics & runbooks.” “Collaborate & Share.” “Connect with the right resources and team members.” “Get the right alerts to the right people through rou8ng.” “Establish a single source of truth for all ac8vi8es of an incident.” “Include useful content & context in the alerts.” “Use custom no8fica8ons to dis8nguish cri8cal alerts.”
- 19. Jason Hand – DevOps Evangelist Tips & Tricks to Reduce TTR for the Next Incident @jasonhand Thank You jason@victorops.com