Creating Effective Sigma Rules with AI

Creating Effective Sigma Rules with AI

Can Threat Detection be enhanced with AI? Ashish sat down with Dave Johnson, Senior Threat Intelligence Advisor at Feedly, at BSides SF 2024, where Dave also presented a talk.

Dave shares his journey in cyber threat intelligence, including his 15-year career with the FBI and his transition to the private sector. The conversation focuses on the innovative use of large language models (LLMs) to create Sigma rules for threat detection and the challenges faced along the way. Dave spoke about his four approaches to creating Sigma rules with AI, ultimately highlighting the benefits of prompt chaining and Retrieval Augmented Generation (RAG) systems.


Guest Socials: ⁠Dave's Linkedin

Podcast Twitter - ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@CloudSecPod⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security Podcast- Youtube⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security Newsletter ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security BootCamp


Questions asked:

(00:00) Introduction

(01:44) A word for our episode sponsor, Panoptica

(02:39) A bit about Dave Johnson

(03:33) What are Sigma Rules?

(04:36) Where to get started with Sigma Rules?

(05:27) Skills required to work with Sigma Rules

(06:32) The four approaches Dave took to Sigma Rules

(11:29) Are Sigma Rules complimentary to existing log systems?

(12:18) Challenges Dave had during his research

(14:09) Validating Sigma Rules

(16:01) Working on Sigma Rule Projects

(18:54) The Fun Section


Resources spoken about during the episode:

Dave's Website

SigmaHQ GitHub

Jaksot(345)

Cloud Security Careers: Threat Analyst Skills

Cloud Security Careers: Threat Analyst Skills

In this episode of the Virtual Coffee with Ashish edition, we spoke with Abisola Dayspring Johnson aka Day (@CyberwoxAcademy) is a Threat Analyst at Optiv (@Optiv) and the Founder of Cyberwox Academy ...

24 Syys 202141min

Vulnerabilities in AWS, GCP and Azure - Cloud Security News

Vulnerabilities in AWS, GCP and Azure - Cloud Security News

Cloud Security News this week - 22 September 2021 AWS, Google Cloud and Azure have all been busy last few weeks fixing and patching Vulnerabilities. In addition to Azure's OMIGOD flaws which we cove...

22 Syys 20212min

Cloud Security Careers: From University to Security Engineer at Atlassian

Cloud Security Careers: From University to Security Engineer at Atlassian

In this episode of the Virtual Coffee with Ashish edition, we spoke with Kaif Ahsan (@KaifAhsan1) is a Security Engineer at Atlassian (@Atlassian). Episode ShowNotes, Links and Transcript on Cloud Sec...

19 Syys 202146min

Cloud Security Careers: Getting an Entry Level GRC Role

Cloud Security Careers: Getting an Entry Level GRC Role

In this episode of the Virtual Coffee with Ashish edition, we spoke with Gerald Auger (@Linkedin- Gerald Auger) is a CyberSecurity PhD holder, Content Creator at Simply Cyber(@SimplyCyber) and a Cyber...

15 Syys 202145min

fwd:cloudsec conference this week, Vulnerabilities discovered in AWS  - Cloud Security News

fwd:cloudsec conference this week, Vulnerabilities discovered in AWS - Cloud Security News

Cloud Security News this week - 15 September 2021 Oracle Chief Technology Officer and co-founder Larry Ellison told their investors this week that Oracle Cloud is superior to AWS when it comes to s...

15 Syys 20213min

Cloud Security Careers: From Executive Assistant to Head of Security

Cloud Security Careers: From Executive Assistant to Head of Security

In this episode of the Virtual Coffee with Ashish edition, we spoke with Lisa Hall (@Lisa_H_), the Head of Security, PagerDuty(@PagerDuty). Episode ShowNotes, Links and Transcript on Cloud Security Po...

12 Syys 202144min

IBM Launches Servers for Hybrid Cloud, Microsoft and Verizon bring 5G Edge Cloud Computing - Cloud Security News

IBM Launches Servers for Hybrid Cloud, Microsoft and Verizon bring 5G Edge Cloud Computing - Cloud Security News

Cloud Security News this week - 8 September 2021 Verizon, a multinational telecommunications giant and Microsoft have teamed up to bring on-prem, private 5G edge cloud computing to business. Their o...

8 Syys 20212min

Cloud Security Careers: Skills Required for an Associate Cloud Security Engineer

Cloud Security Careers: Skills Required for an Associate Cloud Security Engineer

In this episode of the Virtual Coffee with Ashish edition, we spoke with Zinet Kemal (Linkedin - Zinet-Kemal) is an Associate Cloud Security Engineer at Best Buy (@BestBuy) Episode ShowNotes, Links an...

5 Syys 202146min