Creating Effective Sigma Rules with AI
Cloud Security Podcast25 Kesä 2024

Creating Effective Sigma Rules with AI

Can Threat Detection be enhanced with AI? Ashish sat down with Dave Johnson, Senior Threat Intelligence Advisor at Feedly, at BSides SF 2024, where Dave also presented a talk.

Dave shares his journey in cyber threat intelligence, including his 15-year career with the FBI and his transition to the private sector. The conversation focuses on the innovative use of large language models (LLMs) to create Sigma rules for threat detection and the challenges faced along the way. Dave spoke about his four approaches to creating Sigma rules with AI, ultimately highlighting the benefits of prompt chaining and Retrieval Augmented Generation (RAG) systems.


Guest Socials:⁠ ⁠Dave's Linkedin

Podcast Twitter - ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@CloudSecPod⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security Podcast- Youtube⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security Newsletter ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security BootCamp


Questions asked:

(00:00) Introduction

(01:44) A word for our episode sponsor, Panoptica

(02:39) A bit about Dave Johnson

(03:33) What are Sigma Rules?

(04:36) Where to get started with Sigma Rules?

(05:27) Skills required to work with Sigma Rules

(06:32) The four approaches Dave took to Sigma Rules

(11:29) Are Sigma Rules complimentary to existing log systems?

(12:18) Challenges Dave had during his research

(14:09) Validating Sigma Rules

(16:01) Working on Sigma Rule Projects

(18:54) The Fun Section


Resources spoken about during the episode:

Dave's Website

SigmaHQ GitHub

Jaksot(345)

WHAT IS CYBER RESILIENCY IN CLOUD?

WHAT IS CYBER RESILIENCY IN CLOUD?

In this episode of the Virtual Coffee with Ashish edition, we spoke with Chris Hughes (Linkedin - Chris Hughes) & Dr. Nikki Robinson (Linkedin @dr-nikki-robinson) are the host of Resilient Cyber Podca...

25 Heinä 202138min

AWS Security - Managing Threat Detection and Response

AWS Security - Managing Threat Detection and Response

In this episode of the Virtual Coffee with Ashish edition, we spoke with Ely Khan (@elykahn) is the Principal Product Manager at AWS (@AWS). Episode ShowNotes, Links and Transcript on Cloud Security P...

21 Heinä 202146min

Cloud Security RoadMap - Scott Piper

Cloud Security RoadMap - Scott Piper

In this episode of the Virtual Coffee with Ashish edition, we spoke with Scott Piper (@0xdabbad00) is a AWS Security Legend who has written AWS Security tools for the community and among other things ...

18 Heinä 20211h 4min

Comparing Cloud Security Tools - CWPP, CSPM, CASB & CNAPP

Comparing Cloud Security Tools - CWPP, CSPM, CASB & CNAPP

In this episode of the Virtual Coffee with Ashish edition, we spoke with Patrick Pushor (@CloudChronicle) is the Technical Evangelist at Orca Security (@OrcaSec). Episode ShowNotes, Links and Transcri...

11 Heinä 202149min

Cloud Infrastructure Security at Scale - Netflix

Cloud Infrastructure Security at Scale - Netflix

In this episode of the Virtual Coffee with Ashish edition, we spoke with Srinath Kuruvadi (@Srinath Kuruvadi) is the Head of Cloud Infrastructure Security at Netflix (@Netflix). Episode ShowNotes, Lin...

4 Heinä 202149min

Hacker Valley Studio - ExIST Framework to reach Peak Performance in CyberSecurity

Hacker Valley Studio - ExIST Framework to reach Peak Performance in CyberSecurity

In this episode of the Virtual Coffee with Ashish edition, we spoke with Chris Cochran (@chriscochrcyber) and Ronald Eddings (@ronaldeddings) are the host of a CyberSecurity Podcast called Hacker Vall...

27 Kesä 202137min

Finding Security Bugs in Google Cloud - Kat Traxler

Finding Security Bugs in Google Cloud - Kat Traxler

In this episode of the Virtual Coffee with Ashish edition, we spoke with Kat Traxler (@nightmarejs) is the Cloud Security Engineering Lead, Best Buy(@BestBuy). Episode ShowNotes, Links and Transcript ...

20 Kesä 202137min

Hacker stories from the Internet - Darknet Diaries

Hacker stories from the Internet - Darknet Diaries

In this episode of the Virtual Coffee with Ashish edition, we spoke with Jack Rhysider (@jackrhysider) is the host of Award Winning CyberSecurity Podcast Darknet Diaries (@DarknetDiaries). Episode Sho...

13 Kesä 202157min