Creating Effective Sigma Rules with AI
Cloud Security Podcast25 Kesä 2024

Creating Effective Sigma Rules with AI

Can Threat Detection be enhanced with AI? Ashish sat down with Dave Johnson, Senior Threat Intelligence Advisor at Feedly, at BSides SF 2024, where Dave also presented a talk.

Dave shares his journey in cyber threat intelligence, including his 15-year career with the FBI and his transition to the private sector. The conversation focuses on the innovative use of large language models (LLMs) to create Sigma rules for threat detection and the challenges faced along the way. Dave spoke about his four approaches to creating Sigma rules with AI, ultimately highlighting the benefits of prompt chaining and Retrieval Augmented Generation (RAG) systems.


Guest Socials:⁠ ⁠Dave's Linkedin

Podcast Twitter - ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@CloudSecPod⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security Podcast- Youtube⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security Newsletter ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security BootCamp


Questions asked:

(00:00) Introduction

(01:44) A word for our episode sponsor, Panoptica

(02:39) A bit about Dave Johnson

(03:33) What are Sigma Rules?

(04:36) Where to get started with Sigma Rules?

(05:27) Skills required to work with Sigma Rules

(06:32) The four approaches Dave took to Sigma Rules

(11:29) Are Sigma Rules complimentary to existing log systems?

(12:18) Challenges Dave had during his research

(14:09) Validating Sigma Rules

(16:01) Working on Sigma Rule Projects

(18:54) The Fun Section


Resources spoken about during the episode:

Dave's Website

SigmaHQ GitHub

Jaksot(345)

Getting Started with Chaos Engineering - What is it and how can it be used to build Application resiliency? - Aaron Rinehart, Verica

Getting Started with Chaos Engineering - What is it and how can it be used to build Application resiliency? - Aaron Rinehart, Verica

In this episode of the Virtual Coffee with Ashish edition, we spoke with Aaron Rinehart, CTO Co-Founder Verica. This is episode not to miss. Host: Ashish Rajan - Twitter @hashishrajan Guest: Aaron ...

2 Elo 20201h

Cloud Security in Operational Technology vs Information Technology world - Parul Kharub, CISSP

Cloud Security in Operational Technology vs Information Technology world - Parul Kharub, CISSP

In this episode of the Virtual Coffee with Ashish edition, we spoke with Parul Kharub, CISSP, HMM. Parul has spent number of years in the Operational Technology (OT) space building cybersecurity strat...

19 Heinä 202054min

HOW TO BECOME A SUCCESSFUL CISO IN 2020 - Abbas Kudrati, Microsoft

HOW TO BECOME A SUCCESSFUL CISO IN 2020 - Abbas Kudrati, Microsoft

In this episode of the Virtual Coffee with Ashish edition, we spoke with Abbas Kudrati, CyberSecurity Advisor for Microsoft Asia Pacific Region. Abbas has previously worked in various large companies ...

12 Heinä 20201h 3min

How to do Google Cloud Security Well - The 2020 Edition - Darpan Shah

How to do Google Cloud Security Well - The 2020 Edition - Darpan Shah

In this episode of the Virtual Coffee with Ashish edition, we spoke with Darpan Shah, Cloud Security Engineer. Darpan has 8 AWS Certificates, 6 GCP certificates and at his work, he works on both Googl...

5 Heinä 202055min

HOW TO BECOME A CLOUD SECURITY ENGINEER in 2020 | Including Top Certifications

HOW TO BECOME A CLOUD SECURITY ENGINEER in 2020 | Including Top Certifications

In this episode of the Virtual Coffee with Ashish edition, we spoke with Christopher Hughes, CISSP, Cloud Security Engineer. Host: Ashish Rajan - Twitter @hashishrajan Guest: Chris Hughes - Linked...

28 Kesä 202045min

Building an Engineering Security Culture - Failure stories included - Edwin Kwan, Tyro Payments

Building an Engineering Security Culture - Failure stories included - Edwin Kwan, Tyro Payments

In this episode of the Virtual Coffee with Ashish edition, we spoke with Edwin Kwan, Head of Application and Software Security at Tyro payments. Host: Ashish Rajan - Twitter @hashishrajan Guest: Ed...

21 Kesä 202044min

TIPS FOR WOMEN IN INFORMATION SECURITY TO GET A JOB IN CYBER SECURITY - Alannah Goh, 0xCC

TIPS FOR WOMEN IN INFORMATION SECURITY TO GET A JOB IN CYBER SECURITY - Alannah Goh, 0xCC

In this episode of the Virtual Coffee with Ashish edition, we spoke with Alannah Guo, Founder of 0xCC & Pentester. Host: Ashish Rajan - Twitter @hashishrajan Guest: Alannah Guo - Twitter @AlannahGu...

14 Kesä 202058min

Google Cloud Security - How does Google Cloud work?

Google Cloud Security - How does Google Cloud work?

In this episode sponsored by Virtual Coffee with Ashish edition, we spoke with Francesco Cipollone, Chapter Chair (UK), Cloud Security Alliance Host: Ashish Rajan - Twitter @hashishrajan Guest: Fra...

7 Kesä 202054min