Collect All the Data; Protect All the Things

"Blue teaming has not, up until this point, received the same applause and attention that red teaming has, but the tide is changing. The realization that the charge to ""protect all the things, all the time"" requires the collection and analysis of a...

"Blue teaming has not, up until this point, received the same applause and attention that red teaming has, but the tide is changing. The realization that the charge to ""protect all the things, all the time"" requires the collection and analysis of all the data is creating the conditions to ""bring the sexy"" to the blue team. This talk covers the application of different methods to collect, analyze, and correlate multiple types of data as well as the use of machine learning to generate behavioral anomalies that are incorporated into overall continuous monitoring capabilities. This is not a vendor talk, and with very few exceptions all methods and tools discussed are open source and free; the focus is on the application of concepts. "