Session
Schrödinger's Detection: Finding the "Zombie" Rules in Your SIEM
Presented sigma-lens, a detection rule analyzer I built, and the results of auditing 2,000+ SigmaHQ and Elastic cloud detection rules: 1 in 3 contained significant quality defects, including rules referencing log fields that do not exist.
Gowthamaraj Rajendran
Detection & Response Engineer @ Meta | DEF CON & fwd:cloudsec Speaker | OSCE3 | 200+ Research Citations
San Francisco, California, United States
Links
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top