Скачать или смотреть Using AI to reduce toil in detection writing | Dylan Williams | MSSN CTRL 2024

What is detection engineering? It is the meticulous and complex task of going from an idea to a finished detection or analytic. Currently, this process demands a high degree of specialized knowledge across many areas of expertise and remains extremely manual. You need to be a cybersecurity tradecraft expert, a security log expert, and proficient in multiple tools and query languages. This talk explores how we can leverage Generative AI and Large Language Models (LLMs) to remove all the toil from this process.

We'll begin by illustrating the traditional detection development process, highlighting the challenges and pain points cybersecurity professionals face. Next, we'll delve into how we can use LLMs to streamline this process. By using LLMs, we aim to transform threat intelligence reports, cybersecurity blogs, bespoke TTPs, and open-source detection content into fully crafted detections, reducing the manual effort involved.

The presentation will bring practical tips and techniques for optimizing LLMs to the world of detection writing and we'll cover the importance of core principals like prompt engineering, few-shot learning, chain of thought instructions, prompt structuring, and guarding against model hallucination.

Attendees will gain insights into the effectiveness of this approach through real-world examples and results from experimentation. We will showcase the potential of AI to not only automate but also improve the quality of detection engineering, enabling cybersecurity professionals to focus on higher-value tasks like coming up with better and more innovative signals for our security operations teams.

Learn more about MSSN CTRL: https://www.mssnctrl.org/