✳flâneur — a map of the web's best reading

The role of ‘Novelty’ and ‘Behaviour’ in Computer Forensics & Detection Engineering | by Alex Teixeira | Detect FYI

detect.fyi · 702 words · saved by 1 readers

This is just another quick blog that could not fit in a tweet which is hopefully inspiring for for all Detection Engineering teams out there. First off, let's get the definitions loud and clear: Novelty: the quality of being new, original, or unusual. Behaviour: the way in which one acts or conducts oneself. Those are perhaps the main traits we should consider when designing or engineering a detection system. I used to say Forensics happens after the fact while Detection should happen right after the fact and both are really challenging! Let alone Prevention which should happen before the fact! But that's a story for another post… Just like in Forensics, the Locard’s principle applies here: Every contact leaves a trace. Attackers will both bring something with them and will leave with something from the system. Our challenge is to find out which artifacts tie to that principle. That brings us to the next point. The answer is pretty simple. The same as in Computer Forensics: the crime s

The role of ‘Novelty’ and ‘Behaviour’ in Computer Forensics & Detection Engineering Alex Teixeira 3 min read · Aug 10, 2021 -- Listen Share This is just another quick blog that could not fit in a tweet which is hopefully inspiring for for all Detection Engineering teams out there. First off, let's get the definitions loud and clear: Novelty: the quality of being new, original, or unusual. Behaviour: the way in which one acts or conducts oneself. Those are perhaps the main traits we should consider when designing or engineering a detection system. One action, multiple traces I used to say Foren

Explore this link on the map →

related reading