Behavior Analytics in Your Security Data Lake Just Got Way Easier

I’m no data scientist, but I know machine learning can be a SOC’s best friend. In a previous role, my security engineering team had to convince our management (and ourselves) that we would get alerted if the Capital One hacker tried the same attack with us. Machine learning for behavior analytics gave us a way to detect a compromised AWS account trying to steal documents from our cloud. And now, prebuilt machine learning functions in Snowflake cut the effort involved from weeks to hours. And you don’t need to be a data scientist to use them. The hacker “erratic” behind one of the largest breaches of all time was not stealthy. She bragged about copying over 30 GB of documents out of 700 cloud storage buckets. Despite all that activity, the breach stayed undetected from March to July. When we read the breach reports, my team knew we needed detection time that would not be measured in months. Could behavior analytics help detect this kind of cloud breach? We considered how a compromised a

Behavior Analytics in Your Security Data Lake Just Got Way Easier Snowflake's new machine learning functions bring ML to SOCs without data scientists Omer Singer Mar 07, 2024 4 Share I’m no data scientist, but I know machine learning can be a SOC’s best friend. In a previous role, my security engineering team had to convince our management (and ourselves) that we would get alerted if the Capital One hacker tried the same attack with us. Machine learning for behavior analytics gave us a way to detect a compromised AWS account trying to steal documents from our cloud. And now, prebuilt machine l

related reading

• A guide to threat hunting and monitoring in Snowflake | Datadog Security Labssecuritylabs.datadoghq.com
• Security incident disclosure — July 2026huggingface.co
• Anomaly Detection in SOC – Friend or Foe? | 2019-12-27 | Security Magazinesecuritymagazine.com
• Greg Brockman on Svbtleblog.gregbrockman.com
• Security Data Lakes, Normalization and OCSF | by Jake Berkowsky | Snowflake Builders Blog: Data Engineers, App Developers, AI, & Data Science | Mediummedium.com
• Anomalies detected by the Microsoft Sentinel machine learning engine | Microsoft Learnlearn.microsoft.com
• A guide to threat hunting and monitoring in Snowflake | Datadog Security Labssecuritylabs.datadoghq.com
• Elevating Security Intelligence with Splunk UBA's Machine Learning Models | Splunksplunk.com
• Security data lakehouse and modular designrippling.com
• Tactical Guide to Threat Hunting in Snowflake Environmentsmitiga.io
• Use customizable anomalies to detect threats in Microsoft Sentinel | Microsoft Learnlearn.microsoft.com
• The Transition from Monolithic SIEMs to Data Lakes for Security Monitoringjacknaglieri.substack.com