How rare is a rare HTTP agent? Context-rich alerts because of math – Opstune.com

There are known knowns. There are things we know we know. We also know there are known unknowns. That is to say, we know there are some things we do not know. But there are also unknown unknowns, the ones we don’t know we don’t know. While some vendors claim they can spot the super badness “Unknowns Unknowns” using AI and Deep (really deep) Learning, I here present to you a simple way to spot “Known Unknowns” just to start your journey, hope you enjoy! Despite being an atomic indicator, the mechanisms for inspecting the HTTP user agent are still a challenge in large scale environments. With the amount of data pouring into the SIEM from web proxies and internet facing web servers, detection engineers need to use creativity to win. Not surprisingly, Splunk does provide commands such as rare and top, which allow users to organize results based on least or most frequent values. But is it as easy as counting the number of occurrences of an agent string and firing an alarm? Unless you want S

Known unknowns? This time I start with another cyber cliché : There are known knowns. There are things we know we know. We also know there are known unknowns. That is to say, we know there are some things we do not know. But there are also unknown unknowns, the ones we don’t know we don’t know. Secretary of Defense Donald Rumsfeld, 2002 While some vendors claim they can spot the super badness “Unknowns Unknowns” using AI and Deep (really deep) Learning, I here present to you a simple way to spot “Known Unknowns” just to start your journey, hope you enjoy! De

related reading

• Unsupervised Machine Learning with Splunk: the cluster command | by Alex Teixeira | Detect FYIdetect.fyi
• Vulnerability Research Is Cooked - Quarrelsomesockpuppet.org
• Mediumdetect.fyi
• Risk-Based Alerting: The New Frontier for SIEM | Splunksplunk.com
• The Hugging Face attack surprised meplanned-obsolescence.org
• Mediumdetect.fyi
• Use customizable anomalies to detect threats in Microsoft Sentinel | Microsoft Learnlearn.microsoft.com
• Elevating Security Intelligence with Splunk UBA's Machine Learning Models | Splunksplunk.com
• Model-Assisted Threat Hunting (M-ATH) with the PEAK Framework | Splunksplunk.com
• Mediumdetect.fyi
• Anomalies detected by the Microsoft Sentinel machine learning engine | Microsoft Learnlearn.microsoft.com
• You Can Catch Sleeper Agents by Teaching Another Model to Imitate Them — LessWronglesswrong.com