Chronicle White Paper

N/A

WHITEPAPER YARA-L: A New Detection Language for Modern Threats SUMMARY Most enterprises use a SIEM to analyze security data, to detect threats and investigate incidents. However, most leading SIEM products were created more than a decade ago, and were designed for a different world. Today, the threat landscape and IT environment looks quite different: Data generated in petabytes, not terabytes; a mature public cloud infrastructure; new technologies such as EDR that generate useful but massive amounts of telemetry; and threats such as fileless malware that are either ephemeral or silent…

related reading

• Tuning YARA-L Rules in Chronicle SIEM | by Chris Martin (@thatsiemguy) | Mediummedium.com
• What is Detection Engineering and Why do I Need it?cyberseccafe.com
• The dotted lines between Threat Hunting and Detection Engineering | by Alex Teixeira | Detect FYIdetect.fyi
• A guide to threat hunting and monitoring in Snowflake | Datadog Security Labssecuritylabs.datadoghq.com
• Create custom detection rules in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learnlearn.microsoft.com
• Cloud coverage: Detecting an email payroll diversion attackredcanary.com
• What Is Cyber Threat Hunting? Complete Guide | Exabeamexabeam.com
• Best practices for creating custom detection rules with Datadog Cloud SIEM | Datadogdatadoghq.com
• Is the SIEM dead? - CPO Magazinecpomagazine.com
• The Evolution of the Modern Security Data Platformsoftwareanalyst.substack.com
• Protect your organization as SIEM vendor, technology and threat landscape changeslinkedin.com
• Automated Incident Response: Streamlining Your SecOps | Prophet Securityprophet.security