Anand Kumar

Prerequisites for This Session:

• To get the most out of this session, it is helpful to have a basic understanding of how a Security Operations Center (SOC) operates, along with the role of an L1 analyst in alert triage and incident handling. Familiarity with detection engineering concepts, especially how detection rules are developed and tested, will provide better context. Additionally, knowledge of how custom detection rules are written using SPL, KQL, or Sigma, and how they function within a SIEM platform, will make it easier to follow. A general understanding of how enterprises detect and respond to security threats will further enhance your learning experience.

Key Capabilities:

• The platform offers comprehensive capabilities to streamline detection engineering. It includes a large-scale repository of detection logic covering Windows, Linux, network, and cloud environments, along with platforms like CyberArk, Okta, Docker, and OpenStack. It integrates leading adversary simulation tools such as Splunk Attack Range (SAR), GOAD, Atomic Red Team, PurpleSharp, Stratus, and CALDERA to enable realistic attack simulations. On the detection side, it connects with Splunk Enterprise Security and Microsoft Defender for Endpoint (MDE) for real-time validation. The platform also features built-in testing infrastructure, eliminating manual setup, and supports reporting and knowledge management through tools like GitHub, Obsidian, and GitLab. Designed for flexibility, it supports both on-premise and cloud deployments with template-based setups for quick and efficient implementation.