Elastic Security Opens Public Detections Rules Repo – James Spiteri – PSW #667
Following the release of our detection engine, Elastic opened up a new GitHub repo of our public detection rules. See: https://github.com/elastic/detection-rules. This is where our security intelligence and analytics team develops rules, creates issues, manages PR's - and by making the repo public we're inviting external contributors into the workflow. This gives contributors visibility into our development process and a clear path for rules to be released with the detection engine. If time allows, James can also talk about the preview we recently released of Event Query Language (EQL) in Elasticsearch. This is the correlation query language that Elastic adopted through the acquisition of Endgame last year to support threat hunting and threat detection use cases. It's a feature that users have been asking for for years and an exciting step toward natively integrating EQL into the Stack.
This segment is sponsored by Elastic.
Visit https://securityweekly.com/elastic to learn more about them!
Sponsored By
Announcements
BSides Boston is back in action for their 10 year anniversary! The conference will be held on Saturday, September 26th & tickets are only $10! Get yours at https://bsidesbos.org! Some of the Security Weekly team will be in our own channel on the BSides Boston Discord server answering questions and possibly doing some contests!
Guest
James Spiteri is a solutions architect for Elastic, where he also serves as the company’s cybersecurity specialist for Europe, the Middle East and Africa. Prior to that he gained extensive experience as an Elasticsearch user, including at RS2 Software, as well as while serving as the security architecture manager for Invinsec. He’s also served as a Linux systems administrator at Arvato Financial Solutions, among other roles.
Hosts
