We've been big fans of the Thinkst platform for a while now. We may have mentioned them a time or two :) Like many others, we get a lot of mileage out of their Canaries and Canary Tokens.
Some of you may remember our last event, Camp COVID. That was the biggest event we had ever run.
UNTIL LAST WEEK: DEF CON 28
Let me first say, on behalf of the Recon team, we cannot thank the community enough for joining us last week.
If you couldn't tell by now, we love Graylog. We may have mentioned them a time or two :)
TL;DR - we needed to ingest multiple sources of Cylance logs into Graylog, and this is how we did it.
I tweeted this the other day, and had a lot of folks reach out asking for more details/a diagram of this setup.
After DEF CON last year, we posted this blog about our infrastructure, which was spread between a handful of Intel NUCs, and AWS. It was epic. It was shiny and new. We loved it.
Part of our job at Recon relies on fine tuning our threat signatures that make up the bulk of our pipeline rules in our Graylog environment.