Notes

client presentation
he wil send ppt to me on personal email
3 yrs
MLOps
internals sponsors -> regular weekly labeling, model performance discussions
national security conference uk govt
analysts provided 137 differerent categories -> we segmeented those into malicious things and everything else
we had set of attrs we could use, we definitel needed an IP. customer-specific models.
260 billon events per day
5000 send to cusotemsr
36 posssible attributes - 100s. SIEM pipeline. cs detection -> malware ahsh, hostname, c2, username, bunch of diff fields.
5000 sec events to analysts
new data, try to build mdoel again .
44.7% autoresolve
negative -> bolted in. no real thought. other teams that were builidng rules engine.
attribute selection was per-customer
need to make this supervised - how did u do this? boolean? FPs . unsuperivsed . initially, already got a bunch of labels from analysts.
suppression/escalation rules
customer networks -> events -> rule engine
benign.
global or custom rules
mimikatz -> send to soc (escalation)
benign threshold -> p(malicious)
unwanteed program
foresee - find maliciosu things
foresee - determine if somethign is maliciosu or benign
if we assume that this is what we are opitmizng ofr (benign)
poisson samplings

tagged everything