3 ms·
The article is very light on product details. Reading between the lines, it sounds like the tool plugs into a bunch of existing tools (firewall, AV, etc) and th
by tschwimmer 8y ago
The article is very light on product details. Reading between the lines, it sounds like the tool plugs into a bunch of existing tools (firewall, AV, etc) and then watches for certain heuristic patterns.
A clever approach, but I wonder how noisy it will be at the start.
- mr_overalls 8y ago> I wonder how noisy it will be at the start. I don't expect that Google will find it difficult to procure some large training sets. The article's author seem to think that Google is likely to be leveraging the VirusTotal malware repositories.
- txcwpalpha 8y agoThat's exactly what existing SIEM tools like Splunk [1] have been doing for years. I've been following Chronicle since I heard about their initial project at X and I'm eager to see what their actual product is, but I'll be pretty disappointed if it's just yet another SIEM with yet another "powered by machine learning™" label slapped on. 1: https://www.splunk.com/en_us/cyber-security/advanced-persistent-threat.html https://www.splunk.com/en_us/cyber-security/advanced-persist...
- NoPicklez 8y agoThat's the problem that most SIEM implementation have. Splunk have been doing behavioral anomaly detection for a while, but its still up to the employee/business to determine what the baseline is.