4 ms·
Detections as Code
- k__ 6y agoSeems like a Python only tool. AWS CodeGuru is Java only, AFAIK. Anyone knows good JavaScript/TypeScript tools?
- jacknagz 6y agoPanther uses Python for real-time log analysis and SQL for analytics over the stored/normalized data.
- kyrrewk 6y agopanther looks very interesting i'm trying to evaluate solutions in this space and these are the ones i am aware of: chronicle security, panther and grapl otherwise i have seen teams build their custom platform using databricks (apple did this), snowflake, or some other cloud-native data warehouse/lake any others around?
- jacknagz 6y agoFYI Panther can also integrate to Snowflake as the data backend
- StefanKarpinski 6y agoFails the "what is it?" test. I don't really care to dig around. Anyone want to enlighten me and all the others who read this who have no idea: what is a detection?
- kyrrewk 6y agoa detection is typically a rule that describes known bad or suspicious behaviour. all simple rule would just be a list of malware hashes or domain names so instead of writing rules using tools such as YARA: https://github.com/fireeye/sunburst_countermeasures/blob/main/all-yara.yar https://github.com/fireeye/sunburst_countermeasures/blob/mai... (sunburst) they want to write them in python
- kartikeypan 6y agoSorry about that. We've now added a new section in the blog explaining more about Detections. Thanks!