BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//sched.securitybsides.org.uk//bsides-london-2023//speaker
 //VAB8KP
BEGIN:VTIMEZONE
TZID:GMT
BEGIN:STANDARD
DTSTART:20001029T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:GMT
TZOFFSETFROM:+0100
TZOFFSETTO:+0000
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T020000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:BST
TZOFFSETFROM:+0000
TZOFFSETTO:+0100
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-bsides-london-2023-79LHJB@sched.securitybsides.org.uk
DTSTART;TZID=GMT:20231209T154500
DTEND;TZID=GMT:20231209T163000
DESCRIPTION:Help! We’ve bought the latest tools\, we’ve got all our log
 s in a SIEM\, we’ve  tuned and tweaked our detection rules\, we’ve eve
 n built investigation playbooks… but we still don’t have enough time t
 o investigate all of these alerts!\n\nWith modern blue teams investigating
  more alerts from a wider variety of data sources than ever before\, a com
 mon reason for being overwhelmed is that it just takes too long per alert 
 for an analyst to perform a meaningful investigation. This inevitably lead
 s to alert fatigue\, lower quality investigations\, missed true positives 
 and to a detection and response service that can’t scale. So\, how do we
  combat this problem? \n\nIn this talk I’ll be discussing a recent case-
 study of ideas and tools that were implemented in a global detection and r
 esponse team to:\n\n- Empower analysts to quickly identify important conte
 xtual information during investigations\n- Establish shared investigative 
 baselines between different levels of analyst experience\n- Automate commo
 n tasks to allow analysts to perform meaningful investigations\n\nIf you
 ’re looking for actionable takeaways that you can build into your blue t
 eam’s tooling and processes to help scale your operations\, then this is
  the talk for you!
DTSTAMP:20260714T123349Z
LOCATION:Track 2
SUMMARY:Scaling Detection and Response Teams - Enabling Efficient Investiga
 tions - James Dorgan
URL:https://sched.securitybsides.org.uk/bsides-london-2023/talk/79LHJB/
END:VEVENT
END:VCALENDAR