EP241 From Black Box to Building Blocks: More Modern Detection Engineering Lessons from Google

Guest:

• Rick Correa,Uber TL Google SecOps, Google Cloud

Topics:

• On the 3rd anniversary of Curated Detections, you've grown from 70 rules to over 4700. Can you walk us through that journey? What were some of the key inflection points and what have been the biggest lessons learned in scaling a detection portfolio so massively?
• Historically the SecOps Curated Detection content was opaque, which led to, understandably, a bit of customer friction. We’ve recently made nearly all of that content transparent and editable by users. What were the challenges in that transition?
• You make a distinction between "Detection-as-Code" and a more mature "Software Engineering" paradigm. What gets better for a security team when they move beyond just version control and a CI/CD pipeline and start incorporating things like unit testing, readability reviews, and performance testing for their detections?
• The idea of a "Goldilocks Zone" for detections is intriguing – not too many, not too few. How do you find that balance, and what are the metrics that matter when measuring the effectiveness of a detection program? You mentioned customer feedback is important, but a confusion matrix isn't possible, why is that?
• You talk about enabling customers to use your "building blocks" to create their own detections. Can you give us a practical example of how a customer might use a building block for something like detecting VPN and Tor traffic to augment their security?
• You have started using LLMs for reviewing the explainability of human-generated metadata. Can you expand on that? What have you found are the ripe areas for AI in detection engineering, and can you share any anecdotes of where AI has succeeded and where it has failed?

   Resources

• EP197 SIEM (Decoupled or Not), and Security Data Lakes: A Google SecOps Perspective
• EP231 Beyond the Buzzword: Practical Detection as Code in the Enterprise
• EP181 Detection Engineering Deep Dive: From Career Paths to Scaling SOC Teams
• EP139 What is Chronicle? Beyond XDR and into the Next Generation of Security Operations
• EP123 The Good, the Bad, and the Epic of Threat Detection at Scale with Panther
• “Back to Cooking: Detection Engineer vs Detection Consumer, Again?” blog
• “On Trust and Transparency in Detection” blog
• “Detection Engineering Weekly” newsletter
• “Practical Threat Detection Engineering” book