GRAYHAT

Detecting and responding to incidents is challenging. To do so automatically is even more challenging. There are many sources of information for security events
such as endpoint security, DNS, Firewalls, Network Anomalies etc. Trying to automatically respond is typically avoided because of the risk for false positives.
But can we, by combining different sources of events, and applying a penalty point system, reduce the likelyhood of false positives enough to allow for automatic response?
This lecture will outline a prototype for Rapid Threat Containment based on input from multiple sources. It will also discuss challenges, such as how to normalise the target
of the attack (which could be hostname, IP address, MAC address, email address, username - depending on the source). It will also discuss some potential extra benefits such
as creating automatic reports on breaches based on the information.