{"version":"1.0.0","segments":[{"speaker":"Amy Ciminnisi","startTime":0.166,"endTime":2.702,"body":"Welcome to the Talos Takes podcast,"},{"speaker":"Amy Ciminnisi","startTime":2.702,"endTime":2.702,"body":" "},{"speaker":"Amy Ciminnisi","startTime":2.702,"endTime":6.139,"body":"where we discuss"},{"speaker":"Amy Ciminnisi","startTime":6.139,"endTime":2.702,"body":" "},{"speaker":"Amy Ciminnisi","startTime":2.702,"endTime":6.139,"body":"Talos' latest research and security news."},{"speaker":"Amy Ciminnisi","startTime":6.139,"endTime":6.573,"body":" "},{"speaker":"Amy Ciminnisi","startTime":6.573,"endTime":9.476,"body":"This podcast is for everyone"},{"speaker":"Amy Ciminnisi","startTime":9.476,"endTime":6.573,"body":" "},{"speaker":"Amy Ciminnisi","startTime":6.573,"endTime":9.476,"body":"from the C-suite"},{"speaker":"Amy Ciminnisi","startTime":9.476,"endTime":9.476,"body":" "},{"speaker":"Amy Ciminnisi","startTime":9.476,"endTime":12.479,"body":"to the frontlines."},{"speaker":"Amy Ciminnisi","startTime":12.479,"endTime":12.612,"body":" "},{"speaker":"Amy Ciminnisi","startTime":12.612,"endTime":12.612,"body":"\n"},{"speaker":"Amy Ciminnisi","startTime":12.612,"endTime":13.68,"body":"Hello everyone!"},{"speaker":"Amy Ciminnisi","startTime":13.68,"endTime":13.68,"body":" "},{"speaker":"Amy Ciminnisi","startTime":13.68,"endTime":16.149,"body":"I'm Amy and today on Talos Takes, we are talking about proactive cyber"},{"speaker":"Amy Ciminnisi","startTime":20.52,"endTime":16.149,"body":" "},{"speaker":"Amy Ciminnisi","startTime":16.149,"endTime":20.52,"body":"defense, specifically threat hunting."},{"speaker":"Amy Ciminnisi","startTime":20.52,"endTime":21.354,"body":" "},{"speaker":"Amy Ciminnisi","startTime":21.354,"endTime":25.225,"body":"Cyber threats are becoming"},{"speaker":"Amy Ciminnisi","startTime":25.225,"endTime":21.354,"body":" "},{"speaker":"Amy Ciminnisi","startTime":21.354,"endTime":25.225,"body":"more sophisticated every day. And networks"},{"speaker":"Amy Ciminnisi","startTime":28.628,"endTime":25.592,"body":" "},{"speaker":"Amy Ciminnisi","startTime":25.592,"endTime":28.628,"body":"and systems are becoming more complex."},{"speaker":"Amy Ciminnisi","startTime":28.628,"endTime":28.995,"body":" "},{"speaker":"Amy Ciminnisi","startTime":28.995,"endTime":33.8,"body":"So it's really more important than ever"},{"speaker":"Amy Ciminnisi","startTime":33.8,"endTime":28.995,"body":" "},{"speaker":"Amy Ciminnisi","startTime":28.995,"endTime":33.8,"body":"to identify risks before they escalate."},{"speaker":"Amy Ciminnisi","startTime":33.8,"endTime":34.334,"body":" "},{"speaker":"Amy Ciminnisi","startTime":34.334,"endTime":37.003,"body":"We're going to be talking"},{"speaker":"Amy Ciminnisi","startTime":37.003,"endTime":34.334,"body":" "},{"speaker":"Amy Ciminnisi","startTime":34.334,"endTime":37.003,"body":"about a few things today."},{"speaker":"Amy Ciminnisi","startTime":37.003,"endTime":37.003,"body":" "},{"speaker":"Amy Ciminnisi","startTime":37.003,"endTime":41.274,"body":"First, what threat hunting is why"},{"speaker":"Amy Ciminnisi","startTime":41.274,"endTime":37.003,"body":" "},{"speaker":"Amy Ciminnisi","startTime":37.003,"endTime":41.274,"body":"it matters and common mistakes"},{"speaker":"Amy Ciminnisi","startTime":41.274,"endTime":41.274,"body":" "},{"speaker":"Amy Ciminnisi","startTime":41.274,"endTime":42.542,"body":"that people make."},{"speaker":"Amy Ciminnisi","startTime":42.542,"endTime":42.542,"body":" "},{"speaker":"Amy Ciminnisi","startTime":42.542,"endTime":47.447,"body":"Next, the peak threat hunting framework,"},{"speaker":"Amy Ciminnisi","startTime":47.447,"endTime":42.542,"body":" "},{"speaker":"Amy Ciminnisi","startTime":42.542,"endTime":47.447,"body":"as well as a new open"},{"speaker":"Amy Ciminnisi","startTime":47.447,"endTime":47.447,"body":" "},{"speaker":"Amy Ciminnisi","startTime":47.447,"endTime":51.618,"body":"source tool that Cisco Foundation"},{"speaker":"Amy Ciminnisi","startTime":51.618,"endTime":47.447,"body":" "},{"speaker":"Amy Ciminnisi","startTime":47.447,"endTime":51.618,"body":"AI recently released."},{"speaker":"Amy Ciminnisi","startTime":51.618,"endTime":52.018,"body":" "},{"speaker":"Amy Ciminnisi","startTime":52.018,"endTime":54.621,"body":"And finally, how security teams"},{"speaker":"Amy Ciminnisi","startTime":54.621,"endTime":54.621,"body":" "},{"speaker":"Amy Ciminnisi","startTime":54.621,"endTime":57.624,"body":"can better structure"},{"speaker":"Amy Ciminnisi","startTime":57.624,"endTime":54.621,"body":" "},{"speaker":"Amy Ciminnisi","startTime":54.621,"endTime":57.624,"body":"their threat hunting approach."},{"speaker":"Amy Ciminnisi","startTime":57.624,"endTime":57.824,"body":" "},{"speaker":"Speaker","startTime":57.824,"endTime":57.824,"body":"\n"},{"speaker":"Speaker","startTime":57.824,"endTime":62.462,"body":"Today we have David Bianco,"},{"speaker":"Speaker","startTime":62.462,"endTime":57.824,"body":" "},{"speaker":"Speaker","startTime":57.824,"endTime":62.462,"body":"a recognized leader in threat hunting"},{"speaker":"Speaker","startTime":62.462,"endTime":62.462,"body":" "},{"speaker":"Speaker","startTime":62.462,"endTime":67.067,"body":"and also an AI Cybersecurity Researcher"},{"speaker":"Speaker","startTime":67.067,"endTime":62.462,"body":" "},{"speaker":"Speaker","startTime":62.462,"endTime":67.067,"body":"with Cisco Foundation AI."},{"speaker":"Speaker","startTime":67.067,"endTime":67.467,"body":" "},{"speaker":"Speaker","startTime":67.467,"endTime":69.769,"body":"David, thanks so much for coming on."},{"speaker":"Speaker","startTime":69.769,"endTime":69.769,"body":" "},{"speaker":"David Bianco","startTime":69.769,"endTime":72.272,"body":"Hi, Amy. Thanks for having me."},{"speaker":"Amy Ciminnisi","startTime":69.779,"endTime":72.272,"body":"Yeah."},{"speaker":"Amy Ciminnisi","startTime":72.272,"endTime":72.272,"body":" "},{"speaker":"Amy Ciminnisi","startTime":72.272,"endTime":76.509,"body":"So to get started, let's establish"},{"speaker":"Amy Ciminnisi","startTime":76.509,"endTime":72.272,"body":" "},{"speaker":"Amy Ciminnisi","startTime":72.272,"endTime":76.509,"body":"a baseline in this conversation."},{"speaker":"Amy Ciminnisi","startTime":76.509,"endTime":76.509,"body":" "},{"speaker":"Amy Ciminnisi","startTime":76.509,"endTime":79.279,"body":"When we are talking about threat hunting,"},{"speaker":"Amy Ciminnisi","startTime":79.279,"endTime":79.279,"body":" "},{"speaker":"Amy Ciminnisi","startTime":79.279,"endTime":83.783,"body":"what kind of threat hunting"},{"speaker":"Amy Ciminnisi","startTime":83.783,"endTime":79.279,"body":" "},{"speaker":"Amy Ciminnisi","startTime":79.279,"endTime":83.783,"body":"are we going to be referring to?"},{"speaker":"Amy Ciminnisi","startTime":83.783,"endTime":84.15,"body":" "},{"speaker":"David Bianco","startTime":84.15,"endTime":87.62,"body":"So a few years ago, my team"},{"speaker":"David Bianco","startTime":87.62,"endTime":87.72,"body":" "},{"speaker":"David Bianco","startTime":87.72,"endTime":91.491,"body":"and I published the Peak"},{"speaker":"David Bianco","startTime":91.491,"endTime":87.72,"body":" "},{"speaker":"David Bianco","startTime":87.72,"endTime":91.491,"body":"Threat Hunting framework, which actually,"},{"speaker":"David Bianco","startTime":91.491,"endTime":92.092,"body":" "},{"speaker":"David Bianco","startTime":92.092,"endTime":95.528,"body":"has two things in it"},{"speaker":"David Bianco","startTime":95.528,"endTime":92.092,"body":" "},{"speaker":"David Bianco","startTime":92.092,"endTime":95.528,"body":"that are relevant to your question."},{"speaker":"David Bianco","startTime":95.528,"endTime":95.862,"body":" "},{"speaker":"David Bianco","startTime":95.862,"endTime":98.531,"body":"One is a definition of threat hunting,"},{"speaker":"David Bianco","startTime":98.531,"endTime":98.531,"body":" "},{"speaker":"David Bianco","startTime":98.531,"endTime":102.735,"body":"which is basically any human driven"},{"speaker":"David Bianco","startTime":102.735,"endTime":103.203,"body":" "},{"speaker":"David Bianco","startTime":103.203,"endTime":108.141,"body":"kind of, exercise"},{"speaker":"David Bianco","startTime":108.141,"endTime":103.203,"body":" "},{"speaker":"David Bianco","startTime":103.203,"endTime":108.141,"body":"that you might go through to identify"},{"speaker":"David Bianco","startTime":108.141,"endTime":108.141,"body":" "},{"speaker":"David Bianco","startTime":108.141,"endTime":111.945,"body":"bad things on your network"},{"speaker":"David Bianco","startTime":111.945,"endTime":108.141,"body":" "},{"speaker":"David Bianco","startTime":108.141,"endTime":111.945,"body":"that your automated systems did not like."},{"speaker":"David Bianco","startTime":111.945,"endTime":112.779,"body":" "},{"speaker":"David Bianco","startTime":112.779,"endTime":115.415,"body":"But the key there is human driven."},{"speaker":"David Bianco","startTime":115.415,"endTime":115.415,"body":" "},{"speaker":"David Bianco","startTime":115.415,"endTime":122.922,"body":"So fully automated or even AI automated"},{"speaker":"David Bianco","startTime":122.922,"endTime":115.415,"body":" "},{"speaker":"David Bianco","startTime":115.415,"endTime":122.922,"body":"and AI driven doesn't really count"},{"speaker":"David Bianco","startTime":122.922,"endTime":122.922,"body":" "},{"speaker":"David Bianco","startTime":122.922,"endTime":126.392,"body":"because we just call that a detection"},{"speaker":"David Bianco","startTime":126.392,"endTime":122.922,"body":" "},{"speaker":"David Bianco","startTime":122.922,"endTime":126.392,"body":"platform at that at that point."},{"speaker":"David Bianco","startTime":126.392,"endTime":126.392,"body":" "},{"speaker":"David Bianco","startTime":126.392,"endTime":127.293,"body":"Right?"},{"speaker":"David Bianco","startTime":127.293,"endTime":127.293,"body":" "},{"speaker":"David Bianco","startTime":127.293,"endTime":131.731,"body":"And then the other thing is"},{"speaker":"David Bianco","startTime":131.731,"endTime":127.293,"body":" "},{"speaker":"David Bianco","startTime":127.293,"endTime":131.731,"body":"we also developed three types"},{"speaker":"David Bianco","startTime":131.731,"endTime":131.731,"body":" "},{"speaker":"David Bianco","startTime":131.731,"endTime":136.636,"body":"of threat hunts, or at least we"},{"speaker":"David Bianco","startTime":136.636,"endTime":131.731,"body":" "},{"speaker":"David Bianco","startTime":131.731,"endTime":136.636,"body":"we documented three types of threat hunts."},{"speaker":"David Bianco","startTime":136.636,"endTime":137.003,"body":" "},{"speaker":"David Bianco","startTime":137.003,"endTime":142.308,"body":"Probably most people who have even heard"},{"speaker":"David Bianco","startTime":142.308,"endTime":137.003,"body":" "},{"speaker":"David Bianco","startTime":137.003,"endTime":142.308,"body":"a little bit about threat hunting"},{"speaker":"David Bianco","startTime":142.308,"endTime":142.308,"body":" "},{"speaker":"David Bianco","startTime":142.308,"endTime":146.012,"body":"know the first one,"},{"speaker":"David Bianco","startTime":146.012,"endTime":142.308,"body":" "},{"speaker":"David Bianco","startTime":142.308,"endTime":146.012,"body":"which is hypothesis driven threat hunting,"},{"speaker":"David Bianco","startTime":146.012,"endTime":146.012,"body":" "},{"speaker":"David Bianco","startTime":146.012,"endTime":148.181,"body":"which is,"},{"speaker":"David Bianco","startTime":148.181,"endTime":146.012,"body":" "},{"speaker":"David Bianco","startTime":146.012,"endTime":148.181,"body":"I think, what you were asking about."},{"speaker":"David Bianco","startTime":148.181,"endTime":148.181,"body":" "},{"speaker":"David Bianco","startTime":148.181,"endTime":151.484,"body":"But we also have, the baseline"},{"speaker":"David Bianco","startTime":151.484,"endTime":152.051,"body":" "},{"speaker":"David Bianco","startTime":152.051,"endTime":155.421,"body":"threat hunting, which is more along"},{"speaker":"David Bianco","startTime":155.421,"endTime":152.051,"body":" "},{"speaker":"David Bianco","startTime":152.051,"endTime":155.421,"body":"the lines of figuring out"},{"speaker":"David Bianco","startTime":155.421,"endTime":155.421,"body":" "},{"speaker":"David Bianco","startTime":155.421,"endTime":160.393,"body":"what's normal for your data set"},{"speaker":"David Bianco","startTime":160.393,"endTime":155.421,"body":" "},{"speaker":"David Bianco","startTime":155.421,"endTime":160.393,"body":"or your environment and then looking for,"},{"speaker":"David Bianco","startTime":160.393,"endTime":160.66,"body":" "},{"speaker":"David Bianco","startTime":160.66,"endTime":164.03,"body":"deviations from that, that are, that,"},{"speaker":"David Bianco","startTime":164.03,"endTime":164.597,"body":" "},{"speaker":"David Bianco","startTime":164.597,"endTime":169.702,"body":"you know, might, might be indicative"},{"speaker":"David Bianco","startTime":169.702,"endTime":164.597,"body":" "},{"speaker":"David Bianco","startTime":164.597,"endTime":169.702,"body":"of some malicious or suspicious behavior."},{"speaker":"David Bianco","startTime":169.702,"endTime":169.903,"body":" "},{"speaker":"David Bianco","startTime":169.903,"endTime":175.475,"body":"And then the third that we defined"},{"speaker":"David Bianco","startTime":175.475,"endTime":169.903,"body":" "},{"speaker":"David Bianco","startTime":169.903,"endTime":175.475,"body":"was the model assisted threat hunting"},{"speaker":"David Bianco","startTime":175.475,"endTime":175.742,"body":" "},{"speaker":"David Bianco","startTime":175.742,"endTime":180.78,"body":"or we just call it math for short,"},{"speaker":"David Bianco","startTime":180.78,"endTime":175.742,"body":" "},{"speaker":"David Bianco","startTime":175.742,"endTime":180.78,"body":"but it's that's where you bring in"},{"speaker":"David Bianco","startTime":180.78,"endTime":181.181,"body":" "},{"speaker":"David Bianco","startTime":181.181,"endTime":185.385,"body":"statistical or, machine learning or,"},{"speaker":"David Bianco","startTime":185.385,"endTime":185.385,"body":" "},{"speaker":"David Bianco","startTime":185.385,"endTime":190.69,"body":"or maybe in some cases even, Lims"},{"speaker":"David Bianco","startTime":190.69,"endTime":185.385,"body":" "},{"speaker":"David Bianco","startTime":185.385,"endTime":190.69,"body":"or something like that to help you,"},{"speaker":"David Bianco","startTime":190.69,"endTime":190.957,"body":" "},{"speaker":"David Bianco","startTime":190.957,"endTime":194.494,"body":"but it's there"},{"speaker":"David Bianco","startTime":194.494,"endTime":190.957,"body":" "},{"speaker":"David Bianco","startTime":190.957,"endTime":194.494,"body":"all three years, still driven by humans."},{"speaker":"David Bianco","startTime":194.494,"endTime":195.061,"body":" "},{"speaker":"Amy Ciminnisi","startTime":195.061,"endTime":196.129,"body":"Got it."},{"speaker":"Amy Ciminnisi","startTime":196.129,"endTime":196.129,"body":" "},{"speaker":"Amy Ciminnisi","startTime":196.129,"endTime":197.43,"body":"You have already talked"},{"speaker":"Amy Ciminnisi","startTime":197.43,"endTime":197.43,"body":" "},{"speaker":"Amy Ciminnisi","startTime":197.43,"endTime":201.301,"body":"about PEAK a little bit,"},{"speaker":"Amy Ciminnisi","startTime":201.301,"endTime":197.43,"body":" "},{"speaker":"Amy Ciminnisi","startTime":197.43,"endTime":201.301,"body":"but for those who don't know, what is it?"},{"speaker":"Amy Ciminnisi","startTime":201.301,"endTime":201.301,"body":" "},{"speaker":"Amy Ciminnisi","startTime":201.301,"endTime":202.669,"body":"What does it stand for?"},{"speaker":"Amy Ciminnisi","startTime":202.669,"endTime":202.669,"body":" "},{"speaker":"Amy Ciminnisi","startTime":202.669,"endTime":204.971,"body":"Why did your team develop it?"},{"speaker":"Amy Ciminnisi","startTime":204.971,"endTime":204.971,"body":" "},{"speaker":"David Bianco","startTime":204.971,"endTime":207.874,"body":"So we developed it and with my two"},{"speaker":"David Bianco","startTime":207.874,"endTime":207.874,"body":" "},{"speaker":"David Bianco","startTime":207.874,"endTime":212.378,"body":"coauthors, Doctor"},{"speaker":"David Bianco","startTime":212.378,"endTime":207.874,"body":" "},{"speaker":"David Bianco","startTime":207.874,"endTime":212.378,"body":"Ryan Fetterman and Sidney Moroney,"},{"speaker":"David Bianco","startTime":212.378,"endTime":212.579,"body":" "},{"speaker":"David Bianco","startTime":212.579,"endTime":217.65,"body":"we developed it to basically modernize"},{"speaker":"David Bianco","startTime":217.65,"endTime":212.579,"body":" "},{"speaker":"David Bianco","startTime":212.579,"endTime":217.65,"body":"threat hunting."},{"speaker":"David Bianco","startTime":217.65,"endTime":217.65,"body":" "},{"speaker":"David Bianco","startTime":217.65,"endTime":222.989,"body":"So around 2015 or 2016,"},{"speaker":"David Bianco","startTime":222.989,"endTime":217.65,"body":" "},{"speaker":"David Bianco","startTime":217.65,"endTime":222.989,"body":"I actually was working"},{"speaker":"David Bianco","startTime":222.989,"endTime":222.989,"body":" "},{"speaker":"David Bianco","startTime":222.989,"endTime":227.493,"body":"for a different like a startup company"},{"speaker":"David Bianco","startTime":227.493,"endTime":222.989,"body":" "},{"speaker":"David Bianco","startTime":222.989,"endTime":227.493,"body":"that was in threat hunting space."},{"speaker":"David Bianco","startTime":227.493,"endTime":227.493,"body":" "},{"speaker":"David Bianco","startTime":227.493,"endTime":231.264,"body":"And we created and published"},{"speaker":"David Bianco","startTime":231.264,"endTime":227.493,"body":" "},{"speaker":"David Bianco","startTime":227.493,"endTime":231.264,"body":"the first widely"},{"speaker":"David Bianco","startTime":231.264,"endTime":231.264,"body":" "},{"speaker":"David Bianco","startTime":231.264,"endTime":235.268,"body":"adopted threat"},{"speaker":"David Bianco","startTime":235.268,"endTime":231.264,"body":" "},{"speaker":"David Bianco","startTime":231.264,"endTime":235.268,"body":"hunting methodology or framework."},{"speaker":"David Bianco","startTime":235.268,"endTime":235.501,"body":" "},{"speaker":"David Bianco","startTime":235.501,"endTime":239.906,"body":"It had been almost nine years since that"},{"speaker":"David Bianco","startTime":239.906,"endTime":240.373,"body":" "},{"speaker":"David Bianco","startTime":240.373,"endTime":244.744,"body":"when I joined the search team back,"},{"speaker":"David Bianco","startTime":244.744,"endTime":240.373,"body":" "},{"speaker":"David Bianco","startTime":240.373,"endTime":244.744,"body":"at this time, we were part of Splunk."},{"speaker":"David Bianco","startTime":244.744,"endTime":244.744,"body":" "},{"speaker":"David Bianco","startTime":244.744,"endTime":248.514,"body":"Even though the search team"},{"speaker":"David Bianco","startTime":248.514,"endTime":244.744,"body":" "},{"speaker":"David Bianco","startTime":244.744,"endTime":248.514,"body":"is now part of Cisco Foundation AI"},{"speaker":"David Bianco","startTime":248.514,"endTime":248.915,"body":" "},{"speaker":"David Bianco","startTime":248.915,"endTime":251.818,"body":"we had a great threat hunting platform,"},{"speaker":"David Bianco","startTime":251.818,"endTime":251.818,"body":" "},{"speaker":"David Bianco","startTime":251.818,"endTime":255.421,"body":"and we wanted to modernize"},{"speaker":"David Bianco","startTime":255.421,"endTime":255.421,"body":" "},{"speaker":"David Bianco","startTime":255.421,"endTime":261.06,"body":"the way people approach threat hunting"},{"speaker":"David Bianco","startTime":261.06,"endTime":255.421,"body":" "},{"speaker":"David Bianco","startTime":255.421,"endTime":261.06,"body":"with the lessons that we had learned"},{"speaker":"David Bianco","startTime":261.06,"endTime":261.06,"body":" "},{"speaker":"David Bianco","startTime":261.06,"endTime":265.698,"body":"in almost the previous decade,"},{"speaker":"David Bianco","startTime":265.698,"endTime":261.06,"body":" "},{"speaker":"David Bianco","startTime":261.06,"endTime":265.698,"body":"because that's a long time not to say"},{"speaker":"David Bianco","startTime":265.698,"endTime":265.698,"body":" "},{"speaker":"David Bianco","startTime":265.698,"endTime":270.136,"body":"any of the older things were wrong,"},{"speaker":"David Bianco","startTime":270.136,"endTime":265.698,"body":" "},{"speaker":"David Bianco","startTime":265.698,"endTime":270.136,"body":"but we added new things."},{"speaker":"David Bianco","startTime":270.136,"endTime":270.136,"body":" "},{"speaker":"David Bianco","startTime":270.136,"endTime":272.972,"body":"We got better"},{"speaker":"David Bianco","startTime":272.972,"endTime":270.136,"body":" "},{"speaker":"David Bianco","startTime":270.136,"endTime":272.972,"body":"at doing the existing things."},{"speaker":"David Bianco","startTime":272.972,"endTime":272.972,"body":" "},{"speaker":"David Bianco","startTime":272.972,"endTime":277.31,"body":"So in a way, the PEAK Threat Hunting"},{"speaker":"David Bianco","startTime":277.31,"endTime":272.972,"body":" "},{"speaker":"David Bianco","startTime":272.972,"endTime":277.31,"body":"Framework is a modernization"},{"speaker":"David Bianco","startTime":277.31,"endTime":277.31,"body":" "},{"speaker":"David Bianco","startTime":277.31,"endTime":280.68,"body":"of the older frameworks, that existed."},{"speaker":"David Bianco","startTime":280.68,"endTime":281.381,"body":" "},{"speaker":"David Bianco","startTime":281.381,"endTime":286.686,"body":"It's called peak because it is a three"},{"speaker":"David Bianco","startTime":286.686,"endTime":281.381,"body":" "},{"speaker":"David Bianco","startTime":281.381,"endTime":286.686,"body":"phase threat hunt process."},{"speaker":"David Bianco","startTime":286.686,"endTime":286.953,"body":" "},{"speaker":"David Bianco","startTime":286.953,"endTime":290.123,"body":"The first phase is the prepare phase,"},{"speaker":"David Bianco","startTime":290.123,"endTime":290.423,"body":" "},{"speaker":"David Bianco","startTime":290.423,"endTime":295.762,"body":"in which you go from I have a general idea"},{"speaker":"David Bianco","startTime":295.762,"endTime":290.423,"body":" "},{"speaker":"David Bianco","startTime":290.423,"endTime":295.762,"body":"of what I want to hunt for into."},{"speaker":"David Bianco","startTime":295.762,"endTime":295.762,"body":" "},{"speaker":"David Bianco","startTime":295.762,"endTime":300.433,"body":"I am ready to start executing data"},{"speaker":"David Bianco","startTime":300.433,"endTime":295.762,"body":" "},{"speaker":"David Bianco","startTime":295.762,"endTime":300.433,"body":"analysis tasks or whatever they are."},{"speaker":"David Bianco","startTime":300.433,"endTime":300.433,"body":" "},{"speaker":"David Bianco","startTime":300.433,"endTime":301.0,"body":"Right."},{"speaker":"David Bianco","startTime":301.0,"endTime":301.0,"body":" "},{"speaker":"David Bianco","startTime":301.0,"endTime":306.773,"body":"So it involves researching"},{"speaker":"David Bianco","startTime":306.773,"endTime":301.0,"body":" "},{"speaker":"David Bianco","startTime":301.0,"endTime":306.773,"body":"on, you know, open source research,"},{"speaker":"David Bianco","startTime":306.773,"endTime":306.773,"body":" "},{"speaker":"David Bianco","startTime":306.773,"endTime":311.544,"body":"like internet research about your hot"},{"speaker":"David Bianco","startTime":311.544,"endTime":306.773,"body":" "},{"speaker":"David Bianco","startTime":306.773,"endTime":311.544,"body":"topic, your general hunt topic,"},{"speaker":"David Bianco","startTime":311.544,"endTime":312.011,"body":" "},{"speaker":"David Bianco","startTime":312.011,"endTime":314.881,"body":"how it is performed,"},{"speaker":"David Bianco","startTime":314.881,"endTime":314.881,"body":" "},{"speaker":"David Bianco","startTime":314.881,"endTime":318.484,"body":"what it is, why threat actors use it, etc."},{"speaker":"David Bianco","startTime":318.484,"endTime":319.152,"body":" "},{"speaker":"David Bianco","startTime":319.152,"endTime":323.256,"body":"but it also involves research"},{"speaker":"David Bianco","startTime":323.256,"endTime":319.152,"body":" "},{"speaker":"David Bianco","startTime":319.152,"endTime":323.256,"body":"in your internal environment."},{"speaker":"David Bianco","startTime":323.256,"endTime":323.289,"body":" "},{"speaker":"David Bianco","startTime":323.289,"endTime":327.794,"body":"So things like, has my hunt team"},{"speaker":"David Bianco","startTime":327.794,"endTime":323.289,"body":" "},{"speaker":"David Bianco","startTime":323.289,"endTime":327.794,"body":"ever hunted for this before?"},{"speaker":"David Bianco","startTime":327.794,"endTime":328.061,"body":" "},{"speaker":"David Bianco","startTime":328.061,"endTime":328.861,"body":"Have we encountered"},{"speaker":"David Bianco","startTime":328.861,"endTime":328.861,"body":" "},{"speaker":"David Bianco","startTime":328.861,"endTime":333.499,"body":"any incidents that had this technique"},{"speaker":"David Bianco","startTime":333.499,"endTime":328.861,"body":" "},{"speaker":"David Bianco","startTime":328.861,"endTime":333.499,"body":"involved that I could learn from?"},{"speaker":"David Bianco","startTime":333.499,"endTime":333.733,"body":" "},{"speaker":"David Bianco","startTime":333.733,"endTime":338.871,"body":"Does our CTE team"},{"speaker":"David Bianco","startTime":338.871,"endTime":333.733,"body":" "},{"speaker":"David Bianco","startTime":333.733,"endTime":338.871,"body":"have some information about threat actors"},{"speaker":"David Bianco","startTime":338.871,"endTime":338.871,"body":" "},{"speaker":"David Bianco","startTime":338.871,"endTime":344.21,"body":"who might be using this, or,"},{"speaker":"David Bianco","startTime":344.21,"endTime":338.871,"body":" "},{"speaker":"David Bianco","startTime":338.871,"endTime":344.21,"body":"you know, almost any kind of internal,"},{"speaker":"David Bianco","startTime":344.21,"endTime":344.544,"body":" "},{"speaker":"David Bianco","startTime":344.544,"endTime":349.649,"body":"nonpublic data that you combine together"},{"speaker":"David Bianco","startTime":349.649,"endTime":344.544,"body":" "},{"speaker":"David Bianco","startTime":344.544,"endTime":349.649,"body":"with the public research,"},{"speaker":"David Bianco","startTime":349.649,"endTime":349.782,"body":" "},{"speaker":"David Bianco","startTime":349.782,"endTime":353.886,"body":"to get a full picture"},{"speaker":"David Bianco","startTime":353.886,"endTime":349.782,"body":" "},{"speaker":"David Bianco","startTime":349.782,"endTime":353.886,"body":"not only of what that is, but also how"},{"speaker":"David Bianco","startTime":353.886,"endTime":353.886,"body":" "},{"speaker":"David Bianco","startTime":353.886,"endTime":358.825,"body":"it affects your environment"},{"speaker":"David Bianco","startTime":358.825,"endTime":353.886,"body":" "},{"speaker":"David Bianco","startTime":353.886,"endTime":358.825,"body":"and you end up, the preparation phase"},{"speaker":"David Bianco","startTime":358.825,"endTime":358.825,"body":" "},{"speaker":"David Bianco","startTime":358.825,"endTime":363.629,"body":"with a, not only all that research,"},{"speaker":"David Bianco","startTime":363.629,"endTime":358.825,"body":" "},{"speaker":"David Bianco","startTime":358.825,"endTime":363.629,"body":"but also the actual hunt plan."},{"speaker":"David Bianco","startTime":363.629,"endTime":363.629,"body":" "},{"speaker":"David Bianco","startTime":363.629,"endTime":366.099,"body":"Like,"},{"speaker":"David Bianco","startTime":366.099,"endTime":363.629,"body":" "},{"speaker":"David Bianco","startTime":363.629,"endTime":366.099,"body":"here are the steps that I'm going to do."},{"speaker":"David Bianco","startTime":366.099,"endTime":366.099,"body":" "},{"speaker":"David Bianco","startTime":366.099,"endTime":367.7,"body":"Here's how they work."},{"speaker":"David Bianco","startTime":367.7,"endTime":367.7,"body":" "},{"speaker":"David Bianco","startTime":367.7,"endTime":371.404,"body":"And you know, this, the order"},{"speaker":"David Bianco","startTime":371.404,"endTime":367.7,"body":" "},{"speaker":"David Bianco","startTime":367.7,"endTime":371.404,"body":"I might have to do them in, etc."},{"speaker":"David Bianco","startTime":371.404,"endTime":371.704,"body":" "},{"speaker":"David Bianco","startTime":371.704,"endTime":375.441,"body":"And then you transfer into the next phase,"},{"speaker":"David Bianco","startTime":375.441,"endTime":371.704,"body":" "},{"speaker":"David Bianco","startTime":371.704,"endTime":375.441,"body":"which is execute,"},{"speaker":"David Bianco","startTime":375.441,"endTime":375.441,"body":" "},{"speaker":"David Bianco","startTime":375.441,"endTime":378.444,"body":"which is where you actually execute"},{"speaker":"David Bianco","startTime":378.444,"endTime":375.441,"body":" "},{"speaker":"David Bianco","startTime":375.441,"endTime":378.444,"body":"the hunt plan."},{"speaker":"David Bianco","startTime":378.444,"endTime":378.444,"body":" "},{"speaker":"David Bianco","startTime":378.444,"endTime":380.146,"body":"You might have to iterate on it"},{"speaker":"David Bianco","startTime":380.146,"endTime":380.146,"body":" "},{"speaker":"David Bianco","startTime":380.146,"endTime":383.649,"body":"a few times because maybe your plan"},{"speaker":"David Bianco","startTime":383.649,"endTime":380.146,"body":" "},{"speaker":"David Bianco","startTime":380.146,"endTime":383.649,"body":"wasn't exactly accurate."},{"speaker":"David Bianco","startTime":383.649,"endTime":383.649,"body":" "},{"speaker":"David Bianco","startTime":383.649,"endTime":386.285,"body":"Or maybe there's some wrenches"},{"speaker":"David Bianco","startTime":386.285,"endTime":383.649,"body":" "},{"speaker":"David Bianco","startTime":383.649,"endTime":386.285,"body":"that you didn't know about"},{"speaker":"David Bianco","startTime":386.285,"endTime":386.285,"body":" "},{"speaker":"David Bianco","startTime":386.285,"endTime":389.822,"body":"that were going to be thrown into"},{"speaker":"David Bianco","startTime":389.822,"endTime":386.285,"body":" "},{"speaker":"David Bianco","startTime":386.285,"endTime":389.822,"body":"the gears, that you have to work around."},{"speaker":"David Bianco","startTime":389.822,"endTime":389.822,"body":" "},{"speaker":"David Bianco","startTime":389.822,"endTime":393.359,"body":"And then you move into the third phase,"},{"speaker":"David Bianco","startTime":393.359,"endTime":389.822,"body":" "},{"speaker":"David Bianco","startTime":389.822,"endTime":393.359,"body":"which is the act phase."},{"speaker":"David Bianco","startTime":393.359,"endTime":393.526,"body":" "},{"speaker":"David Bianco","startTime":393.526,"endTime":397.296,"body":"You feed that knowledge"},{"speaker":"David Bianco","startTime":397.296,"endTime":393.526,"body":" "},{"speaker":"David Bianco","startTime":393.526,"endTime":397.296,"body":"that you just gained"},{"speaker":"David Bianco","startTime":397.296,"endTime":397.296,"body":" "},{"speaker":"David Bianco","startTime":397.296,"endTime":400.7,"body":"from the execute phase"},{"speaker":"David Bianco","startTime":400.7,"endTime":397.296,"body":" "},{"speaker":"David Bianco","startTime":397.296,"endTime":400.7,"body":"back into your organization."},{"speaker":"David Bianco","startTime":400.7,"endTime":400.7,"body":" "},{"speaker":"David Bianco","startTime":400.7,"endTime":403.603,"body":"So it can have an effect on security."},{"speaker":"David Bianco","startTime":403.603,"endTime":403.603,"body":" "},{"speaker":"David Bianco","startTime":403.603,"endTime":406.873,"body":"That could be as simple as, I'm"},{"speaker":"David Bianco","startTime":406.873,"endTime":403.603,"body":" "},{"speaker":"David Bianco","startTime":403.603,"endTime":406.873,"body":"going to document"},{"speaker":"David Bianco","startTime":406.873,"endTime":406.873,"body":" "},{"speaker":"David Bianco","startTime":406.873,"endTime":410.209,"body":"the hunt steps that I did and why"},{"speaker":"David Bianco","startTime":410.209,"endTime":406.873,"body":" "},{"speaker":"David Bianco","startTime":406.873,"endTime":410.209,"body":"and what my results were."},{"speaker":"David Bianco","startTime":410.209,"endTime":410.676,"body":" "},{"speaker":"David Bianco","startTime":410.676,"endTime":414.814,"body":"I might if I found some active"},{"speaker":"David Bianco","startTime":414.814,"endTime":410.676,"body":" "},{"speaker":"David Bianco","startTime":410.676,"endTime":414.814,"body":"security incidents or things"},{"speaker":"David Bianco","startTime":414.814,"endTime":414.814,"body":" "},{"speaker":"David Bianco","startTime":414.814,"endTime":419.218,"body":"that look like they might be incidents,"},{"speaker":"David Bianco","startTime":419.218,"endTime":414.814,"body":" "},{"speaker":"David Bianco","startTime":414.814,"endTime":419.218,"body":"I might escalate them to the SoC analysts."},{"speaker":"David Bianco","startTime":419.218,"endTime":419.552,"body":" "},{"speaker":"David Bianco","startTime":419.552,"endTime":422.522,"body":"There might be other things"},{"speaker":"David Bianco","startTime":422.522,"endTime":419.552,"body":" "},{"speaker":"David Bianco","startTime":419.552,"endTime":422.522,"body":"to stakeholder briefings"},{"speaker":"David Bianco","startTime":422.522,"endTime":422.522,"body":" "},{"speaker":"David Bianco","startTime":422.522,"endTime":425.792,"body":"to let them know what you've been doing"},{"speaker":"David Bianco","startTime":425.792,"endTime":422.522,"body":" "},{"speaker":"David Bianco","startTime":422.522,"endTime":425.792,"body":"recently."},{"speaker":"David Bianco","startTime":425.792,"endTime":426.526,"body":" "},{"speaker":"David Bianco","startTime":426.526,"endTime":429.228,"body":"Kind of showing the value"},{"speaker":"David Bianco","startTime":429.228,"endTime":426.526,"body":" "},{"speaker":"David Bianco","startTime":426.526,"endTime":429.228,"body":"of the threat hunting and of course,"},{"speaker":"David Bianco","startTime":429.228,"endTime":429.228,"body":" "},{"speaker":"David Bianco","startTime":429.228,"endTime":432.231,"body":"tracking the metrics"},{"speaker":"David Bianco","startTime":432.231,"endTime":429.228,"body":" "},{"speaker":"David Bianco","startTime":429.228,"endTime":432.231,"body":"for for the threat hunts."},{"speaker":"David Bianco","startTime":432.231,"endTime":432.498,"body":" "},{"speaker":"David Bianco","startTime":432.498,"endTime":438.171,"body":"With all those three you've moved from,"},{"speaker":"David Bianco","startTime":438.171,"endTime":432.498,"body":" "},{"speaker":"David Bianco","startTime":432.498,"endTime":438.171,"body":"I have a general idea to a concrete plan,"},{"speaker":"David Bianco","startTime":438.171,"endTime":438.171,"body":" "},{"speaker":"David Bianco","startTime":438.171,"endTime":441.374,"body":"which you then execute,"},{"speaker":"David Bianco","startTime":441.374,"endTime":438.171,"body":" "},{"speaker":"David Bianco","startTime":438.171,"endTime":441.374,"body":"which you then turn around"},{"speaker":"David Bianco","startTime":441.374,"endTime":441.374,"body":" "},{"speaker":"David Bianco","startTime":441.374,"endTime":445.478,"body":"and take those results from that execution"},{"speaker":"David Bianco","startTime":445.478,"endTime":441.374,"body":" "},{"speaker":"David Bianco","startTime":441.374,"endTime":445.478,"body":"and put them back into your,"},{"speaker":"David Bianco","startTime":445.478,"endTime":445.545,"body":" "},{"speaker":"David Bianco","startTime":445.545,"endTime":449.115,"body":"security program to strengthen"},{"speaker":"David Bianco","startTime":449.115,"endTime":445.545,"body":" "},{"speaker":"David Bianco","startTime":445.545,"endTime":449.115,"body":"your security posture."},{"speaker":"David Bianco","startTime":449.115,"endTime":449.715,"body":" "},{"speaker":"David Bianco","startTime":449.715,"endTime":451.984,"body":"There's a one additional layer."},{"speaker":"David Bianco","startTime":451.984,"endTime":451.984,"body":" "},{"speaker":"David Bianco","startTime":451.984,"endTime":453.553,"body":"It's the knowledge."},{"speaker":"David Bianco","startTime":453.553,"endTime":453.553,"body":" "},{"speaker":"David Bianco","startTime":453.553,"endTime":457.623,"body":"So the full name of it is prepare, execute"},{"speaker":"David Bianco","startTime":457.623,"endTime":453.553,"body":" "},{"speaker":"David Bianco","startTime":453.553,"endTime":457.623,"body":"and act with knowledge."},{"speaker":"David Bianco","startTime":457.623,"endTime":457.623,"body":" "},{"speaker":"David Bianco","startTime":457.623,"endTime":462.361,"body":"Because in each of those phases"},{"speaker":"David Bianco","startTime":462.361,"endTime":457.623,"body":" "},{"speaker":"David Bianco","startTime":457.623,"endTime":462.361,"body":"you have some interaction with knowledge."},{"speaker":"David Bianco","startTime":462.361,"endTime":462.361,"body":" "},{"speaker":"David Bianco","startTime":462.361,"endTime":465.064,"body":"Either you're consuming knowledge."},{"speaker":"David Bianco","startTime":465.064,"endTime":465.064,"body":" "},{"speaker":"David Bianco","startTime":465.064,"endTime":468.601,"body":"A lot of times in the prepare phase,"},{"speaker":"David Bianco","startTime":468.601,"endTime":465.064,"body":" "},{"speaker":"David Bianco","startTime":465.064,"endTime":468.601,"body":"you're doing the research"},{"speaker":"David Bianco","startTime":468.601,"endTime":468.601,"body":" "},{"speaker":"David Bianco","startTime":468.601,"endTime":470.57,"body":"and you're bringing that knowledge in."},{"speaker":"David Bianco","startTime":470.57,"endTime":470.57,"body":" "},{"speaker":"David Bianco","startTime":470.57,"endTime":473.739,"body":"But also especially in the act"},{"speaker":"David Bianco","startTime":473.739,"endTime":470.57,"body":" "},{"speaker":"David Bianco","startTime":470.57,"endTime":473.739,"body":"you are creating"},{"speaker":"David Bianco","startTime":473.739,"endTime":473.739,"body":" "},{"speaker":"David Bianco","startTime":473.739,"endTime":476.943,"body":"net new knowledge"},{"speaker":"David Bianco","startTime":476.943,"endTime":473.739,"body":" "},{"speaker":"David Bianco","startTime":473.739,"endTime":476.943,"body":"and putting it back into your environment."},{"speaker":"David Bianco","startTime":476.943,"endTime":476.943,"body":" "},{"speaker":"David Bianco","startTime":476.943,"endTime":479.479,"body":"So you're getting better over time."},{"speaker":"David Bianco","startTime":479.479,"endTime":479.479,"body":" "},{"speaker":"David Bianco","startTime":479.479,"endTime":483.983,"body":"So it's it's"},{"speaker":"David Bianco","startTime":483.983,"endTime":479.479,"body":" "},{"speaker":"David Bianco","startTime":479.479,"endTime":483.983,"body":"prepare, execute and act with knowledge."},{"speaker":"David Bianco","startTime":483.983,"endTime":484.383,"body":" "},{"speaker":"Amy Ciminnisi","startTime":484.383,"endTime":486.886,"body":"So there you go. That's PEAK."},{"speaker":"Amy Ciminnisi","startTime":486.886,"endTime":486.886,"body":" "},{"speaker":"Amy Ciminnisi","startTime":486.886,"endTime":491.557,"body":"So a lot of organizations struggle"},{"speaker":"Amy Ciminnisi","startTime":491.557,"endTime":486.886,"body":" "},{"speaker":"Amy Ciminnisi","startTime":486.886,"endTime":491.557,"body":"to get budget and headcount"},{"speaker":"Amy Ciminnisi","startTime":491.557,"endTime":491.557,"body":" "},{"speaker":"Amy Ciminnisi","startTime":491.557,"endTime":495.995,"body":"for even defensive cybersecurity programs"},{"speaker":"Amy Ciminnisi","startTime":495.995,"endTime":491.557,"body":" "},{"speaker":"Amy Ciminnisi","startTime":491.557,"endTime":495.995,"body":"as it is."},{"speaker":"Amy Ciminnisi","startTime":495.995,"endTime":496.529,"body":" "},{"speaker":"Amy Ciminnisi","startTime":496.529,"endTime":499.065,"body":"And threat"},{"speaker":"Amy Ciminnisi","startTime":499.065,"endTime":496.529,"body":" "},{"speaker":"Amy Ciminnisi","startTime":496.529,"endTime":499.065,"body":"hunting is primarily proactive."},{"speaker":"Amy Ciminnisi","startTime":499.065,"endTime":499.065,"body":" "},{"speaker":"Amy Ciminnisi","startTime":499.065,"endTime":499.665,"body":"Right."},{"speaker":"Amy Ciminnisi","startTime":499.665,"endTime":499.665,"body":" "},{"speaker":"Amy Ciminnisi","startTime":499.665,"endTime":505.271,"body":"So for those organizations"},{"speaker":"Amy Ciminnisi","startTime":505.271,"endTime":499.665,"body":" "},{"speaker":"Amy Ciminnisi","startTime":499.665,"endTime":505.271,"body":"that have finally gotten the budget"},{"speaker":"Amy Ciminnisi","startTime":505.271,"endTime":505.638,"body":" "},{"speaker":"Amy Ciminnisi","startTime":505.638,"endTime":510.643,"body":"and don't have established"},{"speaker":"Amy Ciminnisi","startTime":510.643,"endTime":505.638,"body":" "},{"speaker":"Amy Ciminnisi","startTime":505.638,"endTime":510.643,"body":"programs are doing their best to get it up"},{"speaker":"Amy Ciminnisi","startTime":510.643,"endTime":510.643,"body":" "},{"speaker":"Amy Ciminnisi","startTime":510.643,"endTime":514.146,"body":"and running, how does the PEAK Framework"},{"speaker":"Amy Ciminnisi","startTime":514.146,"endTime":510.643,"body":" "},{"speaker":"Amy Ciminnisi","startTime":510.643,"endTime":514.146,"body":"help them start?"},{"speaker":"Amy Ciminnisi","startTime":514.146,"endTime":514.814,"body":" "},{"speaker":"David Bianco","startTime":514.814,"endTime":519.485,"body":"I usually recommend"},{"speaker":"David Bianco","startTime":519.485,"endTime":514.814,"body":" "},{"speaker":"David Bianco","startTime":514.814,"endTime":519.485,"body":"people start in 1 or 2 places"},{"speaker":"David Bianco","startTime":519.485,"endTime":519.485,"body":" "},{"speaker":"David Bianco","startTime":519.485,"endTime":524.39,"body":"if they're starting from zero hunt,"},{"speaker":"David Bianco","startTime":524.39,"endTime":519.485,"body":" "},{"speaker":"David Bianco","startTime":519.485,"endTime":524.39,"body":"capability at all."},{"speaker":"David Bianco","startTime":524.39,"endTime":524.39,"body":" "},{"speaker":"David Bianco","startTime":524.39,"endTime":530.863,"body":"And that's either, for those three types"},{"speaker":"David Bianco","startTime":530.863,"endTime":524.39,"body":" "},{"speaker":"David Bianco","startTime":524.39,"endTime":530.863,"body":"of, of threat hunts that we defined."},{"speaker":"David Bianco","startTime":530.863,"endTime":530.997,"body":" "},{"speaker":"David Bianco","startTime":530.997,"endTime":534.467,"body":"We have detailed process diagrams"},{"speaker":"David Bianco","startTime":534.467,"endTime":530.997,"body":" "},{"speaker":"David Bianco","startTime":530.997,"endTime":534.467,"body":"to show you how to do them."},{"speaker":"David Bianco","startTime":534.467,"endTime":534.467,"body":" "},{"speaker":"David Bianco","startTime":534.467,"endTime":540.139,"body":"And at each stage,"},{"speaker":"David Bianco","startTime":540.139,"endTime":534.467,"body":" "},{"speaker":"David Bianco","startTime":534.467,"endTime":540.139,"body":"what your goal is, and maybe not exactly"},{"speaker":"David Bianco","startTime":540.139,"endTime":540.306,"body":" "},{"speaker":"David Bianco","startTime":540.306,"endTime":544.377,"body":"how to accomplish that goal"},{"speaker":"David Bianco","startTime":544.377,"endTime":540.306,"body":" "},{"speaker":"David Bianco","startTime":540.306,"endTime":544.377,"body":"in every situation, because"},{"speaker":"David Bianco","startTime":544.377,"endTime":544.844,"body":" "},{"speaker":"David Bianco","startTime":544.844,"endTime":547.48,"body":"different"},{"speaker":"David Bianco","startTime":547.48,"endTime":544.844,"body":" "},{"speaker":"David Bianco","startTime":544.844,"endTime":547.48,"body":"hunting hypotheses will be different."},{"speaker":"David Bianco","startTime":547.48,"endTime":548.681,"body":" "},{"speaker":"David Bianco","startTime":548.681,"endTime":551.684,"body":"But we guide you through the process."},{"speaker":"David Bianco","startTime":551.684,"endTime":551.984,"body":" "},{"speaker":"David Bianco","startTime":551.984,"endTime":557.823,"body":"And so if you have no hunting at all,"},{"speaker":"David Bianco","startTime":557.823,"endTime":551.984,"body":" "},{"speaker":"David Bianco","startTime":551.984,"endTime":557.823,"body":"that is a great place to start."},{"speaker":"David Bianco","startTime":557.823,"endTime":557.823,"body":" "},{"speaker":"David Bianco","startTime":557.823,"endTime":560.56,"body":"Like start with hypothesis based hunting."},{"speaker":"David Bianco","startTime":560.56,"endTime":560.56,"body":" "},{"speaker":"David Bianco","startTime":560.56,"endTime":564.263,"body":"Go through the process diagram"},{"speaker":"David Bianco","startTime":564.263,"endTime":560.56,"body":" "},{"speaker":"David Bianco","startTime":560.56,"endTime":564.263,"body":"and the process"},{"speaker":"David Bianco","startTime":564.263,"endTime":564.263,"body":" "},{"speaker":"David Bianco","startTime":564.263,"endTime":568.701,"body":"descriptions and understand"},{"speaker":"David Bianco","startTime":568.701,"endTime":564.263,"body":" "},{"speaker":"David Bianco","startTime":564.263,"endTime":568.701,"body":"how to perform hypothesis based hunt."},{"speaker":"David Bianco","startTime":568.701,"endTime":568.701,"body":" "},{"speaker":"David Bianco","startTime":568.701,"endTime":571.604,"body":"And just start with"},{"speaker":"David Bianco","startTime":571.604,"endTime":568.701,"body":" "},{"speaker":"David Bianco","startTime":568.701,"endTime":571.604,"body":"some simple hypotheses."},{"speaker":"David Bianco","startTime":571.604,"endTime":571.604,"body":" "},{"speaker":"David Bianco","startTime":571.604,"endTime":577.243,"body":"The other places especially helpful"},{"speaker":"David Bianco","startTime":577.243,"endTime":571.604,"body":" "},{"speaker":"David Bianco","startTime":571.604,"endTime":577.243,"body":"if you already have a established threat"},{"speaker":"David Bianco","startTime":577.243,"endTime":577.243,"body":" "},{"speaker":"David Bianco","startTime":577.243,"endTime":581.28,"body":"hunting program,"},{"speaker":"David Bianco","startTime":581.28,"endTime":577.243,"body":" "},{"speaker":"David Bianco","startTime":577.243,"endTime":581.28,"body":"starting with the metrics,"},{"speaker":"David Bianco","startTime":581.28,"endTime":581.614,"body":" "},{"speaker":"David Bianco","startTime":581.614,"endTime":585.051,"body":"the the one metric that that springs to"},{"speaker":"David Bianco","startTime":585.051,"endTime":585.051,"body":" "},{"speaker":"David Bianco","startTime":585.051,"endTime":588.554,"body":"everyone's mind"},{"speaker":"David Bianco","startTime":588.554,"endTime":585.051,"body":" "},{"speaker":"David Bianco","startTime":585.051,"endTime":588.554,"body":"at probably the first thing is"},{"speaker":"David Bianco","startTime":588.554,"endTime":588.788,"body":" "},{"speaker":"David Bianco","startTime":588.788,"endTime":592.291,"body":"how many how many incidents did you find"},{"speaker":"David Bianco","startTime":592.291,"endTime":588.788,"body":" "},{"speaker":"David Bianco","startTime":588.788,"endTime":592.291,"body":"when you're hunting?"},{"speaker":"David Bianco","startTime":592.291,"endTime":592.592,"body":" "},{"speaker":"David Bianco","startTime":592.592,"endTime":596.596,"body":"And that is the worst garbage metric"},{"speaker":"David Bianco","startTime":596.596,"endTime":592.592,"body":" "},{"speaker":"David Bianco","startTime":592.592,"endTime":596.596,"body":"for us throughout hunting program ever."},{"speaker":"David Bianco","startTime":596.596,"endTime":596.896,"body":" "},{"speaker":"David Bianco","startTime":596.896,"endTime":599.332,"body":"Like, it is so totally unfair."},{"speaker":"David Bianco","startTime":599.332,"endTime":599.332,"body":" "},{"speaker":"David Bianco","startTime":599.332,"endTime":602.101,"body":"Your threat hunting program"},{"speaker":"David Bianco","startTime":602.101,"endTime":599.332,"body":" "},{"speaker":"David Bianco","startTime":599.332,"endTime":602.101,"body":"is going to fail"},{"speaker":"David Bianco","startTime":602.101,"endTime":602.101,"body":" "},{"speaker":"David Bianco","startTime":602.101,"endTime":604.804,"body":"if that's your primary metric,"},{"speaker":"David Bianco","startTime":604.804,"endTime":602.101,"body":" "},{"speaker":"David Bianco","startTime":602.101,"endTime":604.804,"body":"you're not going to fail,"},{"speaker":"David Bianco","startTime":604.804,"endTime":604.804,"body":" "},{"speaker":"David Bianco","startTime":604.804,"endTime":607.173,"body":"but it's going to look on paper"},{"speaker":"David Bianco","startTime":607.173,"endTime":604.804,"body":" "},{"speaker":"David Bianco","startTime":604.804,"endTime":607.173,"body":"like you fail."},{"speaker":"David Bianco","startTime":607.173,"endTime":607.173,"body":" "},{"speaker":"David Bianco","startTime":607.173,"endTime":611.41,"body":"And the reason is"},{"speaker":"David Bianco","startTime":611.41,"endTime":607.173,"body":" "},{"speaker":"David Bianco","startTime":607.173,"endTime":611.41,"body":"we don't control what the threat actors"},{"speaker":"David Bianco","startTime":611.41,"endTime":611.41,"body":" "},{"speaker":"David Bianco","startTime":611.41,"endTime":614.413,"body":"are doing, how they're doing it,"},{"speaker":"David Bianco","startTime":614.413,"endTime":611.41,"body":" "},{"speaker":"David Bianco","startTime":611.41,"endTime":614.413,"body":"or when they are doing it."},{"speaker":"David Bianco","startTime":614.413,"endTime":614.747,"body":" "},{"speaker":"David Bianco","startTime":614.747,"endTime":618.317,"body":"But when we hunt, we hunt for a certain,"},{"speaker":"David Bianco","startTime":618.317,"endTime":618.317,"body":" "},{"speaker":"David Bianco","startTime":618.317,"endTime":621.42,"body":"constrained set of behaviors or activities"},{"speaker":"David Bianco","startTime":621.42,"endTime":622.121,"body":" "},{"speaker":"David Bianco","startTime":622.121,"endTime":626.859,"body":"in a certain location on the network"},{"speaker":"David Bianco","startTime":626.859,"endTime":622.121,"body":" "},{"speaker":"David Bianco","startTime":622.121,"endTime":626.859,"body":"and it through a certain time window."},{"speaker":"David Bianco","startTime":626.859,"endTime":627.159,"body":" "},{"speaker":"David Bianco","startTime":627.159,"endTime":627.76,"body":"Right."},{"speaker":"David Bianco","startTime":627.76,"endTime":627.76,"body":" "},{"speaker":"David Bianco","startTime":627.76,"endTime":631.33,"body":"And all of those things have to line up"},{"speaker":"David Bianco","startTime":631.33,"endTime":627.76,"body":" "},{"speaker":"David Bianco","startTime":627.76,"endTime":631.33,"body":"for us to be able to actually catch"},{"speaker":"David Bianco","startTime":631.33,"endTime":631.33,"body":" "},{"speaker":"David Bianco","startTime":631.33,"endTime":633.366,"body":"an adversary in the middle."},{"speaker":"David Bianco","startTime":633.366,"endTime":633.366,"body":" "},{"speaker":"David Bianco","startTime":633.366,"endTime":636.702,"body":"But that is not the purpose"},{"speaker":"David Bianco","startTime":636.702,"endTime":636.702,"body":" "},{"speaker":"David Bianco","startTime":636.702,"endTime":639.872,"body":"of threat hunting,"},{"speaker":"David Bianco","startTime":639.872,"endTime":636.702,"body":" "},{"speaker":"David Bianco","startTime":636.702,"endTime":639.872,"body":"the purpose of threat hunting."},{"speaker":"David Bianco","startTime":639.872,"endTime":639.872,"body":" "},{"speaker":"David Bianco","startTime":639.872,"endTime":643.009,"body":"First, first of all, figure out"},{"speaker":"David Bianco","startTime":643.009,"endTime":639.872,"body":" "},{"speaker":"David Bianco","startTime":639.872,"endTime":643.009,"body":"how to find these things better."},{"speaker":"David Bianco","startTime":643.009,"endTime":643.009,"body":" "},{"speaker":"David Bianco","startTime":643.009,"endTime":647.58,"body":"So we can automate them ideally,"},{"speaker":"David Bianco","startTime":647.58,"endTime":643.009,"body":" "},{"speaker":"David Bianco","startTime":643.009,"endTime":647.58,"body":"but also to drive continuous"},{"speaker":"David Bianco","startTime":647.58,"endTime":647.58,"body":" "},{"speaker":"David Bianco","startTime":647.58,"endTime":652.284,"body":"improvement across your security posture"},{"speaker":"David Bianco","startTime":652.284,"endTime":647.58,"body":" "},{"speaker":"David Bianco","startTime":647.58,"endTime":652.284,"body":"of your entire organization."},{"speaker":"David Bianco","startTime":652.284,"endTime":652.585,"body":" "},{"speaker":"David Bianco","startTime":652.585,"endTime":656.522,"body":"Because when we are threat hunting,"},{"speaker":"David Bianco","startTime":656.522,"endTime":652.585,"body":" "},{"speaker":"David Bianco","startTime":652.585,"endTime":656.522,"body":"we are poking around in places"},{"speaker":"David Bianco","startTime":656.522,"endTime":656.522,"body":" "},{"speaker":"David Bianco","startTime":656.522,"endTime":660.359,"body":"that a lot of times"},{"speaker":"David Bianco","startTime":660.359,"endTime":656.522,"body":" "},{"speaker":"David Bianco","startTime":656.522,"endTime":660.359,"body":"people don't poke around in too much like"},{"speaker":"David Bianco","startTime":660.359,"endTime":660.359,"body":" "},{"speaker":"David Bianco","startTime":660.359,"endTime":663.863,"body":"the automated systems"},{"speaker":"David Bianco","startTime":663.863,"endTime":660.359,"body":" "},{"speaker":"David Bianco","startTime":660.359,"endTime":663.863,"body":"that we have, like our SIEMs and IDs"},{"speaker":"David Bianco","startTime":663.863,"endTime":663.896,"body":" "},{"speaker":"David Bianco","startTime":663.896,"endTime":667.166,"body":"and whatever they consume,"},{"speaker":"David Bianco","startTime":667.166,"endTime":663.896,"body":" "},{"speaker":"David Bianco","startTime":663.896,"endTime":667.166,"body":"the data that they consume, they don't."},{"speaker":"David Bianco","startTime":667.166,"endTime":667.199,"body":" "},{"speaker":"David Bianco","startTime":667.199,"endTime":670.236,"body":"They inspect it,"},{"speaker":"David Bianco","startTime":670.236,"endTime":667.199,"body":" "},{"speaker":"David Bianco","startTime":667.199,"endTime":670.236,"body":"but they're not really looking for gaps"},{"speaker":"David Bianco","startTime":670.236,"endTime":670.236,"body":" "},{"speaker":"David Bianco","startTime":670.236,"endTime":674.273,"body":"or mis-parsed things or something"},{"speaker":"David Bianco","startTime":674.273,"endTime":670.236,"body":" "},{"speaker":"David Bianco","startTime":670.236,"endTime":674.273,"body":"that, that, all that time."},{"speaker":"David Bianco","startTime":674.273,"endTime":674.273,"body":" "},{"speaker":"David Bianco","startTime":674.273,"endTime":678.21,"body":"But we run into these,"},{"speaker":"David Bianco","startTime":678.21,"endTime":674.273,"body":" "},{"speaker":"David Bianco","startTime":674.273,"endTime":678.21,"body":"we run into visibility gaps, logs."},{"speaker":"David Bianco","startTime":678.21,"endTime":678.21,"body":" "},{"speaker":"David Bianco","startTime":678.21,"endTime":680.513,"body":"We thought we were collecting"},{"speaker":"David Bianco","startTime":680.513,"endTime":678.21,"body":" "},{"speaker":"David Bianco","startTime":678.21,"endTime":680.513,"body":"that we weren't, or logs"},{"speaker":"David Bianco","startTime":680.513,"endTime":680.513,"body":" "},{"speaker":"David Bianco","startTime":680.513,"endTime":682.615,"body":"that we didn't try to collect"},{"speaker":"David Bianco","startTime":682.615,"endTime":680.513,"body":" "},{"speaker":"David Bianco","startTime":680.513,"endTime":682.615,"body":"that we should."},{"speaker":"David Bianco","startTime":682.615,"endTime":682.615,"body":" "},{"speaker":"David Bianco","startTime":682.615,"endTime":684.717,"body":"We've run into old software versions."},{"speaker":"David Bianco","startTime":684.717,"endTime":684.717,"body":" "},{"speaker":"David Bianco","startTime":684.717,"endTime":685.618,"body":"Nobody noticed."},{"speaker":"David Bianco","startTime":685.618,"endTime":685.618,"body":" "},{"speaker":"David Bianco","startTime":685.618,"endTime":689.789,"body":"We run into configuration issues"},{"speaker":"David Bianco","startTime":689.789,"endTime":685.618,"body":" "},{"speaker":"David Bianco","startTime":685.618,"endTime":689.789,"body":"where it's, you know, insecurely"},{"speaker":"David Bianco","startTime":689.789,"endTime":689.789,"body":" "},{"speaker":"David Bianco","startTime":689.789,"endTime":691.29,"body":"configured or something like that."},{"speaker":"David Bianco","startTime":691.29,"endTime":691.29,"body":" "},{"speaker":"David Bianco","startTime":691.29,"endTime":693.259,"body":"We just a whole ton of things."},{"speaker":"David Bianco","startTime":693.259,"endTime":693.259,"body":" "},{"speaker":"David Bianco","startTime":693.259,"endTime":696.195,"body":"And every one of those things that we find"},{"speaker":"David Bianco","startTime":696.195,"endTime":696.195,"body":" "},{"speaker":"David Bianco","startTime":696.195,"endTime":698.898,"body":"and report back to the organization"},{"speaker":"David Bianco","startTime":698.898,"endTime":698.898,"body":" "},{"speaker":"David Bianco","startTime":698.898,"endTime":703.669,"body":"is an opportunity for the organization"},{"speaker":"David Bianco","startTime":703.669,"endTime":698.898,"body":" "},{"speaker":"David Bianco","startTime":698.898,"endTime":703.669,"body":"to improve their security posture."},{"speaker":"David Bianco","startTime":703.669,"endTime":703.803,"body":" "},{"speaker":"David Bianco","startTime":703.803,"endTime":708.307,"body":"We might not be"},{"speaker":"David Bianco","startTime":708.307,"endTime":703.803,"body":" "},{"speaker":"David Bianco","startTime":703.803,"endTime":708.307,"body":"the ones that actually solve those issues,"},{"speaker":"David Bianco","startTime":708.307,"endTime":708.574,"body":" "},{"speaker":"David Bianco","startTime":708.574,"endTime":711.41,"body":"but we can at least present"},{"speaker":"David Bianco","startTime":711.41,"endTime":708.574,"body":" "},{"speaker":"David Bianco","startTime":708.574,"endTime":711.41,"body":"the opportunities."},{"speaker":"David Bianco","startTime":711.41,"endTime":711.41,"body":" "},{"speaker":"David Bianco","startTime":711.41,"endTime":712.878,"body":"Like if we don't present them,"},{"speaker":"David Bianco","startTime":712.878,"endTime":712.878,"body":" "},{"speaker":"David Bianco","startTime":712.878,"endTime":716.348,"body":"they mostly won't know"},{"speaker":"David Bianco","startTime":716.348,"endTime":712.878,"body":" "},{"speaker":"David Bianco","startTime":712.878,"endTime":716.348,"body":"and they won't be able to improve."},{"speaker":"David Bianco","startTime":716.348,"endTime":716.482,"body":" "},{"speaker":"David Bianco","startTime":716.482,"endTime":719.685,"body":"But the more we present the,"},{"speaker":"David Bianco","startTime":719.685,"endTime":716.482,"body":" "},{"speaker":"David Bianco","startTime":716.482,"endTime":719.685,"body":"the more opportunity"},{"speaker":"David Bianco","startTime":719.685,"endTime":719.685,"body":" "},{"speaker":"David Bianco","startTime":719.685,"endTime":722.788,"body":"we're providing to the organization"},{"speaker":"David Bianco","startTime":722.788,"endTime":719.685,"body":" "},{"speaker":"David Bianco","startTime":719.685,"endTime":722.788,"body":"to improve."},{"speaker":"David Bianco","startTime":722.788,"endTime":722.788,"body":" "},{"speaker":"David Bianco","startTime":722.788,"endTime":726.826,"body":"And so our, our PEAK"},{"speaker":"David Bianco","startTime":726.826,"endTime":722.788,"body":" "},{"speaker":"David Bianco","startTime":722.788,"endTime":726.826,"body":"metrics are all built around"},{"speaker":"David Bianco","startTime":726.826,"endTime":726.826,"body":" "},{"speaker":"David Bianco","startTime":726.826,"endTime":730.229,"body":"telling the story of the impact"},{"speaker":"David Bianco","startTime":730.229,"endTime":726.826,"body":" "},{"speaker":"David Bianco","startTime":726.826,"endTime":730.229,"body":"that you've had."},{"speaker":"David Bianco","startTime":730.229,"endTime":730.629,"body":" "},{"speaker":"David Bianco","startTime":730.629,"endTime":735.301,"body":"Sure, some of them are like"},{"speaker":"David Bianco","startTime":735.301,"endTime":730.629,"body":" "},{"speaker":"David Bianco","startTime":730.629,"endTime":735.301,"body":"how many incidents did you open?"},{"speaker":"David Bianco","startTime":735.301,"endTime":735.701,"body":" "},{"speaker":"David Bianco","startTime":735.701,"endTime":739.739,"body":"But key differences might be things like,"},{"speaker":"David Bianco","startTime":739.739,"endTime":735.701,"body":" "},{"speaker":"David Bianco","startTime":735.701,"endTime":739.739,"body":"we're no longer counting"},{"speaker":"David Bianco","startTime":739.739,"endTime":739.739,"body":" "},{"speaker":"David Bianco","startTime":739.739,"endTime":744.276,"body":"only the incidents that you opened"},{"speaker":"David Bianco","startTime":744.276,"endTime":739.739,"body":" "},{"speaker":"David Bianco","startTime":739.739,"endTime":744.276,"body":"during the hunt, but when you developed"},{"speaker":"David Bianco","startTime":744.276,"endTime":744.276,"body":" "},{"speaker":"David Bianco","startTime":744.276,"endTime":748.18,"body":"for example, a new detection"},{"speaker":"David Bianco","startTime":748.18,"endTime":744.276,"body":" "},{"speaker":"David Bianco","startTime":744.276,"endTime":748.18,"body":"mechanism that you automated"},{"speaker":"David Bianco","startTime":748.18,"endTime":748.38,"body":" "},{"speaker":"David Bianco","startTime":748.38,"endTime":751.417,"body":"and then it found a security, issue"},{"speaker":"David Bianco","startTime":751.417,"endTime":752.017,"body":" "},{"speaker":"David Bianco","startTime":752.017,"endTime":756.388,"body":"eight months later, you get to count that"},{"speaker":"David Bianco","startTime":756.388,"endTime":752.017,"body":" "},{"speaker":"David Bianco","startTime":752.017,"endTime":756.388,"body":"because you never would have had that"},{"speaker":"David Bianco","startTime":756.388,"endTime":756.388,"body":" "},{"speaker":"David Bianco","startTime":756.388,"endTime":760.059,"body":"detection in place had you not figured out"},{"speaker":"David Bianco","startTime":760.059,"endTime":756.388,"body":" "},{"speaker":"David Bianco","startTime":756.388,"endTime":760.059,"body":"how to do it during the hunt."},{"speaker":"David Bianco","startTime":760.059,"endTime":760.292,"body":" "},{"speaker":"David Bianco","startTime":760.292,"endTime":762.361,"body":"It's it's really about telling the story."},{"speaker":"David Bianco","startTime":762.361,"endTime":762.361,"body":" "},{"speaker":"David Bianco","startTime":762.361,"endTime":765.264,"body":"And we only have five high level metrics."},{"speaker":"David Bianco","startTime":765.264,"endTime":765.264,"body":" "},{"speaker":"David Bianco","startTime":765.264,"endTime":770.803,"body":"So it's actually really easy usually"},{"speaker":"David Bianco","startTime":770.803,"endTime":765.264,"body":" "},{"speaker":"David Bianco","startTime":765.264,"endTime":770.803,"body":"to start collecting those metrics."},{"speaker":"David Bianco","startTime":770.803,"endTime":770.803,"body":" "},{"speaker":"David Bianco","startTime":770.803,"endTime":775.841,"body":"So those are the two places if you're zero"},{"speaker":"David Bianco","startTime":775.841,"endTime":770.803,"body":" "},{"speaker":"David Bianco","startTime":770.803,"endTime":775.841,"body":"hunt or close to zero hunt capability."},{"speaker":"David Bianco","startTime":775.841,"endTime":776.041,"body":" "},{"speaker":"David Bianco","startTime":776.041,"endTime":781.514,"body":"Start with hypothesis based hunting with"},{"speaker":"David Bianco","startTime":781.514,"endTime":776.041,"body":" "},{"speaker":"David Bianco","startTime":776.041,"endTime":781.514,"body":"the defined processes in the framework."},{"speaker":"David Bianco","startTime":781.514,"endTime":781.847,"body":" "},{"speaker":"David Bianco","startTime":781.847,"endTime":785.551,"body":"And if you already have a functioning"},{"speaker":"David Bianco","startTime":785.551,"endTime":781.847,"body":" "},{"speaker":"David Bianco","startTime":781.847,"endTime":785.551,"body":"hunt program, maybe consider"},{"speaker":"David Bianco","startTime":785.551,"endTime":785.551,"body":" "},{"speaker":"David Bianco","startTime":785.551,"endTime":789.221,"body":"starting with the metrics"},{"speaker":"David Bianco","startTime":789.221,"endTime":785.551,"body":" "},{"speaker":"David Bianco","startTime":785.551,"endTime":789.221,"body":"to show the impact that you're having."},{"speaker":"David Bianco","startTime":789.221,"endTime":789.522,"body":" "},{"speaker":"Amy Ciminnisi","startTime":789.522,"endTime":791.791,"body":"Yeah really smart moves there."},{"speaker":"Amy Ciminnisi","startTime":791.791,"endTime":791.791,"body":" "},{"speaker":"Amy Ciminnisi","startTime":791.791,"endTime":796.195,"body":"So one of the reasons why I invited you on"},{"speaker":"Amy Ciminnisi","startTime":796.195,"endTime":791.791,"body":" "},{"speaker":"Amy Ciminnisi","startTime":791.791,"endTime":796.195,"body":"was because the search team"},{"speaker":"Amy Ciminnisi","startTime":796.195,"endTime":796.195,"body":" "},{"speaker":"Amy Ciminnisi","startTime":796.195,"endTime":799.732,"body":"recently came out with the peak"},{"speaker":"Amy Ciminnisi","startTime":799.732,"endTime":796.195,"body":" "},{"speaker":"Amy Ciminnisi","startTime":796.195,"endTime":799.732,"body":"threat hunting assistant."},{"speaker":"Amy Ciminnisi","startTime":799.732,"endTime":800.166,"body":" "},{"speaker":"Amy Ciminnisi","startTime":800.166,"endTime":801.967,"body":"Can you talk a little bit about that?"},{"speaker":"Amy Ciminnisi","startTime":801.967,"endTime":801.967,"body":" "},{"speaker":"Amy Ciminnisi","startTime":801.967,"endTime":804.036,"body":"What inspired you guys to create it?"},{"speaker":"Amy Ciminnisi","startTime":804.036,"endTime":804.036,"body":" "},{"speaker":"David Bianco","startTime":804.036,"endTime":805.204,"body":"Yeah, absolutely."},{"speaker":"David Bianco","startTime":805.204,"endTime":805.204,"body":" "},{"speaker":"David Bianco","startTime":805.204,"endTime":809.408,"body":"So the the peak framework to back up"},{"speaker":"David Bianco","startTime":809.408,"endTime":805.204,"body":" "},{"speaker":"David Bianco","startTime":805.204,"endTime":809.408,"body":"slightly has nothing in it"},{"speaker":"David Bianco","startTime":809.408,"endTime":809.408,"body":" "},{"speaker":"David Bianco","startTime":809.408,"endTime":813.212,"body":"about AI or agents or actually"},{"speaker":"David Bianco","startTime":813.212,"endTime":813.212,"body":" "},{"speaker":"David Bianco","startTime":813.212,"endTime":816.182,"body":"any specific products or whatever."},{"speaker":"David Bianco","startTime":816.182,"endTime":816.182,"body":" "},{"speaker":"David Bianco","startTime":816.182,"endTime":820.119,"body":"I mean, it is designed to be general,"},{"speaker":"David Bianco","startTime":820.119,"endTime":816.182,"body":" "},{"speaker":"David Bianco","startTime":816.182,"endTime":820.119,"body":"any organization"},{"speaker":"David Bianco","startTime":820.119,"endTime":820.119,"body":" "},{"speaker":"David Bianco","startTime":820.119,"endTime":823.189,"body":"can use it on any technology stack, etc."},{"speaker":"David Bianco","startTime":823.189,"endTime":823.322,"body":" "},{"speaker":"David Bianco","startTime":823.322,"endTime":824.757,"body":"and it is human driven."},{"speaker":"David Bianco","startTime":824.757,"endTime":824.757,"body":" "},{"speaker":"David Bianco","startTime":824.757,"endTime":827.927,"body":"But one of the things that our search team"},{"speaker":"David Bianco","startTime":827.927,"endTime":827.927,"body":" "},{"speaker":"David Bianco","startTime":827.927,"endTime":831.831,"body":"has been heavily involved in for years now"},{"speaker":"David Bianco","startTime":831.831,"endTime":832.198,"body":" "},{"speaker":"David Bianco","startTime":832.198,"endTime":836.268,"body":"is, research about how to effectively"},{"speaker":"David Bianco","startTime":836.268,"endTime":836.268,"body":" "},{"speaker":"David Bianco","startTime":836.268,"endTime":841.674,"body":"use AI in security"},{"speaker":"David Bianco","startTime":841.674,"endTime":836.268,"body":" "},{"speaker":"David Bianco","startTime":836.268,"endTime":841.674,"body":"rather than just throwing AI into the mix"},{"speaker":"David Bianco","startTime":841.674,"endTime":842.241,"body":" "},{"speaker":"David Bianco","startTime":842.241,"endTime":846.378,"body":"randomly and hoping it"},{"speaker":"David Bianco","startTime":846.378,"endTime":842.241,"body":" "},{"speaker":"David Bianco","startTime":842.241,"endTime":846.378,"body":"somehow magically improves things."},{"speaker":"David Bianco","startTime":846.378,"endTime":846.779,"body":" "},{"speaker":"David Bianco","startTime":846.779,"endTime":848.781,"body":"And doesn't break anything. Right?"},{"speaker":"David Bianco","startTime":848.781,"endTime":848.781,"body":" "},{"speaker":"David Bianco","startTime":848.781,"endTime":850.482,"body":"It doesn't break anything."},{"speaker":"David Bianco","startTime":850.482,"endTime":850.482,"body":" "},{"speaker":"David Bianco","startTime":850.482,"endTime":854.019,"body":"Now we have, a lot of research"},{"speaker":"David Bianco","startTime":854.019,"endTime":850.482,"body":" "},{"speaker":"David Bianco","startTime":850.482,"endTime":854.019,"body":"that we've published"},{"speaker":"David Bianco","startTime":854.019,"endTime":854.019,"body":" "},{"speaker":"David Bianco","startTime":854.019,"endTime":859.692,"body":"about how to do that kind of thing"},{"speaker":"David Bianco","startTime":859.692,"endTime":854.019,"body":" "},{"speaker":"David Bianco","startTime":854.019,"endTime":859.692,"body":"effectively and safely."},{"speaker":"David Bianco","startTime":859.692,"endTime":859.859,"body":" "},{"speaker":"David Bianco","startTime":859.859,"endTime":863.429,"body":"Let's be honest, we've we've come up"},{"speaker":"David Bianco","startTime":863.429,"endTime":859.859,"body":" "},{"speaker":"David Bianco","startTime":859.859,"endTime":863.429,"body":"with a number of key guidelines."},{"speaker":"David Bianco","startTime":863.429,"endTime":863.429,"body":" "},{"speaker":"David Bianco","startTime":863.429,"endTime":866.966,"body":"The most important one"},{"speaker":"David Bianco","startTime":866.966,"endTime":863.429,"body":" "},{"speaker":"David Bianco","startTime":863.429,"endTime":866.966,"body":"is human in the loop at all times."},{"speaker":"David Bianco","startTime":866.966,"endTime":867.333,"body":" "},{"speaker":"David Bianco","startTime":867.333,"endTime":873.138,"body":"You can give some autonomy or some agency"},{"speaker":"David Bianco","startTime":873.138,"endTime":867.333,"body":" "},{"speaker":"David Bianco","startTime":867.333,"endTime":873.138,"body":"to your AI systems, but not too much."},{"speaker":"David Bianco","startTime":873.138,"endTime":873.606,"body":" "},{"speaker":"David Bianco","startTime":873.606,"endTime":876.742,"body":"You want them to be able"},{"speaker":"David Bianco","startTime":876.742,"endTime":873.606,"body":" "},{"speaker":"David Bianco","startTime":873.606,"endTime":876.742,"body":"to do things for you, but you don't"},{"speaker":"David Bianco","startTime":876.742,"endTime":876.742,"body":" "},{"speaker":"David Bianco","startTime":876.742,"endTime":880.112,"body":"want them to be able to go out of control"},{"speaker":"David Bianco","startTime":880.112,"endTime":876.742,"body":" "},{"speaker":"David Bianco","startTime":876.742,"endTime":880.112,"body":"and making that balance."},{"speaker":"David Bianco","startTime":880.112,"endTime":880.312,"body":" "},{"speaker":"David Bianco","startTime":880.312,"endTime":882.248,"body":"Is, is very critical."},{"speaker":"David Bianco","startTime":882.248,"endTime":882.248,"body":" "},{"speaker":"David Bianco","startTime":882.248,"endTime":885.384,"body":"So the human is the most important thing"},{"speaker":"David Bianco","startTime":885.384,"endTime":882.248,"body":" "},{"speaker":"David Bianco","startTime":882.248,"endTime":885.384,"body":"in that loop."},{"speaker":"David Bianco","startTime":885.384,"endTime":885.384,"body":" "},{"speaker":"David Bianco","startTime":885.384,"endTime":888.988,"body":"And also threat"},{"speaker":"David Bianco","startTime":888.988,"endTime":885.384,"body":" "},{"speaker":"David Bianco","startTime":885.384,"endTime":888.988,"body":"hunting is defined as human-driven."},{"speaker":"David Bianco","startTime":888.988,"endTime":889.288,"body":" "},{"speaker":"David Bianco","startTime":889.288,"endTime":893.559,"body":"So the human has to drive it even though"},{"speaker":"David Bianco","startTime":893.559,"endTime":889.288,"body":" "},{"speaker":"David Bianco","startTime":889.288,"endTime":893.559,"body":"they can use the AI to help them."},{"speaker":"David Bianco","startTime":893.559,"endTime":893.792,"body":" "},{"speaker":"David Bianco","startTime":893.792,"endTime":897.563,"body":"But some of the other things"},{"speaker":"David Bianco","startTime":897.563,"endTime":893.792,"body":" "},{"speaker":"David Bianco","startTime":893.792,"endTime":897.563,"body":"that we uncovered in our research"},{"speaker":"David Bianco","startTime":897.563,"endTime":897.563,"body":" "},{"speaker":"David Bianco","startTime":897.563,"endTime":901.6,"body":"is the, like general approaches"},{"speaker":"David Bianco","startTime":901.6,"endTime":897.563,"body":" "},{"speaker":"David Bianco","startTime":897.563,"endTime":901.6,"body":"that you might think are kind of"},{"speaker":"David Bianco","startTime":901.6,"endTime":901.6,"body":" "},{"speaker":"David Bianco","startTime":901.6,"endTime":905.604,"body":"a common sense,"},{"speaker":"David Bianco","startTime":905.604,"endTime":901.6,"body":" "},{"speaker":"David Bianco","startTime":901.6,"endTime":905.604,"body":"like find your big pain points,"},{"speaker":"David Bianco","startTime":905.604,"endTime":905.604,"body":" "},{"speaker":"David Bianco","startTime":905.604,"endTime":909.208,"body":"probably the repeated things"},{"speaker":"David Bianco","startTime":909.208,"endTime":905.604,"body":" "},{"speaker":"David Bianco","startTime":905.604,"endTime":909.208,"body":"in your core workflows,"},{"speaker":"David Bianco","startTime":909.208,"endTime":909.642,"body":" "},{"speaker":"David Bianco","startTime":909.642,"endTime":914.246,"body":"and figure out what AI is actually good at"},{"speaker":"David Bianco","startTime":914.246,"endTime":909.642,"body":" "},{"speaker":"David Bianco","startTime":909.642,"endTime":914.246,"body":"and then match those up."},{"speaker":"David Bianco","startTime":914.246,"endTime":914.613,"body":" "},{"speaker":"David Bianco","startTime":914.613,"endTime":919.551,"body":"We wanted to try out"},{"speaker":"David Bianco","startTime":919.551,"endTime":914.613,"body":" "},{"speaker":"David Bianco","startTime":914.613,"endTime":919.551,"body":"some of the things that"},{"speaker":"David Bianco","startTime":919.551,"endTime":919.752,"body":" "},{"speaker":"David Bianco","startTime":919.752,"endTime":922.988,"body":"that we had been uncovering"},{"speaker":"David Bianco","startTime":922.988,"endTime":919.752,"body":" "},{"speaker":"David Bianco","startTime":919.752,"endTime":922.988,"body":"in our research and writing about."},{"speaker":"David Bianco","startTime":922.988,"endTime":922.988,"body":" "},{"speaker":"David Bianco","startTime":922.988,"endTime":925.557,"body":"So we actually had a couple of different"},{"speaker":"David Bianco","startTime":925.557,"endTime":922.988,"body":" "},{"speaker":"David Bianco","startTime":922.988,"endTime":925.557,"body":"things come out."},{"speaker":"David Bianco","startTime":925.557,"endTime":925.557,"body":" "},{"speaker":"David Bianco","startTime":925.557,"endTime":931.163,"body":"We also had an LLM honeypot"},{"speaker":"David Bianco","startTime":931.163,"endTime":925.557,"body":" "},{"speaker":"David Bianco","startTime":925.557,"endTime":931.163,"body":"that used LLMs to simulate systems"},{"speaker":"David Bianco","startTime":931.163,"endTime":931.163,"body":" "},{"speaker":"David Bianco","startTime":931.163,"endTime":935.067,"body":"rather than a honeypot to simulate an L"},{"speaker":"David Bianco","startTime":935.067,"endTime":931.173,"body":" "},{"speaker":"David Bianco","startTime":931.173,"endTime":935.067,"body":"LM,"},{"speaker":"David Bianco","startTime":935.067,"endTime":931.163,"body":" "},{"speaker":"David Bianco","startTime":931.163,"endTime":935.067,"body":"and then that kind of proved it out"},{"speaker":"David Bianco","startTime":935.067,"endTime":935.067,"body":" "},{"speaker":"David Bianco","startTime":935.067,"endTime":936.302,"body":"for like straight up,"},{"speaker":"David Bianco","startTime":936.302,"endTime":936.302,"body":" "},{"speaker":"David Bianco","startTime":936.302,"endTime":940.272,"body":"I kind of I'm going to make a request"},{"speaker":"David Bianco","startTime":940.272,"endTime":936.302,"body":" "},{"speaker":"David Bianco","startTime":936.302,"endTime":940.272,"body":"and get a response and kind of things."},{"speaker":"David Bianco","startTime":940.272,"endTime":940.272,"body":" "},{"speaker":"David Bianco","startTime":940.272,"endTime":944.31,"body":"But when we started"},{"speaker":"David Bianco","startTime":944.31,"endTime":940.272,"body":" "},{"speaker":"David Bianco","startTime":940.272,"endTime":944.31,"body":"going more into agents,"},{"speaker":"David Bianco","startTime":944.31,"endTime":944.31,"body":" "},{"speaker":"David Bianco","startTime":944.31,"endTime":946.912,"body":"we needed to do the same thing again."},{"speaker":"David Bianco","startTime":946.912,"endTime":946.912,"body":" "},{"speaker":"David Bianco","startTime":946.912,"endTime":951.884,"body":"One of the big things with threat"},{"speaker":"David Bianco","startTime":951.884,"endTime":946.912,"body":" "},{"speaker":"David Bianco","startTime":946.912,"endTime":951.884,"body":"hunting is a lot of hunters"},{"speaker":"David Bianco","startTime":951.884,"endTime":952.184,"body":" "},{"speaker":"David Bianco","startTime":952.184,"endTime":957.456,"body":"like to jump right into the data analysis"},{"speaker":"David Bianco","startTime":957.456,"endTime":952.184,"body":" "},{"speaker":"David Bianco","startTime":952.184,"endTime":957.456,"body":"without doing a proper plan"},{"speaker":"David Bianco","startTime":957.456,"endTime":957.456,"body":" "},{"speaker":"David Bianco","startTime":957.456,"endTime":961.16,"body":"for sometimes without even doing any plan,"},{"speaker":"David Bianco","startTime":961.16,"endTime":957.456,"body":" "},{"speaker":"David Bianco","startTime":957.456,"endTime":961.16,"body":"just going to go out there"},{"speaker":"David Bianco","startTime":961.16,"endTime":961.46,"body":" "},{"speaker":"David Bianco","startTime":961.46,"endTime":964.496,"body":"and look at some data"},{"speaker":"David Bianco","startTime":964.496,"endTime":961.46,"body":" "},{"speaker":"David Bianco","startTime":961.46,"endTime":964.496,"body":"and see what I can find."},{"speaker":"David Bianco","startTime":964.496,"endTime":964.697,"body":" "},{"speaker":"David Bianco","startTime":964.697,"endTime":966.932,"body":"You're setting yourself up for failures."},{"speaker":"David Bianco","startTime":966.932,"endTime":966.932,"body":" "},{"speaker":"David Bianco","startTime":966.932,"endTime":971.37,"body":"The best way to ensure the success"},{"speaker":"David Bianco","startTime":971.37,"endTime":966.932,"body":" "},{"speaker":"David Bianco","startTime":966.932,"endTime":971.37,"body":"for your hunt is to do a good a good plan."},{"speaker":"David Bianco","startTime":971.37,"endTime":971.537,"body":" "},{"speaker":"David Bianco","startTime":971.537,"endTime":975.307,"body":"But a good plan can take a long time,"},{"speaker":"David Bianco","startTime":975.307,"endTime":971.537,"body":" "},{"speaker":"David Bianco","startTime":971.537,"endTime":975.307,"body":"maybe days"},{"speaker":"David Bianco","startTime":975.307,"endTime":975.708,"body":" "},{"speaker":"David Bianco","startTime":975.708,"endTime":978.31,"body":"or possibly longer, right?"},{"speaker":"David Bianco","startTime":978.31,"endTime":978.31,"body":" "},{"speaker":"David Bianco","startTime":978.31,"endTime":982.648,"body":"So I looked at the frameworks"},{"speaker":"David Bianco","startTime":982.648,"endTime":978.31,"body":" "},{"speaker":"David Bianco","startTime":978.31,"endTime":982.648,"body":"process diagram for hypothesis"},{"speaker":"David Bianco","startTime":982.648,"endTime":982.648,"body":" "},{"speaker":"David Bianco","startTime":982.648,"endTime":986.852,"body":"space threat hunting and I thought, well,"},{"speaker":"David Bianco","startTime":986.852,"endTime":982.648,"body":" "},{"speaker":"David Bianco","startTime":982.648,"endTime":986.852,"body":"this part is the big pain point."},{"speaker":"David Bianco","startTime":986.852,"endTime":987.086,"body":" "},{"speaker":"David Bianco","startTime":987.086,"endTime":989.021,"body":"It takes a lot of time."},{"speaker":"David Bianco","startTime":989.021,"endTime":989.021,"body":" "},{"speaker":"David Bianco","startTime":989.021,"endTime":993.092,"body":"So much time that people skip it"},{"speaker":"David Bianco","startTime":993.092,"endTime":989.021,"body":" "},{"speaker":"David Bianco","startTime":989.021,"endTime":993.092,"body":"or don't do it very well."},{"speaker":"David Bianco","startTime":993.092,"endTime":993.092,"body":" "},{"speaker":"David Bianco","startTime":993.092,"endTime":996.495,"body":"Maybe, they skimp on it,"},{"speaker":"David Bianco","startTime":996.495,"endTime":993.092,"body":" "},{"speaker":"David Bianco","startTime":993.092,"endTime":996.495,"body":"but it's something"},{"speaker":"David Bianco","startTime":996.495,"endTime":996.495,"body":" "},{"speaker":"David Bianco","startTime":996.495,"endTime":999.498,"body":"that really matches"},{"speaker":"David Bianco","startTime":999.498,"endTime":996.495,"body":" "},{"speaker":"David Bianco","startTime":996.495,"endTime":999.498,"body":"well with AI's strengths."},{"speaker":"David Bianco","startTime":999.498,"endTime":999.898,"body":" "},{"speaker":"David Bianco","startTime":999.898,"endTime":1004.603,"body":"So it just became a matter of like,"},{"speaker":"David Bianco","startTime":1004.603,"endTime":999.898,"body":" "},{"speaker":"David Bianco","startTime":999.898,"endTime":1004.603,"body":"how would we want this workflow to work"},{"speaker":"David Bianco","startTime":1004.603,"endTime":1004.636,"body":" "},{"speaker":"David Bianco","startTime":1004.636,"endTime":1007.673,"body":"if it was AI assisted but human driven?"},{"speaker":"David Bianco","startTime":1007.673,"endTime":1008.107,"body":" "},{"speaker":"David Bianco","startTime":1008.107,"endTime":1011.01,"body":"And so that's what the Peak"},{"speaker":"David Bianco","startTime":1011.01,"endTime":1008.107,"body":" "},{"speaker":"David Bianco","startTime":1008.107,"endTime":1011.01,"body":"Assistant actually does."},{"speaker":"David Bianco","startTime":1011.01,"endTime":1011.01,"body":" "},{"speaker":"David Bianco","startTime":1011.01,"endTime":1011.477,"body":"Right?"},{"speaker":"David Bianco","startTime":1011.477,"endTime":1011.477,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1011.477,"endTime":1015.014,"body":"So how do people actually"},{"speaker":"Amy Ciminnisi","startTime":1015.014,"endTime":1011.477,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1011.477,"endTime":1015.014,"body":"go about using it?"},{"speaker":"Amy Ciminnisi","startTime":1015.014,"endTime":1015.714,"body":" "},{"speaker":"David Bianco","startTime":1015.714,"endTime":1018.984,"body":"The easiest way to use it,"},{"speaker":"David Bianco","startTime":1018.984,"endTime":1015.714,"body":" "},{"speaker":"David Bianco","startTime":1015.714,"endTime":1018.984,"body":"it's an open source."},{"speaker":"David Bianco","startTime":1018.984,"endTime":1018.984,"body":" "},{"speaker":"David Bianco","startTime":1018.984,"endTime":1021.387,"body":"So you can download it from GitHub."},{"speaker":"David Bianco","startTime":1021.387,"endTime":1021.387,"body":" "},{"speaker":"David Bianco","startTime":1021.387,"endTime":1024.023,"body":"And and it's a"},{"speaker":"David Bianco","startTime":1024.023,"endTime":1021.387,"body":" "},{"speaker":"David Bianco","startTime":1021.387,"endTime":1024.023,"body":"we call it a bring your own model."},{"speaker":"David Bianco","startTime":1024.023,"endTime":1024.023,"body":" "},{"speaker":"David Bianco","startTime":1024.023,"endTime":1028.66,"body":"So you can hook up any Lims in the back"},{"speaker":"David Bianco","startTime":1028.66,"endTime":1024.023,"body":" "},{"speaker":"David Bianco","startTime":1024.023,"endTime":1028.66,"body":"end that you want."},{"speaker":"David Bianco","startTime":1028.66,"endTime":1028.894,"body":" "},{"speaker":"David Bianco","startTime":1028.894,"endTime":1032.131,"body":"We've tested it"},{"speaker":"David Bianco","startTime":1032.131,"endTime":1028.894,"body":" "},{"speaker":"David Bianco","startTime":1028.894,"endTime":1032.131,"body":"with all the frontier models."},{"speaker":"David Bianco","startTime":1032.131,"endTime":1032.164,"body":" "},{"speaker":"David Bianco","startTime":1032.164,"endTime":1035.667,"body":"You know, OpenAI and anthropic and those,"},{"speaker":"David Bianco","startTime":1035.667,"endTime":1035.968,"body":" "},{"speaker":"David Bianco","startTime":1035.968,"endTime":1038.837,"body":"but also you can run it"},{"speaker":"David Bianco","startTime":1038.837,"endTime":1035.968,"body":" "},{"speaker":"David Bianco","startTime":1035.968,"endTime":1038.837,"body":"with, local models."},{"speaker":"David Bianco","startTime":1038.837,"endTime":1038.837,"body":" "},{"speaker":"David Bianco","startTime":1038.837,"endTime":1043.809,"body":"So, foundation"},{"speaker":"David Bianco","startTime":1043.809,"endTime":1038.837,"body":" "},{"speaker":"David Bianco","startTime":1038.837,"endTime":1043.809,"body":"AI has our own foundation seq land"},{"speaker":"David Bianco","startTime":1043.809,"endTime":1043.809,"body":" "},{"speaker":"David Bianco","startTime":1043.809,"endTime":1048.013,"body":"that's tuned for cyber security tasks,"},{"speaker":"David Bianco","startTime":1048.013,"endTime":1043.809,"body":" "},{"speaker":"David Bianco","startTime":1043.809,"endTime":1048.013,"body":"which works great in some parts of those."},{"speaker":"David Bianco","startTime":1048.013,"endTime":1048.514,"body":" "},{"speaker":"David Bianco","startTime":1048.514,"endTime":1052.317,"body":"Each of those little tasks"},{"speaker":"David Bianco","startTime":1052.317,"endTime":1048.514,"body":" "},{"speaker":"David Bianco","startTime":1048.514,"endTime":1052.317,"body":"has its own agent or sub agent."},{"speaker":"David Bianco","startTime":1052.317,"endTime":1052.317,"body":" "},{"speaker":"David Bianco","startTime":1052.317,"endTime":1056.722,"body":"So you could actually mix models"},{"speaker":"David Bianco","startTime":1056.722,"endTime":1052.317,"body":" "},{"speaker":"David Bianco","startTime":1052.317,"endTime":1056.722,"body":"to see who's doing better at which ones."},{"speaker":"David Bianco","startTime":1056.722,"endTime":1056.722,"body":" "},{"speaker":"David Bianco","startTime":1056.722,"endTime":1058.524,"body":"But you really don't have to."},{"speaker":"David Bianco","startTime":1058.524,"endTime":1058.524,"body":" "},{"speaker":"David Bianco","startTime":1058.524,"endTime":1063.262,"body":"You can just say, hey, we're going to use"},{"speaker":"David Bianco","startTime":1063.262,"endTime":1058.524,"body":" "},{"speaker":"David Bianco","startTime":1058.524,"endTime":1063.262,"body":"all Claud, or we're going to use all GPT"},{"speaker":"David Bianco","startTime":1063.262,"endTime":1064.463,"body":" "},{"speaker":"David Bianco","startTime":1064.463,"endTime":1066.465,"body":"five or, you know, whatever you want."},{"speaker":"David Bianco","startTime":1066.465,"endTime":1066.465,"body":" "},{"speaker":"David Bianco","startTime":1066.465,"endTime":1068.667,"body":"And then when you run it"},{"speaker":"David Bianco","startTime":1068.667,"endTime":1066.465,"body":" "},{"speaker":"David Bianco","startTime":1066.465,"endTime":1068.667,"body":"on your system, the"},{"speaker":"David Bianco","startTime":1068.667,"endTime":1068.667,"body":" "},{"speaker":"David Bianco","startTime":1068.667,"endTime":1072.237,"body":"the default interface is a local web app."},{"speaker":"David Bianco","startTime":1072.237,"endTime":1072.938,"body":" "},{"speaker":"David Bianco","startTime":1072.938,"endTime":1076.809,"body":"So you can easily"},{"speaker":"David Bianco","startTime":1076.809,"endTime":1072.938,"body":" "},{"speaker":"David Bianco","startTime":1072.938,"endTime":1076.809,"body":"then go through and it gives you a chat"},{"speaker":"David Bianco","startTime":1076.809,"endTime":1076.809,"body":" "},{"speaker":"David Bianco","startTime":1076.809,"endTime":1078.31,"body":"kind of based interface"},{"speaker":"David Bianco","startTime":1078.31,"endTime":1078.31,"body":" "},{"speaker":"David Bianco","startTime":1078.31,"endTime":1081.68,"body":"for most of those things that you have"},{"speaker":"David Bianco","startTime":1081.68,"endTime":1078.31,"body":" "},{"speaker":"David Bianco","startTime":1078.31,"endTime":1081.68,"body":"to go through for preparation,"},{"speaker":"David Bianco","startTime":1081.68,"endTime":1082.081,"body":" "},{"speaker":"David Bianco","startTime":1082.081,"endTime":1085.818,"body":"you can start by telling it,"},{"speaker":"David Bianco","startTime":1085.818,"endTime":1082.081,"body":" "},{"speaker":"David Bianco","startTime":1082.081,"endTime":1085.818,"body":"hey, I'm interested in hunting"},{"speaker":"David Bianco","startTime":1085.818,"endTime":1085.818,"body":" "},{"speaker":"David Bianco","startTime":1085.818,"endTime":1090.556,"body":"for Kerberos staging,"},{"speaker":"David Bianco","startTime":1090.556,"endTime":1085.818,"body":" "},{"speaker":"David Bianco","startTime":1085.818,"endTime":1090.556,"body":"or I'm interested in hunting for,"},{"speaker":"David Bianco","startTime":1090.556,"endTime":1090.556,"body":" "},{"speaker":"David Bianco","startTime":1090.556,"endTime":1094.726,"body":"I don't know, log in anomalies"},{"speaker":"David Bianco","startTime":1094.726,"endTime":1090.556,"body":" "},{"speaker":"David Bianco","startTime":1090.556,"endTime":1094.726,"body":"or I am interested in hunting for,"},{"speaker":"David Bianco","startTime":1094.726,"endTime":1094.86,"body":" "},{"speaker":"David Bianco","startTime":1094.86,"endTime":1098.931,"body":"lapses or whatever,"},{"speaker":"David Bianco","startTime":1098.931,"endTime":1094.86,"body":" "},{"speaker":"David Bianco","startTime":1094.86,"endTime":1098.931,"body":"and it will go out and do the research"},{"speaker":"David Bianco","startTime":1098.931,"endTime":1098.931,"body":" "},{"speaker":"David Bianco","startTime":1098.931,"endTime":1104.002,"body":"with the addition of MXGp servers"},{"speaker":"David Bianco","startTime":1104.002,"endTime":1098.931,"body":" "},{"speaker":"David Bianco","startTime":1098.931,"endTime":1104.002,"body":"for your local environment."},{"speaker":"David Bianco","startTime":1104.002,"endTime":1104.002,"body":" "},{"speaker":"David Bianco","startTime":1104.002,"endTime":1107.606,"body":"It can actually also do the research"},{"speaker":"David Bianco","startTime":1107.606,"endTime":1104.002,"body":" "},{"speaker":"David Bianco","startTime":1104.002,"endTime":1107.606,"body":"in your local environment,"},{"speaker":"David Bianco","startTime":1107.606,"endTime":1107.973,"body":" "},{"speaker":"David Bianco","startTime":1107.973,"endTime":1109.942,"body":"but does that in a separate agent team."},{"speaker":"David Bianco","startTime":1109.942,"endTime":1109.942,"body":" "},{"speaker":"David Bianco","startTime":1109.942,"endTime":1113.178,"body":"So it's careful not to accidentally mix"},{"speaker":"David Bianco","startTime":1113.178,"endTime":1113.178,"body":" "},{"speaker":"David Bianco","startTime":1113.178,"endTime":1117.082,"body":"in local information"},{"speaker":"David Bianco","startTime":1117.082,"endTime":1113.178,"body":" "},{"speaker":"David Bianco","startTime":1113.178,"endTime":1117.082,"body":"in your internet searches and leak data."},{"speaker":"David Bianco","startTime":1117.082,"endTime":1117.082,"body":" "},{"speaker":"David Bianco","startTime":1117.082,"endTime":1117.616,"body":"Right."},{"speaker":"David Bianco","startTime":1117.616,"endTime":1117.616,"body":" "},{"speaker":"David Bianco","startTime":1117.616,"endTime":1121.253,"body":"And it and it'll lead you through the,"},{"speaker":"David Bianco","startTime":1121.253,"endTime":1117.616,"body":" "},{"speaker":"David Bianco","startTime":1117.616,"endTime":1121.253,"body":"the whole process."},{"speaker":"David Bianco","startTime":1121.253,"endTime":1121.253,"body":" "},{"speaker":"David Bianco","startTime":1121.253,"endTime":1123.956,"body":"But at any given time"},{"speaker":"David Bianco","startTime":1123.956,"endTime":1121.253,"body":" "},{"speaker":"David Bianco","startTime":1121.253,"endTime":1123.956,"body":"you have a little chat interface."},{"speaker":"David Bianco","startTime":1123.956,"endTime":1123.956,"body":" "},{"speaker":"David Bianco","startTime":1123.956,"endTime":1127.326,"body":"So you can ask it questions,"},{"speaker":"David Bianco","startTime":1127.326,"endTime":1123.956,"body":" "},{"speaker":"David Bianco","startTime":1123.956,"endTime":1127.326,"body":"you can give it feedback,"},{"speaker":"David Bianco","startTime":1127.326,"endTime":1127.326,"body":" "},{"speaker":"David Bianco","startTime":1127.326,"endTime":1131.53,"body":"you can correct it, you can tell it"},{"speaker":"David Bianco","startTime":1131.53,"endTime":1127.326,"body":" "},{"speaker":"David Bianco","startTime":1127.326,"endTime":1131.53,"body":"generally what you want to do."},{"speaker":"David Bianco","startTime":1131.53,"endTime":1131.53,"body":" "},{"speaker":"David Bianco","startTime":1131.53,"endTime":1134.633,"body":"Oh, hey, you forgot that"},{"speaker":"David Bianco","startTime":1134.633,"endTime":1131.53,"body":" "},{"speaker":"David Bianco","startTime":1131.53,"endTime":1134.633,"body":"I have some Linux servers."},{"speaker":"David Bianco","startTime":1134.633,"endTime":1134.666,"body":" "},{"speaker":"David Bianco","startTime":1134.666,"endTime":1137.703,"body":"Add those in and it will go out"},{"speaker":"David Bianco","startTime":1137.703,"endTime":1134.666,"body":" "},{"speaker":"David Bianco","startTime":1134.666,"endTime":1137.703,"body":"and, you know, do"},{"speaker":"David Bianco","startTime":1137.703,"endTime":1137.703,"body":" "},{"speaker":"David Bianco","startTime":1137.703,"endTime":1141.306,"body":"extra research or revise the plan"},{"speaker":"David Bianco","startTime":1141.306,"endTime":1137.703,"body":" "},{"speaker":"David Bianco","startTime":1137.703,"endTime":1141.306,"body":"or whatever you need to do."},{"speaker":"David Bianco","startTime":1141.306,"endTime":1141.707,"body":" "},{"speaker":"David Bianco","startTime":1141.707,"endTime":1145.978,"body":"It even has, which is one"},{"speaker":"David Bianco","startTime":1145.978,"endTime":1141.707,"body":" "},{"speaker":"David Bianco","startTime":1141.707,"endTime":1145.978,"body":"I think is one of the coolest functions."},{"speaker":"David Bianco","startTime":1145.978,"endTime":1146.311,"body":" "},{"speaker":"David Bianco","startTime":1146.311,"endTime":1149.882,"body":"If you provided"},{"speaker":"David Bianco","startTime":1149.882,"endTime":1146.311,"body":" "},{"speaker":"David Bianco","startTime":1146.311,"endTime":1149.882,"body":"an, an MCP server into your SIM,"},{"speaker":"David Bianco","startTime":1149.882,"endTime":1150.616,"body":" "},{"speaker":"David Bianco","startTime":1150.616,"endTime":1154.253,"body":"it can understand what data is in your"},{"speaker":"David Bianco","startTime":1154.253,"endTime":1154.253,"body":" "},{"speaker":"David Bianco","startTime":1154.253,"endTime":1157.256,"body":"SIM that would be relevant to your hunt."},{"speaker":"David Bianco","startTime":1157.256,"endTime":1157.689,"body":" "},{"speaker":"David Bianco","startTime":1157.689,"endTime":1163.195,"body":"Identify like if it's, you know, use"},{"speaker":"David Bianco","startTime":1163.195,"endTime":1157.689,"body":" "},{"speaker":"David Bianco","startTime":1157.689,"endTime":1163.195,"body":"we test a lot with Splunk of course."},{"speaker":"David Bianco","startTime":1163.195,"endTime":1163.195,"body":" "},{"speaker":"David Bianco","startTime":1163.195,"endTime":1167.699,"body":"So which indexes are relevant,"},{"speaker":"David Bianco","startTime":1167.699,"endTime":1163.195,"body":" "},{"speaker":"David Bianco","startTime":1163.195,"endTime":1167.699,"body":"which source types"},{"speaker":"David Bianco","startTime":1167.699,"endTime":1167.699,"body":" "},{"speaker":"David Bianco","startTime":1167.699,"endTime":1171.136,"body":"in those indexes like the types of records"},{"speaker":"David Bianco","startTime":1171.136,"endTime":1167.699,"body":" "},{"speaker":"David Bianco","startTime":1167.699,"endTime":1171.136,"body":"that are in there."},{"speaker":"David Bianco","startTime":1171.136,"endTime":1171.803,"body":" "},{"speaker":"David Bianco","startTime":1171.803,"endTime":1174.54,"body":"And then even the key fields"},{"speaker":"David Bianco","startTime":1174.54,"endTime":1171.803,"body":" "},{"speaker":"David Bianco","startTime":1171.803,"endTime":1174.54,"body":"that are going to be relevant."},{"speaker":"David Bianco","startTime":1174.54,"endTime":1174.54,"body":" "},{"speaker":"David Bianco","startTime":1174.54,"endTime":1177.643,"body":"So it will tailor the hunt plan"},{"speaker":"David Bianco","startTime":1177.643,"endTime":1178.243,"body":" "},{"speaker":"David Bianco","startTime":1178.243,"endTime":1182.948,"body":"exactly to your data and give you"},{"speaker":"David Bianco","startTime":1182.948,"endTime":1178.243,"body":" "},{"speaker":"David Bianco","startTime":1178.243,"endTime":1182.948,"body":"the exact searches that you need to run,"},{"speaker":"David Bianco","startTime":1182.948,"endTime":1183.615,"body":" "},{"speaker":"David Bianco","startTime":1183.615,"endTime":1187.686,"body":"even if you never told it what"},{"speaker":"David Bianco","startTime":1187.686,"endTime":1183.615,"body":" "},{"speaker":"David Bianco","startTime":1183.615,"endTime":1187.686,"body":"data is in there like it will discover it."},{"speaker":"David Bianco","startTime":1187.686,"endTime":1188.053,"body":" "},{"speaker":"David Bianco","startTime":1188.053,"endTime":1190.455,"body":"If you do tell it, that's great."},{"speaker":"David Bianco","startTime":1190.455,"endTime":1190.455,"body":" "},{"speaker":"David Bianco","startTime":1190.455,"endTime":1191.957,"body":"You can give it hints like that,"},{"speaker":"David Bianco","startTime":1191.957,"endTime":1191.957,"body":" "},{"speaker":"David Bianco","startTime":1191.957,"endTime":1195.26,"body":"but you don't actually need to"},{"speaker":"David Bianco","startTime":1195.26,"endTime":1191.957,"body":" "},{"speaker":"David Bianco","startTime":1191.957,"endTime":1195.26,"body":"and it can find the right data."},{"speaker":"David Bianco","startTime":1195.26,"endTime":1195.494,"body":" "},{"speaker":"David Bianco","startTime":1195.494,"endTime":1199.431,"body":"Our test environment has something like"},{"speaker":"David Bianco","startTime":1199.431,"endTime":1195.494,"body":" "},{"speaker":"David Bianco","startTime":1195.494,"endTime":1199.431,"body":"four terabytes of data in it, and it's"},{"speaker":"David Bianco","startTime":1199.431,"endTime":1199.431,"body":" "},{"speaker":"David Bianco","startTime":1199.431,"endTime":1203.435,"body":"it's actually able"},{"speaker":"David Bianco","startTime":1203.435,"endTime":1199.431,"body":" "},{"speaker":"David Bianco","startTime":1199.431,"endTime":1203.435,"body":"to almost always find the right data."},{"speaker":"David Bianco","startTime":1203.435,"endTime":1203.735,"body":" "},{"speaker":"David Bianco","startTime":1203.735,"endTime":1204.703,"body":"So it's really fun."},{"speaker":"David Bianco","startTime":1204.703,"endTime":1204.703,"body":" "},{"speaker":"David Bianco","startTime":1204.703,"endTime":1208.273,"body":"And at the end,"},{"speaker":"David Bianco","startTime":1208.273,"endTime":1204.703,"body":" "},{"speaker":"David Bianco","startTime":1204.703,"endTime":1208.273,"body":"what you have is a couple of documents."},{"speaker":"David Bianco","startTime":1208.273,"endTime":1208.974,"body":" "},{"speaker":"David Bianco","startTime":1208.974,"endTime":1212.211,"body":"Actually you have three documents that"},{"speaker":"David Bianco","startTime":1212.211,"endTime":1208.974,"body":" "},{"speaker":"David Bianco","startTime":1208.974,"endTime":1212.211,"body":"you would give to a real threat hunter"},{"speaker":"David Bianco","startTime":1212.211,"endTime":1212.578,"body":" "},{"speaker":"David Bianco","startTime":1212.578,"endTime":1214.313,"body":"to start executing."},{"speaker":"David Bianco","startTime":1214.313,"endTime":1214.313,"body":" "},{"speaker":"David Bianco","startTime":1214.313,"endTime":1219.084,"body":"You have the internet research,"},{"speaker":"David Bianco","startTime":1219.084,"endTime":1214.313,"body":" "},{"speaker":"David Bianco","startTime":1214.313,"endTime":1219.084,"body":"you have your local, research summary,"},{"speaker":"David Bianco","startTime":1219.084,"endTime":1219.084,"body":" "},{"speaker":"David Bianco","startTime":1219.084,"endTime":1222.087,"body":"and then you have the hunt detailed"},{"speaker":"David Bianco","startTime":1222.087,"endTime":1219.084,"body":" "},{"speaker":"David Bianco","startTime":1219.084,"endTime":1222.087,"body":"hunt plan."},{"speaker":"David Bianco","startTime":1222.087,"endTime":1222.354,"body":" "},{"speaker":"David Bianco","startTime":1222.354,"endTime":1226.258,"body":"In future, we're looking at expanding"},{"speaker":"David Bianco","startTime":1226.258,"endTime":1222.354,"body":" "},{"speaker":"David Bianco","startTime":1222.354,"endTime":1226.258,"body":"into execute and act."},{"speaker":"David Bianco","startTime":1226.258,"endTime":1226.258,"body":" "},{"speaker":"David Bianco","startTime":1226.258,"endTime":1230.963,"body":"But right now it is a prepare phase"},{"speaker":"David Bianco","startTime":1230.963,"endTime":1226.258,"body":" "},{"speaker":"David Bianco","startTime":1226.258,"endTime":1230.963,"body":"focused tool."},{"speaker":"David Bianco","startTime":1230.963,"endTime":1231.263,"body":" "},{"speaker":"David Bianco","startTime":1231.263,"endTime":1234.366,"body":"And it does a great job,"},{"speaker":"David Bianco","startTime":1234.366,"endTime":1231.263,"body":" "},{"speaker":"David Bianco","startTime":1231.263,"endTime":1234.366,"body":"I think, at taking the pain"},{"speaker":"David Bianco","startTime":1234.366,"endTime":1234.366,"body":" "},{"speaker":"David Bianco","startTime":1234.366,"endTime":1236.768,"body":"out of that workflow"},{"speaker":"David Bianco","startTime":1236.768,"endTime":1234.366,"body":" "},{"speaker":"David Bianco","startTime":1234.366,"endTime":1236.768,"body":"and you can complete it"},{"speaker":"David Bianco","startTime":1236.768,"endTime":1236.768,"body":" "},{"speaker":"David Bianco","startTime":1236.768,"endTime":1239.771,"body":"sometimes you can complete it"},{"speaker":"David Bianco","startTime":1239.771,"endTime":1236.768,"body":" "},{"speaker":"David Bianco","startTime":1236.768,"endTime":1239.771,"body":"in like 15 minutes."},{"speaker":"David Bianco","startTime":1239.771,"endTime":1239.871,"body":" "},{"speaker":"David Bianco","startTime":1239.871,"endTime":1241.807,"body":"It's it's really fun."},{"speaker":"David Bianco","startTime":1241.807,"endTime":1241.807,"body":" "},{"speaker":"David Bianco","startTime":1241.807,"endTime":1244.81,"body":"We also provide a couple of different"},{"speaker":"David Bianco","startTime":1244.81,"endTime":1245.077,"body":" "},{"speaker":"David Bianco","startTime":1245.077,"endTime":1249.081,"body":"alternate ways that I don't talk about"},{"speaker":"David Bianco","startTime":1249.081,"endTime":1245.077,"body":" "},{"speaker":"David Bianco","startTime":1245.077,"endTime":1249.081,"body":"as much because they're not as visual."},{"speaker":"David Bianco","startTime":1249.081,"endTime":1249.081,"body":" "},{"speaker":"David Bianco","startTime":1249.081,"endTime":1253.118,"body":"But we have a full suite of command line"},{"speaker":"David Bianco","startTime":1253.118,"endTime":1249.081,"body":" "},{"speaker":"David Bianco","startTime":1249.081,"endTime":1253.118,"body":"utilities for all the different phases,"},{"speaker":"David Bianco","startTime":1253.118,"endTime":1253.652,"body":" "},{"speaker":"David Bianco","startTime":1253.652,"endTime":1256.521,"body":"so you can script them if you want."},{"speaker":"David Bianco","startTime":1256.521,"endTime":1256.521,"body":" "},{"speaker":"David Bianco","startTime":1256.521,"endTime":1259.591,"body":"And but we also have an MC server"},{"speaker":"David Bianco","startTime":1259.591,"endTime":1256.521,"body":" "},{"speaker":"David Bianco","startTime":1256.521,"endTime":1259.591,"body":"that runs it"},{"speaker":"David Bianco","startTime":1259.591,"endTime":1259.791,"body":" "},{"speaker":"David Bianco","startTime":1259.791,"endTime":1264.263,"body":"so that you could actually put it"},{"speaker":"David Bianco","startTime":1264.263,"endTime":1259.791,"body":" "},{"speaker":"David Bianco","startTime":1259.791,"endTime":1264.263,"body":"in your own LLN systems"},{"speaker":"David Bianco","startTime":1264.263,"endTime":1264.263,"body":" "},{"speaker":"David Bianco","startTime":1264.263,"endTime":1268.0,"body":"and call the PE agents that way"},{"speaker":"David Bianco","startTime":1268.0,"endTime":1264.263,"body":" "},{"speaker":"David Bianco","startTime":1264.263,"endTime":1268.0,"body":"if you wanted to."},{"speaker":"David Bianco","startTime":1268.0,"endTime":1268.367,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1268.367,"endTime":1269.501,"body":"That's really incredible."},{"speaker":"Amy Ciminnisi","startTime":1269.501,"endTime":1269.501,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1269.501,"endTime":1272.07,"body":"I didn't know the details"},{"speaker":"Amy Ciminnisi","startTime":1272.07,"endTime":1269.501,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1269.501,"endTime":1272.07,"body":"of how that worked."},{"speaker":"Amy Ciminnisi","startTime":1272.07,"endTime":1272.07,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1272.07,"endTime":1276.441,"body":"For listeners, I will put a blog article"},{"speaker":"Amy Ciminnisi","startTime":1276.441,"endTime":1272.07,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1272.07,"endTime":1276.441,"body":"about the peek assistant"},{"speaker":"Amy Ciminnisi","startTime":1276.441,"endTime":1276.441,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1276.441,"endTime":1279.444,"body":"and also the GitHub link in the show"},{"speaker":"Amy Ciminnisi","startTime":1279.444,"endTime":1276.441,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1276.441,"endTime":1279.444,"body":"notes."},{"speaker":"Amy Ciminnisi","startTime":1279.444,"endTime":1279.645,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1279.645,"endTime":1283.782,"body":"But, David, for listeners"},{"speaker":"Amy Ciminnisi","startTime":1283.782,"endTime":1279.645,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1279.645,"endTime":1283.782,"body":"who are looking to improve their threat"},{"speaker":"Amy Ciminnisi","startTime":1283.782,"endTime":1283.782,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1283.782,"endTime":1287.119,"body":"hunting workflows,"},{"speaker":"Amy Ciminnisi","startTime":1287.119,"endTime":1283.782,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1283.782,"endTime":1287.119,"body":"regardless of the tools that they use."},{"speaker":"Amy Ciminnisi","startTime":1287.119,"endTime":1287.552,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1287.552,"endTime":1292.691,"body":"What is one key piece of advice,"},{"speaker":"Amy Ciminnisi","startTime":1292.691,"endTime":1287.552,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1287.552,"endTime":1292.691,"body":"whether it's technical or operational,"},{"speaker":"Amy Ciminnisi","startTime":1292.691,"endTime":1292.991,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1292.991,"endTime":1297.896,"body":"that you would give them to help"},{"speaker":"Amy Ciminnisi","startTime":1297.896,"endTime":1292.991,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1292.991,"endTime":1297.896,"body":"get started or advance where they're at?"},{"speaker":"Amy Ciminnisi","startTime":1297.896,"endTime":1298.43,"body":" "},{"speaker":"David Bianco","startTime":1298.43,"endTime":1302.367,"body":"The first thing is get started thinking"},{"speaker":"David Bianco","startTime":1302.367,"endTime":1298.43,"body":" "},{"speaker":"David Bianco","startTime":1298.43,"endTime":1302.367,"body":"if you're not already doing it,"},{"speaker":"David Bianco","startTime":1302.367,"endTime":1302.734,"body":" "},{"speaker":"David Bianco","startTime":1302.734,"endTime":1304.636,"body":"like don't overthink it."},{"speaker":"David Bianco","startTime":1304.636,"endTime":1304.636,"body":" "},{"speaker":"David Bianco","startTime":1304.636,"endTime":1308.54,"body":"You can take something really simple"},{"speaker":"David Bianco","startTime":1308.54,"endTime":1304.636,"body":" "},{"speaker":"David Bianco","startTime":1304.636,"endTime":1308.54,"body":"and start hunting for that."},{"speaker":"David Bianco","startTime":1308.54,"endTime":1308.54,"body":" "},{"speaker":"David Bianco","startTime":1308.54,"endTime":1312.778,"body":"And then maybe the next hunt"},{"speaker":"David Bianco","startTime":1312.778,"endTime":1308.54,"body":" "},{"speaker":"David Bianco","startTime":1308.54,"endTime":1312.778,"body":"would be slightly less"},{"speaker":"David Bianco","startTime":1312.778,"endTime":1312.778,"body":" "},{"speaker":"David Bianco","startTime":1312.778,"endTime":1314.813,"body":"simple and slightly less simple."},{"speaker":"David Bianco","startTime":1314.813,"endTime":1314.813,"body":" "},{"speaker":"David Bianco","startTime":1314.813,"endTime":1318.95,"body":"And then, you know, eventually"},{"speaker":"David Bianco","startTime":1318.95,"endTime":1314.813,"body":" "},{"speaker":"David Bianco","startTime":1314.813,"endTime":1318.95,"body":"you're you're just gaining experience."},{"speaker":"David Bianco","startTime":1318.95,"endTime":1318.95,"body":" "},{"speaker":"David Bianco","startTime":1318.95,"endTime":1319.785,"body":"It doesn't matter."},{"speaker":"David Bianco","startTime":1319.785,"endTime":1319.785,"body":" "},{"speaker":"David Bianco","startTime":1319.785,"endTime":1323.755,"body":"You don't have to jump to,"},{"speaker":"David Bianco","startTime":1323.755,"endTime":1319.785,"body":" "},{"speaker":"David Bianco","startTime":1319.785,"endTime":1323.755,"body":"a really complicated topic."},{"speaker":"David Bianco","startTime":1323.755,"endTime":1323.755,"body":" "},{"speaker":"David Bianco","startTime":1323.755,"endTime":1326.758,"body":"Write it and right up front"},{"speaker":"David Bianco","startTime":1326.758,"endTime":1323.755,"body":" "},{"speaker":"David Bianco","startTime":1323.755,"endTime":1326.758,"body":"and you don't have to be like, well,"},{"speaker":"David Bianco","startTime":1326.758,"endTime":1326.758,"body":" "},{"speaker":"David Bianco","startTime":1326.758,"endTime":1328.427,"body":"I don't know how to make my own machine"},{"speaker":"David Bianco","startTime":1328.427,"endTime":1328.427,"body":" "},{"speaker":"David Bianco","startTime":1328.427,"endTime":1331.129,"body":"learning models,"},{"speaker":"David Bianco","startTime":1331.129,"endTime":1328.427,"body":" "},{"speaker":"David Bianco","startTime":1328.427,"endTime":1331.129,"body":"so I can't do threat hunting."},{"speaker":"David Bianco","startTime":1331.129,"endTime":1331.129,"body":" "},{"speaker":"David Bianco","startTime":1331.129,"endTime":1333.832,"body":"You can start slow and easy"},{"speaker":"David Bianco","startTime":1333.832,"endTime":1333.832,"body":" "},{"speaker":"David Bianco","startTime":1333.832,"endTime":1336.802,"body":"and simple and build from there."},{"speaker":"David Bianco","startTime":1336.802,"endTime":1336.968,"body":" "},{"speaker":"David Bianco","startTime":1336.968,"endTime":1342.407,"body":"Whether you are just threat"},{"speaker":"David Bianco","startTime":1342.407,"endTime":1336.968,"body":" "},{"speaker":"David Bianco","startTime":1336.968,"endTime":1342.407,"body":"hunting yourself or if you're trying"},{"speaker":"David Bianco","startTime":1342.407,"endTime":1342.407,"body":" "},{"speaker":"David Bianco","startTime":1342.407,"endTime":1347.312,"body":"to establish a hunting team, think of it"},{"speaker":"David Bianco","startTime":1347.312,"endTime":1342.407,"body":" "},{"speaker":"David Bianco","startTime":1342.407,"endTime":1347.312,"body":"as adding tools to your toolbox."},{"speaker":"David Bianco","startTime":1347.312,"endTime":1347.813,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1347.813,"endTime":1351.383,"body":"Yeah, the best expert hunters started"},{"speaker":"Amy Ciminnisi","startTime":1351.383,"endTime":1351.383,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1351.383,"endTime":1355.754,"body":"where you are now,"},{"speaker":"Amy Ciminnisi","startTime":1355.754,"endTime":1351.383,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1351.383,"endTime":1355.754,"body":"so just take that next step, get started."},{"speaker":"Amy Ciminnisi","startTime":1355.754,"endTime":1355.754,"body":" "},{"speaker":"David Bianco","startTime":1355.754,"endTime":1358.857,"body":"Nobody starts as an expert"},{"speaker":"David Bianco","startTime":1358.857,"endTime":1358.857,"body":" "},{"speaker":"David Bianco","startTime":1358.857,"endTime":1355.754,"body":", but they all start."},{"speaker":"David Bianco","startTime":1358.857,"endTime":1359.191,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1359.191,"endTime":1361.66,"body":"Yes, absolutely."},{"speaker":"Amy Ciminnisi","startTime":1361.66,"endTime":1361.66,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1361.66,"endTime":1363.628,"body":"Thanks so much for listening everyone."},{"speaker":"Amy Ciminnisi","startTime":1363.628,"endTime":1363.628,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1363.628,"endTime":1368.6,"body":"I'll be sure to put the resources that we"},{"speaker":"Amy Ciminnisi","startTime":1368.6,"endTime":1363.628,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1363.628,"endTime":1368.6,"body":"discussed in the show notes tune back in."},{"speaker":"Amy Ciminnisi","startTime":1368.6,"endTime":1368.6,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1368.6,"endTime":1370.936,"body":"And another two weeks"},{"speaker":"Amy Ciminnisi","startTime":1370.936,"endTime":1368.6,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1368.6,"endTime":1370.936,"body":"for the next episode."},{"speaker":"Amy Ciminnisi","startTime":1370.936,"endTime":1370.936,"body":" "},{"speaker":"Amy Ciminnisi","startTime":1370.936,"endTime":1373.105,"body":"And until then, stay safe out there."}]}