How our customers with Microsoft tools detect and protect against attacks

If you’ve got GuardDuty set up in your AWS environment, then your security is already heading in the right direction. But knowing what to do with the alerts and how to make the most out of them isn’t always as clear. I’ll break down the classes of GuardDuty alerts and discuss different strategies to identify quality alerts using levers to tweak the volume and mapping of alerts based on your business needs.

Enrichments help you up-level your detections capabilities by giving you the full picture of what’s going on and a baseline for your users’ activity. Find out how Expel automates AWS alerts enrichment with the help of the Expel Workbench™ and our bot, Ruxie™. We’ll cover the key questions our automations help us quickly answer and how these automations make spotting true positives in the complexity of the cloud easier.

Containers are complex, and securing them is even more complicated. It all starts with understanding the different components from the bottom up. Join our partners at Lacework to unpack each part of a container with insights on how to best secure each using AWS native tools as well as additional monitoring from the Lacework platform.

Alerts in any environment, but especially the cloud, are only as useful as the investigative time put into them. Digging through logs and sorting through false-positives is time consuming and every second can matter. The solution? Automating the right things at the right time. Join a panel of Expel customers who have built their own automation and taken advantage of Expel’s automation to free up their time.

In this panel we’ll discuss:
• Benefits from automation (ex: staffing, faster time to detect and respond, improved visibility)
• Challenges with automation
• How it’s freed up resources and the follow-on effect of what else they were able to focus on

Panelists:
Peter Silberman, CTO, Expel
Brandon Maxwell, Senior Manager, Detection & Response, Auth0
Jeremy Stinson, Chief Architect of SaaS, Precisely
Aaron Blum, Lead Security Engineer, Cockroach Labs

Learn how Expel approaches detection writing by iterating upon previous research and detection work. We’ll explore how our detection coverage evolves as we learn more about a technology and brainstorm ways to iterate upon your own detections. Then you’ll get a glimpse of our detections for lesser known AWS controls that can be used to unseat security in your environment.

Join Expel in the data caves to see how we dig for coin miners in customer environments. You’ll leave this session with some tips on how you can use signal to find unauthorized coin mining in your AWS environment.

We’ve seen quite a few incidents in AWS. And we noticed a few common themes about when and why attackers use different AWS APIs – and they mapped nicely to the MITRE ATT&CK tactics. Follow along as we walk you through Expel’s AWS mind map and share why constructing a mind map can assist in developing detections, performing timeline analyses and identify attacker paths in AWS.