Security Onion 2017 - Pivoting Effectively to Catch More Bad Guys

Explore effective pivoting techniques to enhance threat detection in this 51-minute conference talk from Security Onion Conference 2017. Delve into Chris Sanders' expertise as he discusses the contrast between practice and performance, introduces the concept of secret practice, and emphasizes the importance of higher quality practice and metacognition in cybersecurity. Learn about the investigative process, evidence handling, and data transformation through practical examples. Discover various pivot techniques, including ID SLR and suspicious file analysis, and understand how to execute write masks and scope investigations effectively. Gain insights into expert pivoting strategies, the maturity of pivoting skills, and the significance of maintaining a data source wiki and query history. Witness a pivot map demo and gather final thoughts on applying pivoting techniques to catch more cybercriminals.

Introduction
Pivoting
Practice vs Performance
Secret Practice
Higher Quality Practice
Metacognition
Investigative Process
Evidence
Example
Data Transformation
Pivot
Pivot Practice
Pivot Examples
ID SLR Example
Suspicious File
Executing Write Mask
Scoping
Cobie
Learning to Pivot
Expert Pivots
Applying Pivoting
Why Pivoting
Pivots
Maturity
Data Source Wiki
Query History
Data Source
Pivot Map Demo
Final Thoughts
Wrap Up