SANS Cyber Safari 2025 Community Night Talks

Abstract: Actionable intelligence is only as good as your ability to share it — quickly, reliably, and with the right context. In this talk, we’ll explore how MISP can be used not just as a threat intel repository, but as a powerful engine for real-time collaboration and operational impact. We’ll cover how to make MISP highly available, build and sustain a community around it, and create qualitative events that provide the necessary context for detection, decision-making, and response. You’ll also see how we’re integrating AI into our workflows to improve speed, reduce manual effort, and enrich intelligence automatically — without sacrificing quality. Whether you’re just getting started with MISP or looking to take your threat sharing to the next level, this talk will give you concrete ideas to make it work in high-pressure, real-world environments.

Abstract: In Digital Forensics, Incident Response, and other Cyber Security topics, we're frequently tasked with consuming HUGE amounts of data and finding the "interesting" parts quickly. We've had great tools to do this for decades. But, those tools we're optimized for old computing hardware. In our modern day we have setups with multiple CPU cores and flash storage. This talk will present some techniques to speed up those old techniques fully utilizing modern hardware.