Digital Forensics and Incident Response, Cloud Security
Explore content featuring this instructor’s insights and expertise.
This talk goes below the prompt into the logs — what Azure, AWS, Google Cloud, and Kubernetes record when an agent, not a human, acts. Anchored on a real July 2026 intrusion, we pull each platform’s own logs and find the same shape of logs that ground our investigations.
This talk teaches the practitioner path from where most of us started: prompting an assistant for a faster answer.
Join SANS instructor Terrence Williams and Kevin Gonzalez for a deep dive into the data and actionable insights into detection engineering practices
The landscape of Detection Engineering is rapidly evolving, and staying ahead of the curve is crucial for cybersecurity professionals. To dive deep into understanding the current state and future trends of this critical field, SANS has partnered with Anvilogic to conduct a comprehensive survey of Detection Engineering professionals across various industries.
This hands-on workshop will support content from FOR509: Enterprise Cloud Forensics and Incident Response
Going from responding to incidents to actively hunting threats is a stance shift that requires maturity in your cybersecurity journey. It also requires having access to the right threat intelligence, the right visibility across your environment, as well as the right tools to do the job. Advances in data science and artificial intelligence can help organizations bridge the maturity gap, but we shouldn’t forget that it’s ultimately a human with financial or geopolitical interests who’s behind these attacks. Also the same technology is available to both sides, and just as quickly as new models become more effective at threat detection, malicious actors grow more capable at confusing those models.Likewise, organizations have now access to threat intelligence sources through various vendors and platforms. Yet many are not necessarily seeing all the value threat intelligence can bring because they don't understand how to operationalize it or they are not taking advance of the tools that can help them automate and accelerate their threat-hunting programs.At the same time many security practitioners still struggle with the basics, the three big “knows” that every organization should focus on: knowing your enemy, knowing your network, and knowing your tools. Why? In many cases they are too busy responding to alerts and false positives to do what's needed for a threat-hunting program to be successful.What should organizations do in 2023 to take a more proactive stance, operationalize threat intelligence and focus on maturing their threat hunting program?Join Ismael Valenzuela, SANS author and Senior instructor for the 2024 Cyber Solutions Fest - Threat Hunting and Intelligence Track, and hear talks on:Enriching alerts with threat intelligenceUtilizing XDR and MDR services to help accelerate your threat-hunting programOperationalizing threat intelligenceAutomating threat hunting tasks with XDR, NDR, and threat intelligence solutionsIdentifying the most actionable intelligence for the organization
Crypto miners are increasingly targeting cloud environments, leveraging the vast resources of organizations to mine cryptocurrency, which leads to inflated costs and resource depletion.
