Live, interactive cybersecurity training available through SANS Live Online. View upcoming events.


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

Taming Your Indicator Consumption Pipeline

  • Friday, March 13, 2015 at 1:00 PM EST (2015-03-13 17:00:00 UTC)
  • Ryan Stillions

You can now attend the webcast using your mobile device!



Does your cup overflow with indicators? Sensors run hot? Analysts tired from alert fatigue? This talk is for those interested in a pragmatic model for building an indicator consumption pipeline that results in actionable, prioritized, relevant detections for your event analysts & responders. Using proven techniques from several of the world's largest environments, Ryan Stillions will discuss key steps to optimizing indicator consumption and reclaiming your alert consoles.

Speaker Bio

Ryan Stillions

Ryan Stillions, Head of Detection & Response Services, Vigilant LLC Ryan Stillions is Head of Detection & Response Services for Vigilant Technology Solutions, a leading managed Network Security Monitoring (NSM) solutions provider. His background is in Incident Detection and Response for large Fortune-500 enterprises, and operationalizing threat intelligence into detection platforms that span network, endpoint, and event log domains. Prior to joining Vigilant, Ryan held positions with Mandiant, General Electric (GE-CIRT), RSA, Rockwell Collins, ManTech International, Lockheed Martin, and served in the United States Air Force. He can be found on Twitter @ryanstillions and blogs occasionally at

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.