Graph Based Detection and Response with Grapl

Explore graph-based detection and response techniques using Grapl in this 46-minute conference talk from BSidesSF 2020. Learn how to leverage graphs and Python to build powerful, behavior-oriented attack signatures and investigate suspicious activities in your environment. Discover the fundamentals of graph analytics, including examples from financial security and tools like Bloodhound and CloudMapper. Dive into log-based detection, identity management, and Python analyzers. Gain insights on conducting log-based investigations, finding parent processes, and utilizing Jupiter notebooks. Explore advanced topics such as lenses, graph engagements, pivoting behaviors, and visualization techniques. Understand process tree analysis, recursive queries, and how to set up Grapl for enhanced security detection and response capabilities.