I usually see two things.
1. Analysts don't have the skills to perform tuning.
2. Management won't prioritize time for it or train analysts to do it.
I rarely see #2 get rectified until new management comes in who understands the importance of tuning.
1. Analysts don't have the skills to perform tuning.
2. Management won't prioritize time for it or train analysts to do it.
I rarely see #2 get rectified until new management comes in who understands the importance of tuning.
https://twitter.com/markaorlando/status/1408070651202637824
I've seen many good analysts give clear, compelling explanations as to why tuning is important but fail to convince the decision-makers that this needs a dedicated person or a day a week from an existing person.
The thing that needs to become more commonly accepted is that if you decide your company needs a SOC, then that has to include a detection tuning capability. It also needs to be run by people who've seen this thing work well.
The number of places where this is done well is still smallish, but it's growing quickly! I
I do think we'll get to where people understand the importance of tuning more. We need to talk more about it, give more conference presentations about it, and enable it in tools with better feedback mechanisms and ways to act on them.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
