DtSR Episode 716 - What if Context Replaced Alerts Entirely
Summary
Hosts Rafal and James are joined by Jason Vest and Josh Taylor to critique current AI-driven SOC triage as a mere band-aid. They argue that detection engineering must shift earlier in the pipeline, using dynamic context and just-in-time modeling to extract signal from noise before alerts are generated. The group discusses the need for community collaboration on open AI models to improve threat detection rather than relying on rigid, vendor-specific rules.
Topics discussed
Introduction and guest introductions
The problem with AI alert triage as a band-aid
Limitations of static rules and the need for dynamic context
Reengineering detection: From alerts to situations
Just-in-time modeling and scalable anomaly detection
Data granularity, cost, and the pendulum of logging
Community collaboration vs. vendor monetization of AI
Final thoughts and closing remarks
Listen ad-free on Castria