WEBVTT

1
00:00:02.540 --> 00:00:06.300
<00:00:02.540>Hey <00:00:02.656>everyone, <00:00:02.773>my <00:00:02.890>name <00:00:03.006>is <00:00:03.123>Matthias <00:00:03.240>Palmersheim, <00:00:03.356>and <00:00:03.473>this <00:00:03.590>talk <00:00:03.706>is <00:00:03.823>Using <00:00:03.940>Your

2
00:00:06.380 --> 00:00:08.560
<00:00:06.380>Observability <00:00:06.729>Tool <00:00:07.080>as <00:00:07.430>a <00:00:07.779>SIEM.

3
00:00:09.420 --> 00:00:13.060
<00:00:09.420>A <00:00:09.536>little <00:00:09.653>bit <00:00:09.770>about <00:00:09.886>me <00:00:10.003>is <00:00:10.120>I'm <00:00:10.236>obsessed <00:00:10.353>with <00:00:10.469>observability, <00:00:10.586>so <00:00:10.703>much <00:00:10.820>so

4
00:00:13.180 --> 00:00:17.080
<00:00:13.180>I <00:00:13.296>actually <00:00:13.413>would <00:00:13.530>not <00:00:13.646>shut <00:00:13.763>up <00:00:13.879>about <00:00:13.996>centralized <00:00:14.113>logging <00:00:14.230>on <00:00:14.346>the <00:00:14.463>first <00:00:14.580>date

5
00:00:17.120 --> 00:00:20.960
<00:00:17.120>with <00:00:17.247>my <00:00:17.374>wife. <00:00:17.501>And <00:00:17.629>eventually, <00:00:17.756>I <00:00:17.883>got <00:00:18.010>a <00:00:18.138>job <00:00:18.265>working <00:00:18.392>on <00:00:18.520>observability

6
00:00:21.000 --> 00:00:24.600
<00:00:21.000>full-time <00:00:21.200>at <00:00:21.400>Victoria <00:00:21.600>Metrics, <00:00:21.800>where <00:00:22.000>I <00:00:22.200>help <00:00:22.400>our

7
00:00:24.980 --> 00:00:27.760
<00:00:24.980>open <00:00:25.107>source <00:00:25.234>users <00:00:25.361>and <00:00:25.489>enterprise <00:00:25.616>customers <00:00:25.743>get <00:00:25.870>the <00:00:25.998>most <00:00:26.125>out <00:00:26.252>of <00:00:26.380>their

8
00:00:27.780 --> 00:00:31.720
<00:00:27.780>observability. <00:00:27.980>And <00:00:28.180>when <00:00:28.380>I'm <00:00:28.580>still <00:00:28.780>at <00:00:28.980>a <00:00:29.180>computer

9
00:00:31.760 --> 00:00:35.720
<00:00:31.760>and <00:00:31.860>not <00:00:31.960>at <00:00:32.060>work, <00:00:32.160>I <00:00:32.259>maintain <00:00:32.360>an <00:00:32.460>open <00:00:32.560>source <00:00:32.660>project <00:00:32.759>called <00:00:32.860>Shiftmon, <00:00:32.960>which <00:00:33.060>tries <00:00:33.160>to

10
00:00:35.760 --> 00:00:37.960
<00:00:35.760>be <00:00:36.040>an <00:00:36.320>open <00:00:36.599>source <00:00:36.879>observability <00:00:37.160>on-ramp

11
00:00:39.060 --> 00:00:42.700
<00:00:39.060>for <00:00:39.187>small <00:00:39.314>and <00:00:39.441>medium <00:00:39.569>businesses, <00:00:39.696>so <00:00:39.823>you <00:00:39.950>don't <00:00:40.078>need <00:00:40.205>a <00:00:40.332>big <00:00:40.460>pocketbook

12
00:00:42.740 --> 00:00:46.129
<00:00:42.740>or <00:00:42.940>a <00:00:43.140>massive <00:00:43.340>infrastructure <00:00:43.540>footprint <00:00:43.740>to <00:00:43.940>get <00:00:44.140>good

13
00:00:46.180 --> 00:00:50.060
<00:00:46.180>observability. <00:00:46.413>Shiftmon <00:00:46.646>was <00:00:46.880>started <00:00:47.113>to <00:00:47.346>help <00:00:47.580>monitor

14
00:00:50.070 --> 00:00:53.880
<00:00:50.070>my <00:00:50.170>sprawling <00:00:50.270>home <00:00:50.370>lab. <00:00:50.470>And <00:00:50.570>when <00:00:50.670>I <00:00:50.770>do <00:00:50.870>get <00:00:50.970>away <00:00:51.070>from <00:00:51.170>the <00:00:51.270>computer, <00:00:51.370>I <00:00:51.470>love

15
00:00:53.920 --> 00:00:55.360
<00:00:53.920>spending <00:00:54.244>time <00:00:54.568>with <00:00:54.892>my <00:00:55.216>animals,

16
00:00:56.740 --> 00:00:59.580
<00:00:56.740>who <00:00:56.880>are <00:00:57.020>featured <00:00:57.160>throughout <00:00:57.300>this <00:00:57.440>talk, <00:00:57.580>as <00:00:57.720>you <00:00:57.860>can <00:00:58.000>see <00:00:58.140>here.

17
00:00:59.640 --> 00:01:03.530
<00:00:59.640>If <00:00:59.717>you <00:00:59.795>need <00:00:59.873>to <00:00:59.951>get <00:01:00.028>a <00:01:00.106>hold <00:01:00.184>of <00:01:00.262>me <00:01:00.340>or <00:01:00.417>want <00:01:00.495>to <00:01:00.573>check <00:01:00.651>out <00:01:00.728>anything <00:01:00.806>I'm <00:01:00.884>doing <00:01:00.962>online, <00:01:01.040>I

18
00:01:03.620 --> 00:01:05.860
<00:01:03.620>have <00:01:03.970>my <00:01:04.319>email <00:01:04.670>address, <00:01:05.019>and

19
00:01:06.940 --> 00:01:10.790
<00:01:06.940>all <00:01:07.080>the <00:01:07.220>links <00:01:07.360>to <00:01:07.500>all <00:01:07.640>my <00:01:07.780>social <00:01:07.920>media <00:01:08.060>are <00:01:08.200>at <00:01:08.340>links.shiftsystems.net.

20
00:01:13.420 --> 00:01:17.110
<00:01:13.420>Before <00:01:13.547>we <00:01:13.674>talk <00:01:13.801>about <00:01:13.929>why <00:01:14.056>observability <00:01:14.183>and <00:01:14.310>your <00:01:14.438>SIEM <00:01:14.565>should <00:01:14.692>be <00:01:14.820>combined,

21
00:01:17.280 --> 00:01:18.750
<00:01:17.280>I <00:01:17.469>think <00:01:17.658>we <00:01:17.847>should <00:01:18.036>establish <00:01:18.225>what <00:01:18.414>they <00:01:18.603>are.

22
00:01:19.580 --> 00:01:23.560
<00:01:19.580>And <00:01:19.780>observability <00:01:19.980>is <00:01:20.179>the <00:01:20.380>process <00:01:20.580>of <00:01:20.780>collecting <00:01:20.980>telemetry

23
00:01:23.620 --> 00:01:27.220
<00:01:23.620>to <00:01:23.795>interrogate <00:01:23.970>systems. <00:01:24.145>I'm <00:01:24.320>not <00:01:24.495>a <00:01:24.670>fan <00:01:24.845>of <00:01:25.020>saying

24
00:01:27.260 --> 00:01:29.250
<00:01:27.260>observability <00:01:27.540>is <00:01:27.820>metrics, <00:01:28.100>logs, <00:01:28.380>and <00:01:28.660>traces.

25
00:01:29.440 --> 00:01:31.420
<00:01:29.440>It <00:01:29.673>feels <00:01:29.906>like <00:01:30.140>you're <00:01:30.373>describing <00:01:30.606>a <00:01:30.840>cake

26
00:01:34.820 --> 00:01:38.660
<00:01:34.820>by <00:01:34.960>saying <00:01:35.100>it's <00:01:35.240>milk, <00:01:35.380>eggs, <00:01:35.520>and <00:01:35.660>butter, <00:01:35.800>which <00:01:35.940>is <00:01:36.080>just <00:01:36.220>saying

27
00:01:38.700 --> 00:01:41.300
<00:01:38.700>some <00:01:38.855>of <00:01:39.011>the <00:01:39.166>ingredients <00:01:39.322>that <00:01:39.477>might <00:01:39.633>not <00:01:39.788>always <00:01:39.944>be <00:01:40.100>there.

28
00:01:41.520 --> 00:01:44.500
<00:01:41.520>If <00:01:41.620>you <00:01:41.720>wanted <00:01:41.820>to <00:01:41.920>make <00:01:42.020>a <00:01:42.120>vegan <00:01:42.220>cake, <00:01:42.320>you <00:01:42.420>wouldn't <00:01:42.520>be <00:01:42.620>able <00:01:42.720>to <00:01:42.820>use <00:01:42.920>eggs.

29
00:01:44.540 --> 00:01:48.120
<00:01:44.539>You <00:01:44.679>would <00:01:44.820>use <00:01:44.960>something <00:01:45.100>else, <00:01:45.240>similar <00:01:45.380>to <00:01:45.520>people <00:01:45.660>who <00:01:45.800>primarily <00:01:45.940>use

30
00:01:48.240 --> 00:01:51.940
<00:01:48.240>traces <00:01:48.415>for <00:01:48.590>observability, <00:01:48.765>or <00:01:48.940>they're <00:01:49.115>taking <00:01:49.290>the <00:01:49.465>wide <00:01:49.640>event

31
00:01:51.980 --> 00:01:52.360
approach.

32
00:01:53.920 --> 00:01:56.580
<00:01:53.920>So <00:01:54.095>the <00:01:54.270>ingredient <00:01:54.445>list <00:01:54.620>is <00:01:54.795>accurate, <00:01:54.970>it's <00:01:55.145>also <00:01:55.320>incomplete.

33
00:01:56.700 --> 00:02:00.640
<00:01:56.700>You <00:01:56.827>just <00:01:56.954>don't <00:01:57.081>slap <00:01:57.209>together <00:01:57.336>milk, <00:01:57.463>eggs, <00:01:57.590>and <00:01:57.718>butter <00:01:57.845>and <00:01:57.972>get <00:01:58.100>a

34
00:02:00.720 --> 00:02:02.320
<00:02:00.720>cake. <00:02:01.186>You <00:02:01.653>have <00:02:02.120>to

35
00:02:03.260 --> 00:02:07.200
<00:02:03.260>mix <00:02:03.400>them <00:02:03.540>properly, <00:02:03.680>cook <00:02:03.820>them <00:02:03.960>properly, <00:02:04.100>let <00:02:04.240>them <00:02:04.380>rest <00:02:04.520>properly <00:02:04.660>before

36
00:02:07.260 --> 00:02:07.740
<00:02:07.260>you <00:02:07.476>can <00:02:07.692>get

37
00:02:08.961 --> 00:02:10.920
<00:02:08.961>a <00:02:09.161>good <00:02:09.361>cake. <00:02:09.561>And <00:02:09.761>observability <00:02:09.961>is <00:02:10.161>the <00:02:10.361>same.

38
00:02:10.980 --> 00:02:14.460
<00:02:10.979>It's <00:02:11.179>not <00:02:11.380>just <00:02:11.579>you <00:02:11.780>deploy <00:02:11.980>one <00:02:12.179>to <00:02:12.380>three

39
00:02:14.480 --> 00:02:17.609
<00:02:14.480>databases, <00:02:14.760>and <00:02:15.040>everything's <00:02:15.320>just <00:02:15.600>magically <00:02:15.880>there.

40
00:02:18.880 --> 00:02:22.200
<00:02:18.880>You <00:02:18.996>have <00:02:19.113>to <00:02:19.230>glue <00:02:19.346>everything <00:02:19.463>together <00:02:19.579>in <00:02:19.696>order <00:02:19.813>to <00:02:19.930>get <00:02:20.046>a <00:02:20.163>good <00:02:20.280>solution.

41
00:02:25.040 --> 00:02:28.850
<00:02:25.040>The <00:02:25.156>biggest <00:02:25.273>thing <00:02:25.390>for <00:02:25.506>me <00:02:25.623>that <00:02:25.739>observability <00:02:25.856>does <00:02:25.973>is <00:02:26.090>it <00:02:26.206>notifies <00:02:26.323>me <00:02:26.440>when

42
00:02:28.860 --> 00:02:32.769
<00:02:28.860>things <00:02:28.967>aren't <00:02:29.075>working, <00:02:29.183>and <00:02:29.290>in <00:02:29.398>my <00:02:29.506>use <00:02:29.613>case, <00:02:29.721>that <00:02:29.829>can <00:02:29.936>mean <00:02:30.044>that <00:02:30.152>a <00:02:30.260>service

43
00:02:32.820 --> 00:02:36.410
<00:02:32.820>is <00:02:33.019>down, <00:02:33.220>there's <00:02:33.420>some <00:02:33.620>automated <00:02:33.820>process <00:02:34.019>that's <00:02:34.220>failing.

44
00:02:36.480 --> 00:02:40.380
<00:02:36.480>And <00:02:36.619>ideally, <00:02:36.760>it's <00:02:36.899>going <00:02:37.040>to <00:02:37.179>be <00:02:37.320>proactive <00:02:37.459>troubleshooting <00:02:37.600>rather <00:02:37.739>than <00:02:37.880>reactive

45
00:02:40.460 --> 00:02:44.180
<00:02:40.460>troubleshooting. <00:02:40.693>So <00:02:40.926>before <00:02:41.160>you're <00:02:41.393>having <00:02:41.626>issues <00:02:41.860>with

46
00:02:44.240 --> 00:02:46.000
<00:02:44.240>some <00:02:44.590>outdated <00:02:44.940>version <00:02:45.290>of <00:02:45.640>software,

47
00:02:47.900 --> 00:02:51.010
<00:02:47.900>you <00:02:48.016>would <00:02:48.133>have <00:02:48.250>gotten <00:02:48.366>alerted <00:02:48.483>that <00:02:48.600>the <00:02:48.716>automation <00:02:48.833>that <00:02:48.950>updates <00:02:49.066>your <00:02:49.183>software <00:02:49.300>is

48
00:02:51.040 --> 00:02:51.390
failing.

49
00:02:52.800 --> 00:02:53.130
And

50
00:02:54.220 --> 00:02:57.890
<00:02:54.220>on <00:02:54.347>larger <00:02:54.474>scales, <00:02:54.601>it <00:02:54.729>would <00:02:54.856>be <00:02:54.983>a <00:02:55.110>node <00:02:55.238>behind <00:02:55.365>a <00:02:55.492>load <00:02:55.620>balancer

51
00:02:58.080 --> 00:03:01.800
<00:02:58.079>failing <00:02:58.179>you <00:02:58.279>would <00:02:58.380>get <00:02:58.480>an <00:02:58.579>alert <00:02:58.679>for, <00:02:58.779>rather <00:02:58.880>than <00:02:58.980>getting <00:02:59.079>an <00:02:59.179>alert <00:02:59.279>for <00:02:59.380>the <00:02:59.480>service

52
00:03:01.820 --> 00:03:05.640
<00:03:01.820>being <00:03:01.995>down. <00:03:02.170>Another <00:03:02.345>thing <00:03:02.519>is <00:03:02.695>observability <00:03:02.870>has <00:03:03.045>to <00:03:03.220>correlate

53
00:03:05.660 --> 00:03:07.160
<00:03:05.660>data <00:03:06.109>from <00:03:06.560>multiple <00:03:07.010>sources.

54
00:03:08.310 --> 00:03:10.950
<00:03:08.310>That <00:03:08.510>doesn't <00:03:08.710>just <00:03:08.910>mean <00:03:09.110>metrics, <00:03:09.310>logs, <00:03:09.510>and <00:03:09.710>traces.

55
00:03:11.160 --> 00:03:14.400
<00:03:11.160>Even <00:03:11.276>something <00:03:11.393>as <00:03:11.510>simple <00:03:11.626>as <00:03:11.743>hosting <00:03:11.859>a <00:03:11.976>chat <00:03:12.093>app <00:03:12.210>now <00:03:12.326>could <00:03:12.443>require <00:03:12.560>two

56
00:03:14.420 --> 00:03:18.049
<00:03:14.420>databases, <00:03:14.619>two <00:03:14.820>load <00:03:15.019>balancers, <00:03:15.220>and <00:03:15.420>multiple <00:03:15.619>worker <00:03:15.820>processes,

57
00:03:18.500 --> 00:03:22.400
<00:03:18.500>and <00:03:18.627>it <00:03:18.754>can <00:03:18.881>be <00:03:19.009>really <00:03:19.136>tricky <00:03:19.263>to <00:03:19.390>find <00:03:19.518>where <00:03:19.645>the <00:03:19.772>problem <00:03:19.900>is

58
00:03:22.460 --> 00:03:26.340
<00:03:22.460>and <00:03:22.576>how <00:03:22.693>to <00:03:22.810>fix <00:03:22.926>it <00:03:23.043>if <00:03:23.160>you're <00:03:23.276>having <00:03:23.393>to <00:03:23.510>troubleshoot <00:03:23.626>those <00:03:23.743>things <00:03:23.860>individually

59
00:03:26.380 --> 00:03:29.670
<00:03:26.380>instead <00:03:26.535>of <00:03:26.691>having <00:03:26.846>one <00:03:27.002>place <00:03:27.157>where <00:03:27.313>everything <00:03:27.468>can <00:03:27.624>be <00:03:27.780>monitored.

60
00:03:32.120 --> 00:03:36.040
<00:03:32.120>And <00:03:32.227>because <00:03:32.335>there's <00:03:32.443>so <00:03:32.550>much <00:03:32.658>data <00:03:32.766>and <00:03:32.873>so <00:03:32.981>many <00:03:33.089>things <00:03:33.196>going <00:03:33.304>on, <00:03:33.412>we <00:03:33.520>need

61
00:03:36.100 --> 00:03:37.630
<00:03:36.100>to <00:03:36.296>use <00:03:36.493>abstractions <00:03:36.690>to <00:03:36.886>go <00:03:37.083>through <00:03:37.280>it <00:03:37.477>all.

62
00:03:37.760 --> 00:03:41.480
<00:03:37.760>You <00:03:37.899>can't <00:03:38.040>just <00:03:38.179>look <00:03:38.320>at <00:03:38.459>a <00:03:38.600>terabyte <00:03:38.739>of <00:03:38.880>logs <00:03:39.019>in <00:03:39.160>one

63
00:03:41.520 --> 00:03:45.020
<00:03:41.520>shot. <00:03:41.753>You <00:03:41.986>have <00:03:42.220>to <00:03:42.453>use <00:03:42.686>abstractions <00:03:42.920>like

64
00:03:45.040 --> 00:03:45.850
dashboards,

65
00:03:46.900 --> 00:03:50.600
<00:03:46.900>aggregated <00:03:47.075>queries, <00:03:47.250>and <00:03:47.425>alerting <00:03:47.600>rules <00:03:47.775>in <00:03:47.950>order <00:03:48.125>for <00:03:48.300>that

66
00:03:50.620 --> 00:03:51.940
<00:03:50.620>data <00:03:51.016>to <00:03:51.412>make <00:03:51.808>sense.

67
00:03:54.700 --> 00:03:58.380
<00:03:54.700>And <00:03:54.855>SIEM <00:03:55.011>is <00:03:55.166>an <00:03:55.322>acronym <00:03:55.477>for <00:03:55.633>Security <00:03:55.788>Information <00:03:55.944>and <00:03:56.100>Event

68
00:03:58.460 --> 00:04:02.240
<00:03:58.460>Monitoring, <00:03:58.693>and <00:03:58.926>it <00:03:59.160>is <00:03:59.393>responsible <00:03:59.626>for <00:03:59.860>collecting

69
00:04:02.280 --> 00:04:06.080
<00:04:02.280>telemetry <00:04:02.480>from <00:04:02.680>various <00:04:02.880>sources. <00:04:03.080>It <00:04:03.280>alerts <00:04:03.480>for <00:04:03.680>different

70
00:04:06.100 --> 00:04:06.420
<00:04:06.100>sorts <00:04:06.387>of

71
00:04:07.320 --> 00:04:11.040
<00:04:07.320>irregularities <00:04:07.475>and <00:04:07.631>failures. <00:04:07.786>So <00:04:07.942>rather <00:04:08.097>than <00:04:08.253>getting <00:04:08.408>alerted <00:04:08.564>that <00:04:08.720>a

72
00:04:11.080 --> 00:04:14.500
<00:04:11.080>machine <00:04:11.207>is <00:04:11.334>offline, <00:04:11.461>it <00:04:11.589>would <00:04:11.716>get <00:04:11.843>an <00:04:11.970>alert <00:04:12.098>for <00:04:12.225>a <00:04:12.352>machine <00:04:12.480>is

73
00:04:14.560 --> 00:04:18.340
<00:04:14.560>unpatched, <00:04:14.793>or <00:04:15.026>the <00:04:15.260>automated <00:04:15.493>process <00:04:15.726>failing <00:04:15.960>for

74
00:04:18.399 --> 00:04:22.240
<00:04:18.399>updates <00:04:18.599>would <00:04:18.798>likely <00:04:18.999>notify <00:04:19.199>both <00:04:19.399>teams <00:04:19.599>because <00:04:19.798>security

75
00:04:22.320 --> 00:04:26.140
<00:04:22.320>wants <00:04:22.447>to <00:04:22.574>make <00:04:22.701>sure <00:04:22.829>that <00:04:22.956>the <00:04:23.083>latest <00:04:23.210>version <00:04:23.338>and <00:04:23.465>all <00:04:23.592>the <00:04:23.719>security

76
00:04:26.180 --> 00:04:29.680
<00:04:26.180>patches <00:04:26.335>are <00:04:26.491>applied, <00:04:26.646>and <00:04:26.802>infrastructure <00:04:26.957>wants <00:04:27.113>to <00:04:27.268>make <00:04:27.424>sure <00:04:27.580>any

77
00:04:29.740 --> 00:04:33.440
<00:04:29.740>updates <00:04:29.940>to <00:04:30.140>fix <00:04:30.340>bugs <00:04:30.540>or <00:04:30.740>performance <00:04:30.940>optimizations <00:04:31.140>have

78
00:04:33.480 --> 00:04:37.320
<00:04:33.480>been <00:04:33.655>deployed. <00:04:33.830>So <00:04:34.005>you're <00:04:34.180>getting <00:04:34.355>alerts <00:04:34.530>in <00:04:34.705>both <00:04:34.880>cases.

79
00:04:38.780 --> 00:04:42.510
<00:04:38.780>You're <00:04:38.880>also <00:04:38.979>trying <00:04:39.080>to <00:04:39.179>be <00:04:39.280>proactive <00:04:39.380>in <00:04:39.479>both <00:04:39.580>use <00:04:39.679>cases, <00:04:39.780>where <00:04:39.880>you <00:04:39.979>want <00:04:40.080>to <00:04:40.179>get

80
00:04:42.540 --> 00:04:45.660
<00:04:42.540>notified <00:04:43.006>that <00:04:43.473>there's <00:04:43.940>an

81
00:04:45.720 --> 00:04:49.620
<00:04:45.720>outdated <00:04:45.847>version <00:04:45.974>of <00:04:46.101>something <00:04:46.229>or <00:04:46.356>some <00:04:46.483>host <00:04:46.610>isn't <00:04:46.738>compliant <00:04:46.865>in <00:04:46.992>some <00:04:47.120>way

82
00:04:49.660 --> 00:04:52.040
<00:04:49.659>before <00:04:49.893>an <00:04:50.126>attacker <00:04:50.359>has <00:04:50.593>established <00:04:50.826>a <00:04:51.059>foothold.

83
00:04:52.960 --> 00:04:56.950
<00:04:52.960>And <00:04:53.099>you're <00:04:53.239>also <00:04:53.380>dealing <00:04:53.520>with <00:04:53.659>insane <00:04:53.799>amounts <00:04:53.940>of <00:04:54.080>data <00:04:54.219>and <00:04:54.359>having

84
00:04:56.960 --> 00:05:00.880
<00:04:56.960>to <00:04:57.076>use <00:04:57.193>similar <00:04:57.310>abstractions <00:04:57.426>like <00:04:57.543>alerting <00:04:57.659>rules <00:04:57.776>and <00:04:57.893>dashboards <00:04:58.010>to <00:04:58.126>make <00:04:58.243>sense <00:04:58.359>of

85
00:05:00.940 --> 00:05:01.360
everything.

86
00:05:03.700 --> 00:05:07.560
<00:05:03.700>Another <00:05:03.855>thing <00:05:04.011>that's <00:05:04.166>fairly <00:05:04.322>similar <00:05:04.477>is <00:05:04.633>the <00:05:04.788>incidents <00:05:04.944>are <00:05:05.099>nearly

87
00:05:07.640 --> 00:05:08.880
identical.

88
00:05:10.620 --> 00:05:14.530
<00:05:10.620>I've <00:05:10.820>been <00:05:11.020>on <00:05:11.220>infrastructure <00:05:11.420>and <00:05:11.620>security <00:05:11.820>incidents, <00:05:12.020>and

89
00:05:14.600 --> 00:05:17.420
<00:05:14.600>they <00:05:14.740>both <00:05:14.880>have <00:05:15.020>a <00:05:15.160>lot <00:05:15.300>of <00:05:15.440>the <00:05:15.580>same <00:05:15.720>effect <00:05:15.860>on <00:05:16.000>people.

90
00:05:18.120 --> 00:05:21.760
<00:05:18.120>So <00:05:18.227>the <00:05:18.335>worst <00:05:18.443>one <00:05:18.550>for <00:05:18.658>me <00:05:18.766>was <00:05:18.873>two <00:05:18.981>days <00:05:19.089>before <00:05:19.196>Christmas, <00:05:19.304>I <00:05:19.412>was <00:05:19.520>off,

91
00:05:21.940 --> 00:05:25.780
<00:05:21.940>and <00:05:22.080>I <00:05:22.219>was <00:05:22.360>about <00:05:22.500>to <00:05:22.640>enjoy <00:05:22.780>sitting <00:05:22.920>down, <00:05:23.060>eating <00:05:23.200>some <00:05:23.340>sugary

92
00:05:26.920 --> 00:05:30.800
<00:05:26.920>cereal, <00:05:27.120>and <00:05:27.320>watching <00:05:27.520>some <00:05:27.720>old <00:05:27.920>Saturday <00:05:28.120>morning <00:05:28.320>cartoons.

93
00:05:30.900 --> 00:05:34.440
<00:05:30.900>And <00:05:31.055>as <00:05:31.211>soon <00:05:31.366>as <00:05:31.522>I <00:05:31.677>sit <00:05:31.833>down <00:05:31.988>and <00:05:32.144>pour <00:05:32.299>my

94
00:05:34.480 --> 00:05:38.440
<00:05:34.480>cereal, <00:05:34.587>I <00:05:34.695>get <00:05:34.803>a <00:05:34.910>text <00:05:35.018>from <00:05:35.126>my <00:05:35.233>boss <00:05:35.341>saying, <00:05:35.449>"Hey, <00:05:35.556>we <00:05:35.664>had <00:05:35.772>a <00:05:35.880>security

95
00:05:38.480 --> 00:05:42.450
<00:05:38.480>incident. <00:05:38.587>I <00:05:38.695>need <00:05:38.803>you <00:05:38.910>to <00:05:39.018>hop <00:05:39.126>on <00:05:39.233>and <00:05:39.341>work." <00:05:39.449>And <00:05:39.556>I <00:05:39.664>spent <00:05:39.772>the <00:05:39.880>entirety

96
00:05:42.480 --> 00:05:45.720
<00:05:42.480>of <00:05:42.680>that <00:05:42.880>day <00:05:43.080>off <00:05:43.280>troubleshooting <00:05:43.480>that <00:05:43.680>security <00:05:43.880>incident.

97
00:05:46.160 --> 00:05:50.060
<00:05:46.159>I've <00:05:46.359>had <00:05:46.559>similar <00:05:46.760>incidents, <00:05:46.960>too, <00:05:47.159>with <00:05:47.359>infrastructure <00:05:47.559>failing,

98
00:05:50.140 --> 00:05:52.740
<00:05:50.140>and <00:05:50.419>everybody's <00:05:50.700>stressed <00:05:50.979>out, <00:05:51.260>everyone's <00:05:51.539>frustrated.

99
00:05:52.840 --> 00:05:55.020
<00:05:52.840>It <00:05:53.073>always <00:05:53.306>happens <00:05:53.540>at <00:05:53.773>the <00:05:54.006>worst <00:05:54.240>time.

100
00:05:55.040 --> 00:05:57.720
<00:05:55.040>And <00:05:55.180>a <00:05:55.320>lot <00:05:55.460>of <00:05:55.600>the <00:05:55.740>negative <00:05:55.880>outcomes <00:05:56.020>are <00:05:56.160>the <00:05:56.300>same, <00:05:56.440>too.

101
00:05:57.760 --> 00:06:01.530
<00:05:57.760>So <00:05:57.860>along <00:05:57.960>with <00:05:58.060>the <00:05:58.159>stress <00:05:58.260>that <00:05:58.360>it <00:05:58.460>can <00:05:58.560>cause <00:05:58.659>for <00:05:58.760>employees, <00:05:58.860>it <00:05:58.960>can <00:05:59.060>cause <00:05:59.159>financial

102
00:06:01.600 --> 00:06:05.230
<00:06:01.600>loss. <00:06:01.833>So <00:06:02.066>in <00:06:02.300>the <00:06:02.533>case <00:06:02.766>of <00:06:03.000>normal

103
00:06:05.240 --> 00:06:08.580
<00:06:05.240>observability, <00:06:05.440>it <00:06:05.640>would <00:06:05.840>be <00:06:06.040>things <00:06:06.240>like <00:06:06.440>not <00:06:06.640>meeting

104
00:06:09.100 --> 00:06:11.760
<00:06:09.100>service <00:06:09.275>level <00:06:09.450>agreements, <00:06:09.625>and <00:06:09.800>you <00:06:09.975>have <00:06:10.150>to <00:06:10.325>refund <00:06:10.500>customers.

105
00:06:11.800 --> 00:06:14.650
<00:06:11.800>In <00:06:11.955>the <00:06:12.111>case <00:06:12.266>of <00:06:12.422>security, <00:06:12.577>that <00:06:12.733>would <00:06:12.888>be <00:06:13.044>things <00:06:13.200>like

106
00:06:15.540 --> 00:06:19.240
<00:06:15.540>security <00:06:15.680>compliance <00:06:15.820>violations <00:06:15.960>where <00:06:16.100>you <00:06:16.240>have <00:06:16.380>to <00:06:16.520>pay <00:06:16.660>per <00:06:16.800>record <00:06:16.940>that's

107
00:06:19.700 --> 00:06:23.540
<00:06:19.700>violated, <00:06:19.816>and <00:06:19.933>that <00:06:20.050>can <00:06:20.166>get <00:06:20.283>expensive <00:06:20.400>very <00:06:20.516>quickly, <00:06:20.633>and <00:06:20.750>it <00:06:20.866>could <00:06:20.983>even <00:06:21.099>go

108
00:06:23.640 --> 00:06:26.520
<00:06:23.640>up <00:06:23.919>depending <00:06:24.200>on <00:06:24.479>how <00:06:24.760>severe <00:06:25.039>this

109
00:06:28.332 --> 00:06:30.362
<00:06:28.332>How <00:06:28.682>insecure <00:06:29.032>the <00:06:29.382>infrastructure <00:06:29.732>was.

110
00:06:31.032 --> 00:06:32.952
<00:06:31.032>And <00:06:31.311>there's <00:06:31.592>also <00:06:31.871>the <00:06:32.152>reputational <00:06:32.431>damage.

111
00:06:33.052 --> 00:06:37.022
<00:06:33.052>People <00:06:33.285>are <00:06:33.518>absolutely <00:06:33.752>ruthless <00:06:33.985>online <00:06:34.218>and <00:06:34.452>will

112
00:06:37.092 --> 00:06:38.132
<00:06:37.092>post <00:06:38.028>your

113
00:06:39.492 --> 00:06:42.852
<00:06:39.492>availability <00:06:39.692>in <00:06:39.892>memes, <00:06:40.092>and <00:06:40.292>they'll <00:06:40.492>tear <00:06:40.692>apart <00:06:40.892>your

114
00:06:42.892 --> 00:06:46.882
<00:06:42.892>postmortems <00:06:43.019>and <00:06:43.146>point <00:06:43.273>out <00:06:43.401>every <00:06:43.528>little <00:06:43.655>thing <00:06:43.782>you <00:06:43.910>did <00:06:44.037>wrong <00:06:44.164>in <00:06:44.292>security.

115
00:06:46.932 --> 00:06:50.892
<00:06:46.932>And <00:06:47.059>that <00:06:47.186>can <00:06:47.313>cause <00:06:47.441>a <00:06:47.568>lot <00:06:47.695>of <00:06:47.822>damage <00:06:47.950>to <00:06:48.077>your <00:06:48.204>brand, <00:06:48.332>and

116
00:06:50.952 --> 00:06:54.752
<00:06:50.952>if <00:06:51.092>you're <00:06:51.232>on <00:06:51.372>those <00:06:51.512>teams, <00:06:51.652>I'm <00:06:51.792>sure <00:06:51.932>it's <00:06:52.072>not <00:06:52.212>fun <00:06:52.352>to

117
00:06:54.832 --> 00:06:58.312
<00:06:54.832>hear <00:06:55.032>people <00:06:55.232>talk <00:06:55.432>about <00:06:55.632>you <00:06:55.832>like <00:06:56.032>that <00:06:56.232>either.

118
00:06:59.252 --> 00:07:03.222
<00:06:59.252>So <00:06:59.359>we <00:06:59.467>have <00:06:59.575>a <00:06:59.682>lot <00:06:59.790>of <00:06:59.898>the <00:07:00.005>same <00:07:00.113>challenges, <00:07:00.221>problems, <00:07:00.328>and <00:07:00.436>we're <00:07:00.544>using <00:07:00.652>a

119
00:07:03.272 --> 00:07:06.572
<00:07:03.272>lot <00:07:03.379>of <00:07:03.487>the <00:07:03.595>same <00:07:03.702>abstractions <00:07:03.810>to <00:07:03.918>deal <00:07:04.025>with <00:07:04.133>them, <00:07:04.241>but <00:07:04.348>we <00:07:04.456>use <00:07:04.564>entirely <00:07:04.671>separate

120
00:07:06.582 --> 00:07:09.772
<00:07:06.582>tooling, <00:07:06.815>which <00:07:07.048>causes <00:07:07.282>a <00:07:07.515>lot <00:07:07.748>of <00:07:07.982>problems.

121
00:07:09.801 --> 00:07:09.952
The

122
00:07:11.392 --> 00:07:15.232
<00:07:11.392>first <00:07:11.519>one <00:07:11.646>is <00:07:11.773>agent <00:07:11.901>fatigue. <00:07:12.028>Agent, <00:07:12.155>in <00:07:12.282>this <00:07:12.410>case, <00:07:12.537>being <00:07:12.664>a <00:07:12.792>tool

123
00:07:15.312 --> 00:07:19.212
<00:07:15.312>on <00:07:15.487>a <00:07:15.662>machine <00:07:15.837>that's <00:07:16.012>collecting <00:07:16.187>telemetry <00:07:16.362>or <00:07:16.537>detecting <00:07:16.712>for

124
00:07:19.232 --> 00:07:20.052
<00:07:19.232>security <00:07:19.970>events.

125
00:07:21.292 --> 00:07:24.722
<00:07:21.292>In <00:07:21.447>a <00:07:21.603>lot <00:07:21.758>of <00:07:21.914>environments, <00:07:22.069>the <00:07:22.225>tool <00:07:22.380>that <00:07:22.536>is <00:07:22.692>collecting

126
00:07:24.722 --> 00:07:26.592
<00:07:24.722>telemetry <00:07:26.121>for

127
00:07:27.532 --> 00:07:31.212
<00:07:27.532>CPU <00:07:27.707>utilization <00:07:27.882>or <00:07:28.056>application <00:07:28.232>metrics <00:07:28.407>and <00:07:28.582>traces <00:07:28.757>and <00:07:28.931>logs,

128
00:07:32.072 --> 00:07:35.732
<00:07:32.072>that <00:07:32.188>is <00:07:32.305>going <00:07:32.422>to <00:07:32.538>be <00:07:32.655>a <00:07:32.772>different <00:07:32.888>package <00:07:33.005>than <00:07:33.122>an <00:07:33.238>endpoint <00:07:33.355>detection <00:07:33.472>tool,

129
00:07:35.872 --> 00:07:39.072
<00:07:35.872>and <00:07:36.047>usually, <00:07:36.222>the <00:07:36.397>logs <00:07:36.572>that <00:07:36.747>the <00:07:36.922>security <00:07:37.097>team <00:07:37.272>is

130
00:07:39.652 --> 00:07:43.392
<00:07:39.652>looking <00:07:39.807>at <00:07:39.963>is <00:07:40.118>collected <00:07:40.274>through <00:07:40.429>a <00:07:40.585>different <00:07:40.740>process <00:07:40.896>than <00:07:41.051>the

131
00:07:43.932 --> 00:07:47.272
<00:07:43.932>logs <00:07:44.072>that <00:07:44.212>the <00:07:44.352>infrastructure <00:07:44.492>team <00:07:44.632>and <00:07:44.772>that <00:07:44.912>the <00:07:45.052>developers <00:07:45.192>are <00:07:45.332>looking

132
00:07:47.332 --> 00:07:51.312
<00:07:47.332>at. <00:07:47.425>And <00:07:47.518>along <00:07:47.611>with <00:07:47.705>having <00:07:47.798>those <00:07:47.892>agents <00:07:47.985>that <00:07:48.078>have <00:07:48.171>to <00:07:48.265>be <00:07:48.358>up <00:07:48.452>to <00:07:48.545>date, <00:07:48.638>they <00:07:48.732>have

133
00:07:51.352 --> 00:07:55.282
<00:07:51.352>to <00:07:51.459>be <00:07:51.567>maintained <00:07:51.675>and <00:07:51.782>all <00:07:51.890>their <00:07:51.998>configurations <00:07:52.105>be <00:07:52.213>kept <00:07:52.321>up <00:07:52.428>to <00:07:52.536>date, <00:07:52.644>they <00:07:52.751>need

134
00:07:55.292 --> 00:07:56.902
<00:07:55.292>to <00:07:55.525>bring <00:07:55.758>along <00:07:55.992>some <00:07:56.225>libraries <00:07:56.458>with <00:07:56.692>them.

135
00:07:57.672 --> 00:08:00.652
<00:07:57.672>So <00:07:57.779>if <00:07:57.887>you're <00:07:57.995>using <00:07:58.102>open <00:07:58.210>telemetry, <00:07:58.318>that <00:07:58.425>would <00:07:58.533>be <00:07:58.641>things <00:07:58.748>like <00:07:58.856>the <00:07:58.964>open <00:07:59.072>telemetry

136
00:08:00.732 --> 00:08:04.612
<00:08:00.732>SDKs. <00:08:00.887>If <00:08:01.043>you're <00:08:01.198>an <00:08:01.354>infrastructure <00:08:01.509>person, <00:08:01.665>that <00:08:01.820>would <00:08:01.976>be <00:08:02.132>things

137
00:08:04.692 --> 00:08:08.612
<00:08:04.692>like <00:08:04.819>having <00:08:04.946>to <00:08:05.073>make <00:08:05.201>sure <00:08:05.328>Smartmontools <00:08:05.455>are <00:08:05.582>available <00:08:05.710>on <00:08:05.837>the <00:08:05.964>machine, <00:08:06.092>or

138
00:08:08.912 --> 00:08:10.292
<00:08:08.912>the <00:08:09.532>GPU <00:08:10.154>SDKs

139
00:08:11.332 --> 00:08:13.592
<00:08:11.332>need <00:08:11.487>to <00:08:11.643>be <00:08:11.798>present <00:08:11.954>in <00:08:12.109>order <00:08:12.265>to <00:08:12.420>collect <00:08:12.576>that <00:08:12.732>data.

140
00:08:14.892 --> 00:08:17.632
<00:08:14.892>And <00:08:15.092>they <00:08:15.292>can <00:08:15.492>even <00:08:15.692>interfere <00:08:15.892>with <00:08:16.092>each <00:08:16.292>other.

141
00:08:18.312 --> 00:08:21.612
<00:08:18.312>So <00:08:18.412>because <00:08:18.512>these <00:08:18.612>tools <00:08:18.712>are <00:08:18.812>looking <00:08:18.912>at <00:08:19.012>a <00:08:19.112>lot <00:08:19.212>of <00:08:19.312>the <00:08:19.412>same <00:08:19.512>things, <00:08:19.612>they <00:08:19.712>might

142
00:08:22.152 --> 00:08:26.112
<00:08:22.152>set <00:08:22.307>conflicting <00:08:22.463>permissions <00:08:22.618>on <00:08:22.774>a <00:08:22.929>directory, <00:08:23.085>or <00:08:23.240>you <00:08:23.396>might <00:08:23.551>assume

143
00:08:26.212 --> 00:08:29.342
<00:08:26.212>that <00:08:26.412>an <00:08:26.611>observability <00:08:26.812>process <00:08:27.012>is <00:08:27.212>actually <00:08:27.412>malware <00:08:27.611>running.

144
00:08:30.432 --> 00:08:33.793
<00:08:30.432>An <00:08:30.559>example <00:08:30.686>of <00:08:30.813>this <00:08:30.941>that <00:08:31.068>happened <00:08:31.195>to <00:08:31.322>me <00:08:31.450>was <00:08:31.577>I <00:08:31.704>had <00:08:31.832>forgotten

145
00:08:33.852 --> 00:08:37.472
<00:08:33.852>that <00:08:34.085>because <00:08:34.318>of <00:08:34.552>how <00:08:34.785>Windows <00:08:35.018>collects <00:08:35.251>GPU

146
00:08:37.512 --> 00:08:41.072
<00:08:37.511>metrics <00:08:37.628>is <00:08:37.745>kind <00:08:37.861>of <00:08:37.978>strange, <00:08:38.095>I <00:08:38.212>ended <00:08:38.328>up <00:08:38.445>having <00:08:38.561>to <00:08:38.678>use <00:08:38.795>a <00:08:38.911>Base64

147
00:08:41.092 --> 00:08:45.032
<00:08:41.092>encoded <00:08:41.199>PowerShell <00:08:41.307>command <00:08:41.415>to <00:08:41.522>get <00:08:41.630>GPU <00:08:41.738>metrics <00:08:41.845>in <00:08:41.953>the <00:08:42.061>format <00:08:42.168>that <00:08:42.276>made <00:08:42.384>sense <00:08:42.491>to

148
00:08:45.072 --> 00:08:46.012
me.

149
00:08:47.072 --> 00:08:50.692
<00:08:47.072>And <00:08:47.165>I <00:08:47.258>was <00:08:47.352>looking <00:08:47.445>through <00:08:47.538>the <00:08:47.632>logs <00:08:47.725>one <00:08:47.818>day <00:08:47.912>in <00:08:48.005>ShiftMon <00:08:48.098>and <00:08:48.192>noticed <00:08:48.285>that <00:08:48.378>there's <00:08:48.472>a

150
00:08:50.732 --> 00:08:54.672
<00:08:50.732>lot <00:08:50.887>of <00:08:51.043>PowerShell <00:08:51.198>commands <00:08:51.354>that <00:08:51.509>are <00:08:51.665>running <00:08:51.820>every <00:08:51.976>few <00:08:52.132>seconds

151
00:08:56.352 --> 00:08:57.892
<00:08:56.352>on <00:08:56.550>all <00:08:56.748>the <00:08:56.946>Windows <00:08:57.144>machines <00:08:57.342>in <00:08:57.540>my <00:08:57.738>fleet.

152
00:08:57.992 --> 00:09:01.781
<00:08:57.992>This <00:08:58.166>is <00:08:58.342>not <00:08:58.516>a <00:08:58.692>great <00:08:58.867>situation. <00:08:59.041>And <00:08:59.217>then <00:08:59.391>I

153
00:09:01.832 --> 00:09:05.342
<00:09:01.832>ended <00:09:02.112>up <00:09:02.391>realizing <00:09:02.672>that <00:09:02.952>it <00:09:03.232>was

154
00:09:05.392 --> 00:09:09.172
<00:09:05.392>the <00:09:05.519>agent <00:09:05.646>that <00:09:05.773>ShiftMon <00:09:05.901>uses <00:09:06.028>for <00:09:06.155>collecting <00:09:06.282>metrics <00:09:06.410>that <00:09:06.537>was <00:09:06.664>the <00:09:06.792>issue.

155
00:09:10.512 --> 00:09:13.992
<00:09:10.512>Another <00:09:10.599>thing <00:09:10.686>that <00:09:10.774>I <00:09:10.862>can <00:09:10.949>see <00:09:11.036>happen <00:09:11.124>a <00:09:11.212>lot <00:09:11.299>is <00:09:11.387>agents <00:09:11.474>are <00:09:11.561>a <00:09:11.649>great <00:09:11.737>place <00:09:11.824>to <00:09:11.911>put

156
00:09:14.012 --> 00:09:17.721
<00:09:14.012>blame. <00:09:14.186>So <00:09:14.362>when <00:09:14.536>an <00:09:14.712>application <00:09:14.887>is <00:09:15.061>slow <00:09:15.237>or <00:09:15.411>you're

157
00:09:17.732 --> 00:09:21.362
<00:09:17.732>needing <00:09:17.965>to <00:09:18.198>size <00:09:18.432>up <00:09:18.665>instances, <00:09:18.898>basically <00:09:19.132>anything

158
00:09:21.432 --> 00:09:24.952
<00:09:21.432>performance <00:09:21.539>related, <00:09:21.647>if <00:09:21.755>you <00:09:21.862>have <00:09:21.970>multiple <00:09:22.078>agents <00:09:22.185>on <00:09:22.293>a <00:09:22.401>machine, <00:09:22.508>there <00:09:22.616>will <00:09:22.724>be <00:09:22.832>some

159
00:09:24.972 --> 00:09:27.972
<00:09:24.972>blame <00:09:25.205>assigned <00:09:25.438>to <00:09:25.672>it <00:09:25.905>because <00:09:26.138>it's <00:09:26.372>a

160
00:09:29.092 --> 00:09:32.992
<00:09:29.092>really <00:09:29.208>easy <00:09:29.325>and <00:09:29.442>convenient <00:09:29.558>excuse, <00:09:29.675>and <00:09:29.792>the <00:09:29.908>more <00:09:30.025>agents <00:09:30.141>you <00:09:30.258>have, <00:09:30.375>the <00:09:30.492>easier

161
00:09:33.032 --> 00:09:36.092
<00:09:33.032>it <00:09:33.159>is <00:09:33.286>to <00:09:33.413>do <00:09:33.541>it <00:09:33.668>because <00:09:33.795>it <00:09:33.922>can <00:09:34.050>add <00:09:34.177>up <00:09:34.304>pretty <00:09:34.432>quickly.

162
00:09:36.472 --> 00:09:38.842
<00:09:36.472>Sometimes <00:09:36.672>it's <00:09:36.872>people <00:09:37.072>being <00:09:37.271>lazy, <00:09:37.472>but <00:09:37.672>other <00:09:37.872>times,

163
00:09:39.932 --> 00:09:43.182
<00:09:39.932>you <00:09:40.072>have <00:09:40.212>multiple <00:09:40.352>agents <00:09:40.492>that <00:09:40.632>are <00:09:40.772>taking <00:09:40.912>up <00:09:41.052>all <00:09:41.192>of <00:09:41.332>your

164
00:09:43.192 --> 00:09:46.721
<00:09:43.192>resources, <00:09:43.319>and <00:09:43.446>it <00:09:43.573>requires <00:09:43.701>more <00:09:43.828>expensive <00:09:43.955>hardware <00:09:44.082>to <00:09:44.210>get <00:09:44.337>your <00:09:44.464>job <00:09:44.592>done.

165
00:09:49.332 --> 00:09:51.792
<00:09:49.332>Another <00:09:49.507>thing <00:09:49.682>that <00:09:49.857>happens, <00:09:50.032>too, <00:09:50.207>is <00:09:50.382>duplication <00:09:50.557>of <00:09:50.732>effort.

166
00:09:52.252 --> 00:09:55.642
<00:09:52.252>So <00:09:52.407>along <00:09:52.563>with <00:09:52.718>having <00:09:52.874>to <00:09:53.029>maintain <00:09:53.185>multiple <00:09:53.340>tools <00:09:53.496>for <00:09:53.651>collecting

167
00:09:55.712 --> 00:09:59.632
<00:09:55.712>telemetry <00:09:55.839>and <00:09:55.966>keeping <00:09:56.093>those <00:09:56.221>up <00:09:56.348>to <00:09:56.475>date <00:09:56.602>and <00:09:56.730>deployed <00:09:56.857>to <00:09:56.984>your <00:09:57.112>entire

168
00:09:59.672 --> 00:10:03.552
<00:09:59.672>fleet, <00:09:59.847>you <00:10:00.022>also <00:10:00.197>have <00:10:00.372>to <00:10:00.547>maintain <00:10:00.722>the <00:10:00.897>storage <00:10:01.072>for

169
00:10:03.632 --> 00:10:07.392
<00:10:03.632>all <00:10:03.732>that <00:10:03.832>and <00:10:03.931>the <00:10:04.031>compute <00:10:04.132>and <00:10:04.232>all <00:10:04.332>the <00:10:04.431>processing <00:10:04.531>that <00:10:04.632>happens <00:10:04.732>to <00:10:04.832>that <00:10:04.931>telemetry <00:10:05.031>when

170
00:10:07.412 --> 00:10:10.892
<00:10:07.412>it <00:10:07.645>gets <00:10:07.878>stored, <00:10:08.112>which <00:10:08.345>can <00:10:08.578>be <00:10:08.812>extremely

171
00:10:10.932 --> 00:10:14.762
<00:10:10.932>expensive, <00:10:11.048>especially <00:10:11.165>if <00:10:11.282>you're <00:10:11.398>in <00:10:11.515>a <00:10:11.632>public <00:10:11.748>cloud <00:10:11.865>where <00:10:11.982>the <00:10:12.098>most <00:10:12.215>expensive <00:10:12.332>things

172
00:10:14.812 --> 00:10:18.412
<00:10:14.812>you <00:10:14.939>can <00:10:15.066>do <00:10:15.193>are <00:10:15.321>store <00:10:15.448>data <00:10:15.575>for <00:10:15.702>a <00:10:15.830>long <00:10:15.957>time <00:10:16.084>and <00:10:16.212>transfer.

173
00:10:18.472 --> 00:10:22.352
<00:10:18.472>And <00:10:18.646>that's <00:10:18.822>essentially <00:10:18.997>what <00:10:19.172>observability <00:10:19.347>is, <00:10:19.521>is <00:10:19.697>you're <00:10:19.872>sending

174
00:10:22.392 --> 00:10:26.132
<00:10:22.392>data <00:10:22.567>from <00:10:22.742>a <00:10:22.917>lot <00:10:23.092>of <00:10:23.267>disparate <00:10:23.442>places <00:10:23.617>into <00:10:23.792>a

175
00:10:26.452 --> 00:10:30.392
<00:10:26.452>semi-centralized <00:10:26.627>or <00:10:26.802>fully <00:10:26.977>centralized <00:10:27.152>location, <00:10:27.327>and <00:10:27.502>then <00:10:27.677>storing <00:10:27.852>that

176
00:10:30.472 --> 00:10:32.292
<00:10:30.472>data <00:10:30.705>for <00:10:30.938>a <00:10:31.172>significant <00:10:31.405>amount <00:10:31.638>of <00:10:31.872>time.

177
00:10:33.392 --> 00:10:37.172
<00:10:33.392>Another <00:10:33.508>problem <00:10:33.625>that <00:10:33.742>duplication <00:10:33.858>of <00:10:33.975>effort <00:10:34.092>can <00:10:34.208>cause <00:10:34.325>is <00:10:34.442>having <00:10:34.558>an <00:10:34.675>increased <00:10:34.792>threat

178
00:10:37.252 --> 00:10:40.982
<00:10:37.252>surface. <00:10:37.407>So <00:10:37.563>because <00:10:37.718>we <00:10:37.874>want <00:10:38.029>these <00:10:38.185>tools <00:10:38.340>to <00:10:38.496>get <00:10:38.651>into

179
00:10:41.032 --> 00:10:45.001
<00:10:41.032>every <00:10:41.148>nook <00:10:41.265>and <00:10:41.382>cranny <00:10:41.498>of <00:10:41.615>our <00:10:41.732>systems <00:10:41.848>and <00:10:41.965>see <00:10:42.082>every <00:10:42.198>little <00:10:42.315>thing <00:10:42.432>going

180
00:10:45.052 --> 00:10:49.032
<00:10:45.052>on <00:10:45.152>in <00:10:45.252>our <00:10:45.352>applications, <00:10:45.452>they <00:10:45.552>have <00:10:45.652>to <00:10:45.752>run <00:10:45.852>with <00:10:45.952>a <00:10:46.052>pretty <00:10:46.152>high <00:10:46.252>level <00:10:46.352>of <00:10:46.452>privilege.

181
00:10:49.732 --> 00:10:50.131
And

182
00:10:51.152 --> 00:10:54.652
<00:10:51.152>these <00:10:51.307>commands, <00:10:51.463>like <00:10:51.618>I <00:10:51.774>was <00:10:51.929>mentioning <00:10:52.085>earlier, <00:10:52.240>can <00:10:52.396>run <00:10:52.552>arbitrary

183
00:10:54.732 --> 00:10:58.512
<00:10:54.732>commands <00:10:54.839>in <00:10:54.947>order <00:10:55.055>to <00:10:55.162>do <00:10:55.270>their <00:10:55.378>job. <00:10:55.485>And <00:10:55.593>so <00:10:55.701>if <00:10:55.808>somebody <00:10:55.916>could <00:10:56.024>replace <00:10:56.132>those

184
00:10:58.572 --> 00:11:02.192
<00:10:58.572>commands <00:10:58.772>or <00:10:58.972>sneakily <00:10:59.172>change <00:10:59.372>what <00:10:59.572>command <00:10:59.772>is <00:10:59.972>being

185
00:11:02.232 --> 00:11:05.652
<00:11:02.232>Base64 <00:11:02.406>encoded, <00:11:02.582>it <00:11:02.757>can <00:11:02.932>be <00:11:03.107>really <00:11:03.281>hard <00:11:03.457>to <00:11:03.632>detect

186
00:11:05.692 --> 00:11:07.272
<00:11:05.692>something <00:11:06.042>bad <00:11:06.392>going <00:11:06.742>on <00:11:07.092>in

187
00:11:09.052 --> 00:11:12.712
<00:11:09.052>those <00:11:09.168>devices. <00:11:09.285>So <00:11:09.402>having <00:11:09.518>all <00:11:09.635>these <00:11:09.752>agents <00:11:09.868>can <00:11:09.985>be <00:11:10.102>a <00:11:10.218>security <00:11:10.335>risk <00:11:10.452>as

188
00:11:12.752 --> 00:11:16.272
<00:11:12.752>well. <00:11:13.031>Another <00:11:13.311>problem, <00:11:13.592>going <00:11:13.872>back <00:11:14.151>to

189
00:11:16.352 --> 00:11:20.212
<00:11:16.352>incidents, <00:11:16.585>is <00:11:16.818>you <00:11:17.052>have <00:11:17.285>so <00:11:17.518>many <00:11:17.752>different

190
00:11:20.272 --> 00:11:22.892
<00:11:20.272>tools <00:11:20.399>open, <00:11:20.526>it <00:11:20.653>can <00:11:20.781>be <00:11:20.908>hard <00:11:21.035>to <00:11:21.162>figure <00:11:21.290>out <00:11:21.417>what's <00:11:21.544>going <00:11:21.672>on.

191
00:11:23.352 --> 00:11:27.272
<00:11:23.352>So <00:11:23.452>going <00:11:23.552>back <00:11:23.651>to <00:11:23.752>the <00:11:23.852>Soggy <00:11:23.952>Crunch <00:11:24.052>Berry <00:11:24.151>incident <00:11:24.252>that <00:11:24.352>I <00:11:24.452>was <00:11:24.552>talking <00:11:24.651>about <00:11:24.752>earlier,

192
00:11:27.952 --> 00:11:30.592
<00:11:27.952>I <00:11:28.152>was <00:11:28.352>having <00:11:28.552>to <00:11:28.752>look <00:11:28.952>through <00:11:29.152>different <00:11:29.352>tools

193
00:11:31.612 --> 00:11:35.532
<00:11:31.612>for <00:11:31.739>the <00:11:31.866>security <00:11:31.993>logs, <00:11:32.121>different <00:11:32.248>tools <00:11:32.375>for <00:11:32.502>the <00:11:32.630>access <00:11:32.757>log <00:11:32.884>for <00:11:33.012>IIS,

194
00:11:36.092 --> 00:11:38.752
<00:11:36.092>where <00:11:36.292>it's <00:11:36.492>happening. <00:11:36.692>And <00:11:36.891>this <00:11:37.092>isn't <00:11:37.292>when <00:11:37.492>I'm

195
00:11:39.952 --> 00:11:41.472
<00:11:39.952>expected <00:11:40.408>to <00:11:40.864>be <00:11:41.319>working,

196
00:11:42.532 --> 00:11:44.232
<00:11:42.532>I've <00:11:42.707>had <00:11:42.882>my <00:11:43.057>coffee <00:11:43.232>for <00:11:43.407>the <00:11:43.582>day <00:11:43.757>and <00:11:43.932>everything.

197
00:11:44.852 --> 00:11:48.822
<00:11:44.852>I'm <00:11:44.945>in <00:11:45.038>the <00:11:45.132>state <00:11:45.225>where <00:11:45.318>I <00:11:45.411>was <00:11:45.505>going <00:11:45.598>to <00:11:45.692>spend <00:11:45.785>time <00:11:45.878>with <00:11:45.972>my <00:11:46.065>family <00:11:46.158>all <00:11:46.252>day,

198
00:11:48.952 --> 00:11:52.692
<00:11:48.952>watching <00:11:49.068>cartoons <00:11:49.185>and <00:11:49.302>eating <00:11:49.418>junk <00:11:49.535>cereal, <00:11:49.652>and <00:11:49.768>now <00:11:49.885>I'm <00:11:50.002>having <00:11:50.118>to <00:11:50.235>work <00:11:50.352>all

199
00:11:52.772 --> 00:11:56.352
<00:11:52.772>day <00:11:52.927>because <00:11:53.083>I'm <00:11:53.238>having <00:11:53.394>to <00:11:53.549>deal <00:11:53.705>with <00:11:53.860>a <00:11:54.016>security <00:11:54.172>incident.

200
00:11:56.952 --> 00:11:59.922
<00:11:56.952>So <00:11:57.079>your <00:11:57.206>brain's <00:11:57.333>already <00:11:57.461>degraded, <00:11:57.588>and <00:11:57.715>you're <00:11:57.842>having <00:11:57.970>to <00:11:58.097>deal <00:11:58.224>with <00:11:58.352>tools

201
00:12:00.032 --> 00:12:03.872
<00:12:00.032>in <00:12:00.187>20 <00:12:00.343>different <00:12:00.498>places. <00:12:00.654>And <00:12:00.809>if <00:12:00.965>it's <00:12:01.120>your <00:12:01.276>first <00:12:01.432>time

202
00:12:03.892 --> 00:12:07.442
<00:12:03.892>being <00:12:04.019>brought <00:12:04.146>onto <00:12:04.273>an <00:12:04.401>infrastructure <00:12:04.528>or <00:12:04.655>security <00:12:04.782>incident, <00:12:04.910>you <00:12:05.037>might <00:12:05.164>not <00:12:05.292>have

203
00:12:07.512 --> 00:12:11.432
<00:12:07.512>access <00:12:07.612>to <00:12:07.712>the <00:12:07.811>tools <00:12:07.911>you <00:12:08.012>need. <00:12:08.112>So <00:12:08.212>when <00:12:08.311>time's <00:12:08.411>at <00:12:08.512>a <00:12:08.612>premium <00:12:08.712>and <00:12:08.811>everyone's <00:12:08.911>in

204
00:12:11.472 --> 00:12:15.432
<00:12:11.472>a <00:12:11.627>degraded <00:12:11.783>state, <00:12:11.938>you're <00:12:12.094>having <00:12:12.249>to <00:12:12.405>chase <00:12:12.560>around <00:12:12.716>the <00:12:12.872>owners

205
00:12:15.472 --> 00:12:17.152
<00:12:15.472>of <00:12:15.672>those <00:12:15.872>tools <00:12:16.072>in <00:12:16.271>order <00:12:16.472>to <00:12:16.672>get <00:12:16.872>access.

206
00:12:19.572 --> 00:12:22.372
<00:12:19.572>Another <00:12:19.772>problem <00:12:19.972>that <00:12:20.172>can <00:12:20.372>happen <00:12:20.572>is <00:12:20.772>different <00:12:20.972>teams

207
00:12:23.212 --> 00:12:24.172
are

208
00:12:26.212 --> 00:12:27.572
<00:12:26.212>seeing <00:12:26.415>a <00:12:26.620>different <00:12:26.824>view <00:12:27.028>of <00:12:27.232>the <00:12:27.436>world.

209
00:12:28.152 --> 00:12:30.732
<00:12:28.152>So <00:12:28.327>even <00:12:28.502>though <00:12:28.677>you're <00:12:28.852>duplicating <00:12:29.027>a <00:12:29.202>lot <00:12:29.377>of <00:12:29.552>data

210
00:12:31.652 --> 00:12:35.432
<00:12:31.652>The <00:12:31.807>infrastructure <00:12:31.963>team <00:12:32.118>might <00:12:32.274>think <00:12:32.429>that, <00:12:32.585>oh, <00:12:32.740>cool, <00:12:32.896>this <00:12:33.052>application's

211
00:12:35.512 --> 00:12:37.782
<00:12:35.512>working, <00:12:35.791>it's <00:12:36.071>performant, <00:12:36.352>and <00:12:36.632>everything's <00:12:36.911>great.

212
00:12:37.832 --> 00:12:41.152
<00:12:37.832>And <00:12:37.948>the <00:12:38.065>security <00:12:38.182>scan <00:12:38.298>results <00:12:38.415>that <00:12:38.532>live <00:12:38.648>in <00:12:38.765>an <00:12:38.882>entirely <00:12:38.998>separate <00:12:39.115>tool <00:12:39.232>and

213
00:12:41.192 --> 00:12:45.012
<00:12:41.192>are <00:12:41.308>looked <00:12:41.425>at <00:12:41.542>by <00:12:41.658>a <00:12:41.775>different <00:12:41.892>team <00:12:42.008>are <00:12:42.125>going <00:12:42.242>to <00:12:42.358>see <00:12:42.475>that, <00:12:42.592>oh,

214
00:12:45.232 --> 00:12:47.632
<00:12:45.232>hey, <00:12:45.432>this <00:12:45.632>library <00:12:45.832>update <00:12:46.031>had <00:12:46.232>malware <00:12:46.432>in <00:12:46.632>it.

215
00:12:48.212 --> 00:12:52.112
<00:12:48.212>And <00:12:48.339>if <00:12:48.466>you're <00:12:48.593>not <00:12:48.721>making <00:12:48.848>those <00:12:48.975>tools <00:12:49.102>visible <00:12:49.230>to <00:12:49.357>the <00:12:49.484>right <00:12:49.612>people,

216
00:12:54.072 --> 00:12:58.052
<00:12:54.072>everybody <00:12:54.212>can <00:12:54.352>think <00:12:54.492>that <00:12:54.632>everything's <00:12:54.772>okay <00:12:54.912>because <00:12:55.052>their <00:12:55.192>small <00:12:55.332>view <00:12:55.472>of

217
00:12:58.072 --> 00:13:01.692
<00:12:58.072>the <00:12:58.212>world <00:12:58.352>is <00:12:58.492>fine, <00:12:58.632>but <00:12:58.772>in <00:12:58.912>reality, <00:12:59.052>things <00:12:59.192>are <00:12:59.332>going <00:12:59.472>wrong.

218
00:13:01.862 --> 00:13:05.832
<00:13:01.862>And <00:13:02.017>it <00:13:02.173>isn't <00:13:02.328>just <00:13:02.484>ops <00:13:02.639>and <00:13:02.795>dev <00:13:02.950>people <00:13:03.106>not <00:13:03.262>looking

219
00:13:05.872 --> 00:13:09.512
<00:13:05.872>at <00:13:06.046>security <00:13:06.222>use <00:13:06.396>cases. <00:13:06.572>There's <00:13:06.747>been <00:13:06.921>multiple <00:13:07.097>times <00:13:07.271>where

220
00:13:10.212 --> 00:13:13.412
<00:13:10.212>vulnerability <00:13:10.562>assessments <00:13:10.912>have <00:13:11.262>caused <00:13:11.612>fun

221
00:13:13.472 --> 00:13:16.912
<00:13:13.472>issues <00:13:13.938>for <00:13:14.405>operations <00:13:14.872>and

222
00:13:16.932 --> 00:13:17.852
<00:13:16.932>developers <00:13:17.346>as <00:13:17.760>well.

223
00:13:19.472 --> 00:13:23.172
<00:13:19.472>And <00:13:19.588>having <00:13:19.705>all <00:13:19.822>that <00:13:19.938>information <00:13:20.055>in <00:13:20.172>one <00:13:20.288>place <00:13:20.405>makes <00:13:20.521>it <00:13:20.638>easy <00:13:20.755>so <00:13:20.872>that

224
00:13:23.232 --> 00:13:26.392
<00:13:23.232>way, <00:13:23.465>hey, <00:13:23.698>this <00:13:23.932>penetration <00:13:24.165>test <00:13:24.398>is <00:13:24.632>causing

225
00:13:27.132 --> 00:13:28.612
<00:13:27.132>error <00:13:27.353>rates <00:13:27.575>to <00:13:27.798>spike <00:13:28.020>on <00:13:28.242>the <00:13:28.464>application.

226
00:13:28.712 --> 00:13:31.632
<00:13:28.712>Can <00:13:28.912>you <00:13:29.112>guys <00:13:29.312>slow <00:13:29.512>down <00:13:29.712>or <00:13:29.912>chill <00:13:30.112>out?

227
00:13:34.752 --> 00:13:38.432
<00:13:34.752>So <00:13:34.879>if <00:13:35.006>we <00:13:35.133>have <00:13:35.261>all <00:13:35.388>these <00:13:35.515>problems <00:13:35.642>where <00:13:35.770>teams <00:13:35.897>are <00:13:36.024>not <00:13:36.151>aware

228
00:13:38.452 --> 00:13:42.082
<00:13:38.452>of <00:13:38.592>the <00:13:38.732>issues <00:13:38.872>that <00:13:39.012>they're <00:13:39.152>causing <00:13:39.292>for <00:13:39.432>each <00:13:39.572>other, <00:13:39.712>we <00:13:39.852>have

229
00:13:42.132 --> 00:13:45.812
<00:13:42.132>issues <00:13:42.271>where <00:13:42.411>we're <00:13:42.551>having <00:13:42.691>five <00:13:42.832>different <00:13:42.972>agents <00:13:43.112>installed <00:13:43.252>on <00:13:43.391>everyone's <00:13:43.531>machine.

230
00:13:45.852 --> 00:13:47.832
<00:13:45.852>Why <00:13:46.085>aren't <00:13:46.318>we <00:13:46.552>combining <00:13:46.785>these <00:13:47.018>tools <00:13:47.252>together?

231
00:13:49.052 --> 00:13:51.622
<00:13:49.052>And <00:13:49.159>I <00:13:49.267>think <00:13:49.375>a <00:13:49.482>lot <00:13:49.590>of <00:13:49.698>it <00:13:49.805>has <00:13:49.913>to <00:13:50.021>do <00:13:50.128>with <00:13:50.236>how <00:13:50.344>these <00:13:50.452>tools

232
00:13:52.452 --> 00:13:56.292
<00:13:52.452>grew <00:13:52.607>up. <00:13:52.763>If <00:13:52.918>you <00:13:53.074>look <00:13:53.229>at <00:13:53.385>a <00:13:53.540>lot <00:13:53.696>of <00:13:53.852>monitoring

233
00:13:56.352 --> 00:14:00.112
<00:13:56.352>tools, <00:13:56.585>they <00:13:56.818>date <00:13:57.052>back <00:13:57.285>to <00:13:57.518>something <00:13:57.752>like

234
00:14:00.132 --> 00:14:03.872
<00:14:00.132>Zabbix <00:14:00.287>or <00:14:00.443>Nagios, <00:14:00.598>where <00:14:00.754>an <00:14:00.909>agent <00:14:01.065>is <00:14:01.220>checking <00:14:01.376>for <00:14:01.531>a

235
00:14:03.912 --> 00:14:07.792
<00:14:03.912>pass-fail <00:14:04.039>style <00:14:04.166>check, <00:14:04.293>so <00:14:04.421>the <00:14:04.548>application <00:14:04.675>is <00:14:04.802>either <00:14:04.930>up <00:14:05.057>or <00:14:05.184>down, <00:14:05.312>the

236
00:14:07.832 --> 00:14:11.432
<00:14:07.832>disk <00:14:08.032>is <00:14:08.232>either <00:14:08.432>above <00:14:08.632>80% <00:14:08.832>full <00:14:09.032>or <00:14:09.232>below

237
00:14:11.512 --> 00:14:15.452
<00:14:11.512>80% <00:14:11.686>full. <00:14:11.862>And <00:14:12.036>security <00:14:12.212>incident <00:14:12.387>and <00:14:12.561>event <00:14:12.737>monitoring <00:14:12.911>started

238
00:14:15.572 --> 00:14:17.592
<00:14:15.572>off <00:14:15.852>with <00:14:16.132>a <00:14:16.412>very <00:14:16.692>log-centric <00:14:16.972>approach.

239
00:14:19.312 --> 00:14:23.072
<00:14:19.312>And <00:14:19.439>because <00:14:19.566>they <00:14:19.693>grew <00:14:19.821>up <00:14:19.948>separately <00:14:20.075>and <00:14:20.202>they <00:14:20.330>were <00:14:20.457>looking <00:14:20.584>at <00:14:20.712>different

240
00:14:23.272 --> 00:14:27.172
<00:14:23.272>things <00:14:23.447>and <00:14:23.622>catering <00:14:23.797>to <00:14:23.972>different <00:14:24.147>audiences, <00:14:24.322>they <00:14:24.497>gained <00:14:24.672>different

241
00:14:27.232 --> 00:14:30.612
<00:14:27.232>feature <00:14:27.359>sets <00:14:27.486>and <00:14:27.613>they <00:14:27.741>gained <00:14:27.868>different <00:14:27.995>workflows <00:14:28.122>that <00:14:28.250>made <00:14:28.377>sense <00:14:28.504>for <00:14:28.632>those

242
00:14:30.672 --> 00:14:34.152
<00:14:30.672>individual <00:14:30.847>teams. <00:14:31.022>And <00:14:31.197>once <00:14:31.372>people <00:14:31.547>get <00:14:31.722>comfortable <00:14:31.897>with <00:14:32.072>a

243
00:14:34.212 --> 00:14:37.172
<00:14:34.212>workflow, <00:14:34.387>they're <00:14:34.562>really <00:14:34.737>stubborn <00:14:34.912>to <00:14:35.087>get <00:14:35.262>rid <00:14:35.437>of <00:14:35.612>it.

244
00:14:38.092 --> 00:14:40.632
<00:14:38.092>I <00:14:38.247>think <00:14:38.403>a <00:14:38.558>really <00:14:38.714>good <00:14:38.869>example <00:14:39.025>of <00:14:39.180>this <00:14:39.336>is <00:14:39.492>VI.

245
00:14:40.642 --> 00:14:44.592
<00:14:40.642>If <00:14:40.749>you <00:14:40.857>look <00:14:40.965>at <00:14:41.072>the <00:14:41.180>keyboard <00:14:41.288>that <00:14:41.395>VI <00:14:41.503>was <00:14:41.611>made <00:14:41.718>for, <00:14:41.826>it <00:14:41.934>looks <00:14:42.042>nothing

246
00:14:44.632 --> 00:14:48.592
<00:14:44.632>like <00:14:44.748>a <00:14:44.865>QWERTY <00:14:44.982>keyboard <00:14:45.098>or <00:14:45.215>any <00:14:45.332>keyboard <00:14:45.448>I've <00:14:45.565>ever <00:14:45.681>seen <00:14:45.798>in <00:14:45.915>my <00:14:46.031>life,

247
00:14:48.632 --> 00:14:52.372
<00:14:48.632>but <00:14:48.739>I'm <00:14:48.847>still <00:14:48.955>addicted <00:14:49.062>to <00:14:49.170>Vim <00:14:49.278>key <00:14:49.385>bindings <00:14:49.493>that <00:14:49.601>I've <00:14:49.708>been <00:14:49.816>using <00:14:49.924>for <00:14:50.031>six

248
00:14:52.432 --> 00:14:56.272
<00:14:52.432>years, <00:14:52.559>and <00:14:52.686>I <00:14:52.813>haven't <00:14:52.941>been <00:14:53.068>able <00:14:53.195>to <00:14:53.322>switch <00:14:53.450>editors <00:14:53.577>because <00:14:53.704>the <00:14:53.832>Vim

249
00:14:56.392 --> 00:14:59.472
<00:14:56.392>mode <00:14:56.532>is <00:14:56.672>slightly <00:14:56.812>different <00:14:56.952>than <00:14:57.092>what <00:14:57.232>I'm <00:14:57.372>used <00:14:57.512>to <00:14:57.652>with <00:14:57.792>Neovim.

250
00:15:00.152 --> 00:15:03.972
<00:15:00.152>So <00:15:00.252>people <00:15:00.352>are <00:15:00.452>really <00:15:00.552>stubborn <00:15:00.652>about <00:15:00.752>changing <00:15:00.852>workflows, <00:15:00.952>and <00:15:01.052>so <00:15:01.152>you <00:15:01.252>have <00:15:01.352>to <00:15:01.452>find <00:15:01.552>a

251
00:15:04.032 --> 00:15:07.812
<00:15:04.032>tool <00:15:04.148>that <00:15:04.265>maintains <00:15:04.382>all <00:15:04.498>of <00:15:04.615>those <00:15:04.732>workflows <00:15:04.848>from <00:15:04.965>all <00:15:05.082>of <00:15:05.198>those <00:15:05.315>big <00:15:05.432>teams,

252
00:15:09.192 --> 00:15:10.652
<00:15:09.192>and <00:15:09.454>it <00:15:09.717>can <00:15:09.980>be <00:15:10.243>extremely <00:15:10.506>challenging.

253
00:15:11.281 --> 00:15:14.852
<00:15:11.281>And <00:15:11.388>even <00:15:11.496>though, <00:15:11.604>again, <00:15:11.711>that <00:15:11.819>there's <00:15:11.927>some <00:15:12.034>overlap <00:15:12.142>in <00:15:12.250>data, <00:15:12.357>some <00:15:12.465>tools <00:15:12.573>are <00:15:12.680>barely

254
00:15:14.932 --> 00:15:18.882
<00:15:14.932>able <00:15:15.072>to <00:15:15.212>handle <00:15:15.352>the <00:15:15.492>load <00:15:15.632>from <00:15:15.772>just <00:15:15.912>the <00:15:16.052>security <00:15:16.192>users <00:15:16.332>using

255
00:15:18.932 --> 00:15:22.832
<00:15:18.932>them, <00:15:19.132>and <00:15:19.332>having <00:15:19.532>the <00:15:19.732>SRE <00:15:19.932>team <00:15:20.132>piggyback <00:15:20.332>on

256
00:15:22.892 --> 00:15:26.352
<00:15:22.892>that <00:15:23.019>tool <00:15:23.146>or <00:15:23.273>vice <00:15:23.401>versa <00:15:23.528>can <00:15:23.655>cause <00:15:23.782>that <00:15:23.910>tool <00:15:24.037>to <00:15:24.164>fall <00:15:24.292>over.

257
00:15:26.392 --> 00:15:29.012
<00:15:26.392>And <00:15:26.532>so <00:15:26.672>you <00:15:26.812>have <00:15:26.952>to <00:15:27.092>find <00:15:27.232>a <00:15:27.372>tool <00:15:27.512>that <00:15:27.652>has <00:15:27.792>a

258
00:15:29.092 --> 00:15:33.932
wide

259
00:15:34.012 --> 00:15:36.332
<00:15:34.012>feature <00:15:34.245>set <00:15:34.478>and <00:15:34.712>can <00:15:34.945>scale <00:15:35.178>really <00:15:35.411>high.

260
00:15:36.372 --> 00:15:40.072
<00:15:36.372>And <00:15:36.546>so <00:15:36.722>you're <00:15:36.896>looking <00:15:37.072>for <00:15:37.247>a <00:15:37.421>tool <00:15:37.597>that <00:15:37.771>can

261
00:15:40.092 --> 00:15:42.512
<00:15:40.092>basically <00:15:40.292>do <00:15:40.492>everything <00:15:40.692>under <00:15:40.891>the <00:15:41.092>sun <00:15:41.292>at <00:15:41.492>scale.

262
00:15:44.312 --> 00:15:47.752
<00:15:44.312>And <00:15:44.419>so <00:15:44.527>this <00:15:44.635>makes <00:15:44.742>migrations <00:15:44.850>extremely <00:15:44.958>tricky <00:15:45.065>because <00:15:45.173>you <00:15:45.281>have <00:15:45.388>to <00:15:45.496>find <00:15:45.604>a <00:15:45.712>new

263
00:15:47.772 --> 00:15:51.512
<00:15:47.772>solution <00:15:47.872>that <00:15:47.972>meets <00:15:48.072>the <00:15:48.172>needs <00:15:48.272>of <00:15:48.372>everybody, <00:15:48.472>and <00:15:48.572>then <00:15:48.672>you <00:15:48.772>have <00:15:48.872>to <00:15:48.972>find <00:15:49.072>someone <00:15:49.172>that

264
00:15:51.572 --> 00:15:55.472
<00:15:51.572>understands <00:15:51.699>the <00:15:51.826>legacy <00:15:51.953>systems <00:15:52.081>and <00:15:52.208>the <00:15:52.335>new <00:15:52.462>system, <00:15:52.590>and <00:15:52.717>then <00:15:52.844>you <00:15:52.972>have

265
00:15:55.512 --> 00:15:59.172
<00:15:55.512>to <00:15:55.686>make <00:15:55.862>sure <00:15:56.036>that <00:15:56.212>all <00:15:56.387>the <00:15:56.561>ingestion <00:15:56.737>is <00:15:56.911>happening.

266
00:15:59.512 --> 00:16:02.272
<00:15:59.512>You <00:15:59.686>might <00:15:59.862>have <00:16:00.036>to <00:16:00.212>migrate <00:16:00.387>legacy <00:16:00.561>data, <00:16:00.737>which <00:16:00.911>for

267
00:16:03.112 --> 00:16:04.912
<00:16:03.112>observability <00:16:04.512>systems

268
00:16:08.112 --> 00:16:11.572
<00:16:08.112>is <00:16:08.239>extremely <00:16:08.366>tricky <00:16:08.493>because <00:16:08.621>sometimes <00:16:08.748>they <00:16:08.875>don't <00:16:09.002>function <00:16:09.130>with <00:16:09.257>out <00:16:09.384>of <00:16:09.512>order

269
00:16:11.712 --> 00:16:15.602
<00:16:11.712>ingest. <00:16:11.812>So <00:16:11.912>you <00:16:12.012>have <00:16:12.112>to <00:16:12.212>decide, <00:16:12.312>do <00:16:12.412>I <00:16:12.512>need <00:16:12.612>to <00:16:12.712>keep <00:16:12.812>both <00:16:12.912>systems <00:16:13.012>running <00:16:13.112>until

270
00:16:15.632 --> 00:16:19.452
<00:16:15.632>retention <00:16:15.832>runs <00:16:16.031>out, <00:16:16.232>or <00:16:16.431>do <00:16:16.632>I <00:16:16.832>need <00:16:17.031>to

271
00:16:19.732 --> 00:16:22.512
<00:16:19.732>find <00:16:19.887>a <00:16:20.043>way <00:16:20.198>to <00:16:20.354>migrate <00:16:20.509>everything <00:16:20.665>over? <00:16:20.820>Is <00:16:20.976>that <00:16:21.132>okay?

272
00:16:22.592 --> 00:16:24.592
<00:16:22.592>Is <00:16:22.747>that <00:16:22.903>going <00:16:23.058>to <00:16:23.214>cause <00:16:23.369>some <00:16:23.525>sort <00:16:23.680>of <00:16:23.836>compliance <00:16:23.992>issue?

273
00:16:26.212 --> 00:16:30.152
<00:16:26.212>And <00:16:26.339>so <00:16:26.466>finding <00:16:26.593>those <00:16:26.721>systems <00:16:26.848>and <00:16:26.975>then <00:16:27.102>getting <00:16:27.230>them <00:16:27.357>to <00:16:27.484>a <00:16:27.612>point

274
00:16:30.172 --> 00:16:34.052
<00:16:30.172>where <00:16:30.279>their <00:16:30.387>feature <00:16:30.495>parity <00:16:30.602>is <00:16:30.710>really <00:16:30.818>tricky, <00:16:30.925>but <00:16:31.033>then <00:16:31.141>you <00:16:31.248>run <00:16:31.356>into <00:16:31.464>user <00:16:31.572>trust.

275
00:16:34.172 --> 00:16:37.892
<00:16:34.172>You <00:16:34.327>get <00:16:34.483>some <00:16:34.638>new <00:16:34.794>team, <00:16:34.949>or <00:16:35.105>you <00:16:35.260>get <00:16:35.416>some <00:16:35.572>very

276
00:16:37.912 --> 00:16:41.692
<00:16:37.912>enthusiastic <00:16:38.052>person <00:16:38.192>pushing <00:16:38.332>a <00:16:38.472>new <00:16:38.612>tool, <00:16:38.752>but <00:16:38.892>there's <00:16:39.032>a <00:16:39.172>lot <00:16:39.312>of

277
00:16:41.712 --> 00:16:45.492
<00:16:41.712>people <00:16:41.839>that <00:16:41.966>are <00:16:42.093>happy <00:16:42.221>with <00:16:42.348>the <00:16:42.475>older <00:16:42.602>tools, <00:16:42.730>even <00:16:42.857>if <00:16:42.984>their <00:16:43.112>workflow

278
00:16:45.552 --> 00:16:48.232
<00:16:45.552>isn't <00:16:45.707>good. <00:16:45.863>It's <00:16:46.018>the <00:16:46.174>devil <00:16:46.329>they <00:16:46.485>know, <00:16:46.640>so <00:16:46.796>to <00:16:46.952>speak.

279
00:16:48.852 --> 00:16:52.812
<00:16:48.852>So <00:16:48.959>they <00:16:49.067>might <00:16:49.175>even <00:16:49.282>know <00:16:49.390>that <00:16:49.498>it's <00:16:49.605>not <00:16:49.713>the <00:16:49.821>worst <00:16:49.928>tool, <00:16:50.036>but <00:16:50.144>because <00:16:50.252>they're

280
00:16:52.852 --> 00:16:56.492
<00:16:52.852>comfortable <00:16:52.992>with <00:16:53.132>it, <00:16:53.271>they're <00:16:53.411>going <00:16:53.552>to <00:16:53.692>be <00:16:53.832>stubborn <00:16:53.972>about <00:16:54.112>switching <00:16:54.252>over,

281
00:16:56.692 --> 00:17:00.662
<00:16:56.692>and <00:16:56.847>it <00:16:57.003>can <00:16:57.158>be <00:16:57.314>really <00:16:57.469>tricky. <00:16:57.625>And <00:16:57.780>then <00:16:57.936>once <00:16:58.092>everything's

282
00:17:00.972 --> 00:17:03.412
<00:17:00.972>migrated <00:17:01.112>over <00:17:01.252>to <00:17:01.391>the <00:17:01.531>new <00:17:01.672>system <00:17:01.812>and <00:17:01.952>you <00:17:02.092>think <00:17:02.232>you're <00:17:02.372>happy,

283
00:17:04.252 --> 00:17:07.992
<00:17:04.252>you're <00:17:04.359>going <00:17:04.467>to <00:17:04.575>be <00:17:04.682>worried <00:17:04.790>that <00:17:04.898>there's <00:17:05.005>that <00:17:05.113>one <00:17:05.221>box <00:17:05.328>in <00:17:05.436>the <00:17:05.544>corner <00:17:05.652>you

284
00:17:08.052 --> 00:17:10.772
<00:17:08.051>forgot <00:17:08.207>to <00:17:08.363>deploy <00:17:08.518>the <00:17:08.674>new <00:17:08.829>telemetry <00:17:08.985>agent <00:17:09.140>on, <00:17:09.296>or <00:17:09.452>there's

285
00:17:10.792 --> 00:17:14.392
some

286
00:17:14.672 --> 00:17:18.072
<00:17:14.672>other <00:17:14.771>old <00:17:14.872>machine <00:17:14.972>or <00:17:15.072>some <00:17:15.172>other <00:17:15.271>old <00:17:15.372>process <00:17:15.472>that <00:17:15.572>didn't <00:17:15.672>make <00:17:15.771>it <00:17:15.872>into <00:17:15.972>the <00:17:16.072>new

287
00:17:18.172 --> 00:17:22.123
<00:17:18.172>system. <00:17:18.288>And <00:17:18.405>so <00:17:18.521>it <00:17:18.638>can <00:17:18.755>be <00:17:18.872>a <00:17:18.988>very <00:17:19.105>nervous <00:17:19.222>day <00:17:19.338>when <00:17:19.455>you're <00:17:19.572>trying

288
00:17:22.152 --> 00:17:23.853
<00:17:22.152>to <00:17:22.327>decomm <00:17:22.502>an <00:17:22.677>old <00:17:22.852>system <00:17:23.027>and <00:17:23.202>turn <00:17:23.377>it <00:17:23.552>off.

289
00:17:26.552 --> 00:17:29.942
<00:17:26.551>Another <00:17:26.726>problem <00:17:26.901>is <00:17:27.077>gaining <00:17:27.252>support <00:17:27.426>for <00:17:27.601>this <00:17:27.776>internally, <00:17:27.952>and

290
00:17:29.992 --> 00:17:33.842
<00:17:29.992>to <00:17:30.147>me, <00:17:30.303>a <00:17:30.458>lot <00:17:30.614>of <00:17:30.769>it <00:17:30.925>comes <00:17:31.080>through <00:17:31.236>as <00:17:31.392>a

291
00:17:33.872 --> 00:17:37.452
<00:17:33.872>communication <00:17:34.152>issue. <00:17:34.432>So <00:17:34.712>engineers <00:17:34.992>will <00:17:35.272>want

292
00:17:37.492 --> 00:17:40.972
<00:17:37.492>systems <00:17:37.619>that <00:17:37.746>are <00:17:37.873>easy <00:17:38.001>to <00:17:38.128>use, <00:17:38.255>that <00:17:38.382>they <00:17:38.510>make <00:17:38.637>their <00:17:38.764>life <00:17:38.892>easy.

293
00:17:41.432 --> 00:17:45.292
<00:17:41.432>So <00:17:41.572>they <00:17:41.712>are <00:17:41.852>highly <00:17:41.992>reliable <00:17:42.132>with <00:17:42.272>a <00:17:42.412>minimum <00:17:42.552>amount <00:17:42.692>of <00:17:42.832>effort.

294
00:17:45.632 --> 00:17:47.212
<00:17:45.632>Upgrades <00:17:45.982>aren't <00:17:46.332>stressful <00:17:46.682>for <00:17:47.032>them.

295
00:17:48.152 --> 00:17:50.932
<00:17:48.152>They <00:17:48.327>support <00:17:48.502>a <00:17:48.677>wide <00:17:48.852>variety <00:17:49.027>of <00:17:49.202>standards <00:17:49.377>for <00:17:49.552>ingest.

296
00:17:51.362 --> 00:17:54.592
<00:17:51.362>And <00:17:51.595>leadership <00:17:51.828>wants <00:17:52.062>to <00:17:52.295>focus <00:17:52.528>on <00:17:52.762>profitability.

297
00:17:55.312 --> 00:17:59.132
<00:17:55.312>And <00:17:55.439>there <00:17:55.566>is <00:17:55.693>alignment <00:17:55.821>there, <00:17:55.948>it's <00:17:56.075>just <00:17:56.202>not <00:17:56.330>communicated <00:17:56.457>the <00:17:56.584>same <00:17:56.712>way.

298
00:17:59.292 --> 00:18:02.912
<00:17:59.292>So <00:17:59.379>if <00:17:59.466>you <00:17:59.554>go <00:17:59.641>to <00:17:59.729>your <00:17:59.817>boss <00:17:59.904>saying, <00:17:59.992>"Hey, <00:18:00.079>I <00:18:00.167>want <00:18:00.254>this <00:18:00.341>tool <00:18:00.429>to <00:18:00.516>make <00:18:00.604>my <00:18:00.692>life

299
00:18:02.972 --> 00:18:06.392
<00:18:02.972>easier," <00:18:03.205>and <00:18:03.438>your <00:18:03.672>boss <00:18:03.905>was <00:18:04.138>told <00:18:04.372>to

300
00:18:06.932 --> 00:18:08.222
<00:18:06.932>save <00:18:07.319>money <00:18:07.706>this <00:18:08.093>year,

301
00:18:09.172 --> 00:18:12.032
<00:18:09.172>those <00:18:09.312>two <00:18:09.452>things <00:18:09.592>might <00:18:09.732>not <00:18:09.872>align. <00:18:10.012>And <00:18:10.152>so <00:18:10.292>you <00:18:10.432>have <00:18:10.572>to

302
00:18:12.412 --> 00:18:15.352
<00:18:12.412>empathize <00:18:12.645>with <00:18:12.878>your <00:18:13.112>leadership <00:18:13.345>and <00:18:13.578>explain, <00:18:13.812>no,

303
00:18:16.372 --> 00:18:20.132
<00:18:16.372>by <00:18:16.488>make <00:18:16.605>my <00:18:16.722>life <00:18:16.838>easier, <00:18:16.955>I <00:18:17.072>mean, <00:18:17.188>I'm <00:18:17.305>going <00:18:17.422>to <00:18:17.538>spend <00:18:17.655>less <00:18:17.772>time

304
00:18:20.192 --> 00:18:23.352
<00:18:20.192>maintaining <00:18:20.332>the <00:18:20.472>observability <00:18:20.612>system <00:18:20.752>so <00:18:20.892>I <00:18:21.032>can <00:18:21.172>focus <00:18:21.312>on <00:18:21.452>other <00:18:21.592>things.

305
00:18:24.732 --> 00:18:28.612
<00:18:24.732>So <00:18:24.872>these <00:18:25.012>priorities <00:18:25.152>are <00:18:25.292>the <00:18:25.432>same. <00:18:25.572>It's <00:18:25.712>just <00:18:25.851>hard <00:18:25.992>to <00:18:26.132>communicate

306
00:18:28.672 --> 00:18:31.012
<00:18:28.672>it <00:18:28.905>through <00:18:29.138>different <00:18:29.372>parts <00:18:29.605>of <00:18:29.838>your <00:18:30.072>organization.

307
00:18:32.748 --> 00:18:35.988
<00:18:32.748>So <00:18:32.948>if <00:18:33.148>you <00:18:33.348>do <00:18:33.548>need <00:18:33.748>to <00:18:33.948>communicate <00:18:34.148>why,

308
00:18:36.888 --> 00:18:40.828
<00:18:36.888>one <00:18:36.981>thing <00:18:37.074>to <00:18:37.168>look <00:18:37.261>at <00:18:37.354>is, <00:18:37.447>again, <00:18:37.541>if <00:18:37.634>you're <00:18:37.727>in <00:18:37.821>a <00:18:37.914>public <00:18:38.007>cloud <00:18:38.101>and <00:18:38.194>you're <00:18:38.288>storing

309
00:18:41.008 --> 00:18:44.628
<00:18:41.008>logs <00:18:41.208>separate <00:18:41.408>from <00:18:41.608>your <00:18:41.808>security <00:18:42.008>information <00:18:42.208>from <00:18:42.408>your

310
00:18:44.668 --> 00:18:48.368
<00:18:44.668>observability <00:18:44.947>data, <00:18:45.227>that <00:18:45.507>is <00:18:45.787>extremely <00:18:46.068>expensive.

311
00:18:48.408 --> 00:18:51.548
<00:18:48.408>You're <00:18:48.535>either <00:18:48.662>paying <00:18:48.789>two <00:18:48.917>SaaS <00:18:49.044>vendors <00:18:49.171>to <00:18:49.298>do <00:18:49.426>it, <00:18:49.553>or <00:18:49.680>you're <00:18:49.808>paying

312
00:18:51.588 --> 00:18:52.568
for

313
00:18:53.608 --> 00:18:56.908
<00:18:53.608>two <00:18:53.735>storage <00:18:53.862>bills <00:18:53.989>for <00:18:54.117>a <00:18:54.244>large <00:18:54.371>amount <00:18:54.498>of <00:18:54.626>data <00:18:54.753>that <00:18:54.880>you're <00:18:55.008>transferring,

314
00:18:58.688 --> 00:19:01.368
<00:18:58.688>you're <00:18:58.843>ingesting, <00:18:58.999>and <00:18:59.154>likely <00:18:59.310>querying <00:18:59.465>a <00:18:59.621>fair <00:18:59.776>bit <00:18:59.932>as <00:19:00.088>well.

315
00:19:02.088 --> 00:19:04.608
<00:19:02.088>Another <00:19:02.368>thing <00:19:02.648>to <00:19:02.928>communicate <00:19:03.207>is <00:19:03.488>observability.

316
00:19:05.628 --> 00:19:09.348
<00:19:05.628>Good <00:19:05.803>observability <00:19:05.977>leads <00:19:06.153>to <00:19:06.328>higher <00:19:06.503>availability <00:19:06.678>and <00:19:06.852>more <00:19:07.028>reliable

317
00:19:09.428 --> 00:19:12.888
<00:19:09.428>applications. <00:19:09.628>So <00:19:09.828>if <00:19:10.028>you're <00:19:10.228>using <00:19:10.428>an <00:19:10.628>older <00:19:10.828>observability

318
00:19:12.908 --> 00:19:16.708
<00:19:12.908>system, <00:19:13.063>when <00:19:13.219>something <00:19:13.374>goes <00:19:13.530>down <00:19:13.685>and <00:19:13.841>you're <00:19:13.996>not <00:19:14.152>able <00:19:14.308>to

319
00:19:16.748 --> 00:19:20.108
<00:19:16.748>see <00:19:16.875>what's <00:19:17.002>going <00:19:17.129>on <00:19:17.257>in <00:19:17.384>the <00:19:17.511>application, <00:19:17.638>you <00:19:17.766>only <00:19:17.893>have <00:19:18.020>infrastructure <00:19:18.148>level

320
00:19:20.188 --> 00:19:24.088
<00:19:20.188>metrics, <00:19:20.304>or <00:19:20.421>you're <00:19:20.538>scrolling <00:19:20.654>through <00:19:20.771>20 <00:19:20.888>tabs <00:19:21.004>and <00:19:21.121>context <00:19:21.238>switching <00:19:21.354>all <00:19:21.471>the <00:19:21.588>time.

321
00:19:25.028 --> 00:19:28.718
<00:19:25.028>When <00:19:25.135>something <00:19:25.243>goes <00:19:25.351>wrong, <00:19:25.458>you're <00:19:25.566>going <00:19:25.674>to <00:19:25.781>spend <00:19:25.889>more <00:19:25.997>time <00:19:26.104>fixing <00:19:26.212>it, <00:19:26.320>and <00:19:26.428>you're

322
00:19:28.748 --> 00:19:32.568
<00:19:28.748>going <00:19:28.864>to <00:19:28.981>have <00:19:29.098>things <00:19:29.214>go <00:19:29.331>wrong <00:19:29.448>more <00:19:29.564>often <00:19:29.681>because <00:19:29.798>you're <00:19:29.914>using <00:19:30.031>an <00:19:30.148>older

323
00:19:32.648 --> 00:19:34.908
<00:19:32.648>tool <00:19:32.881>that's <00:19:33.114>more <00:19:33.348>reactive <00:19:33.581>rather <00:19:33.814>than <00:19:34.048>proactive.

324
00:19:35.548 --> 00:19:39.128
<00:19:35.548>And <00:19:35.688>depending <00:19:35.828>on <00:19:35.968>how <00:19:36.108>large <00:19:36.248>your <00:19:36.388>company <00:19:36.528>is, <00:19:36.668>outages <00:19:36.808>could <00:19:36.948>be

325
00:19:39.188 --> 00:19:41.308
<00:19:39.188>measured <00:19:39.468>in <00:19:39.748>the <00:19:40.028>millions <00:19:40.308>per <00:19:40.588>hour.

326
00:19:42.988 --> 00:19:45.528
<00:19:42.988>Another <00:19:43.188>thing <00:19:43.388>too <00:19:43.588>to <00:19:43.788>look <00:19:43.988>at <00:19:44.188>is <00:19:44.388>compliance.

327
00:19:46.128 --> 00:19:50.008
<00:19:46.128>So <00:19:46.235>if <00:19:46.343>you <00:19:46.451>look <00:19:46.558>at <00:19:46.666>a <00:19:46.774>lot <00:19:46.881>of <00:19:46.989>cyber <00:19:47.097>insurance <00:19:47.204>policies, <00:19:47.312>they <00:19:47.420>actually <00:19:47.528>demand

328
00:19:50.108 --> 00:19:53.728
<00:19:50.108>you <00:19:50.263>have <00:19:50.419>good <00:19:50.574>endpoint <00:19:50.730>detection <00:19:50.885>and <00:19:51.041>good <00:19:51.196>observability <00:19:51.352>on <00:19:51.508>your

329
00:19:53.808 --> 00:19:57.788
<00:19:53.808>systems, <00:19:53.935>and <00:19:54.062>that <00:19:54.189>can <00:19:54.317>be <00:19:54.444>a <00:19:54.571>good <00:19:54.698>way <00:19:54.826>to <00:19:54.953>help <00:19:55.080>sell <00:19:55.208>observability

330
00:19:57.828 --> 00:20:01.688
<00:19:57.828>internally, <00:19:57.983>is <00:19:58.139>to <00:19:58.294>look <00:19:58.450>at <00:19:58.605>your <00:19:58.761>cyber <00:19:58.916>insurance <00:19:59.072>policy <00:19:59.228>and

331
00:20:01.768 --> 00:20:02.248
<00:20:01.768>say, <00:20:02.200>"Hey,

332
00:20:03.148 --> 00:20:06.728
<00:20:03.148>if <00:20:03.264>we <00:20:03.381>don't <00:20:03.497>store <00:20:03.614>logs <00:20:03.731>for <00:20:03.848>this <00:20:03.964>amount <00:20:04.081>of <00:20:04.197>time <00:20:04.314>or <00:20:04.431>have <00:20:04.548>these

333
00:20:06.768 --> 00:20:10.688
<00:20:06.768>policies, <00:20:06.875>and <00:20:06.983>we <00:20:07.091>don't <00:20:07.198>have <00:20:07.306>this <00:20:07.414>monitoring <00:20:07.521>in <00:20:07.629>place, <00:20:07.737>our <00:20:07.844>cyber <00:20:07.952>insurance <00:20:08.060>won't <00:20:08.168>pay

334
00:20:10.748 --> 00:20:12.148
<00:20:10.748>out <00:20:11.000>if <00:20:11.252>there's <00:20:11.504>a <00:20:11.755>ransomware <00:20:12.007>attack."

335
00:20:13.268 --> 00:20:16.588
<00:20:13.268>Another <00:20:13.395>thing <00:20:13.522>when <00:20:13.649>you <00:20:13.777>are <00:20:13.904>pitching <00:20:14.031>this <00:20:14.158>is <00:20:14.286>in <00:20:14.413>the <00:20:14.540>vast <00:20:14.668>majority

336
00:20:16.628 --> 00:20:20.238
<00:20:16.628>of <00:20:16.908>my <00:20:17.187>experience <00:20:17.467>with <00:20:17.747>Victoria <00:20:18.028>Metrics,

337
00:20:20.948 --> 00:20:24.818
<00:20:20.948>the <00:20:21.075>thing <00:20:21.202>that's <00:20:21.329>the <00:20:21.457>most <00:20:21.584>expensive <00:20:21.711>about <00:20:21.838>observability <00:20:21.966>is <00:20:22.093>the <00:20:22.220>humans <00:20:22.348>managing

338
00:20:24.868 --> 00:20:28.378
<00:20:24.868>it. <00:20:25.023>So <00:20:25.179>if <00:20:25.334>you <00:20:25.490>can <00:20:25.645>pitch <00:20:25.801>it <00:20:25.956>as, <00:20:26.112>again, <00:20:26.268>I'm

339
00:20:28.408 --> 00:20:32.148
<00:20:28.408>saving <00:20:28.548>labor <00:20:28.687>hours <00:20:28.828>so <00:20:28.967>I <00:20:29.108>can <00:20:29.247>focus <00:20:29.388>on <00:20:29.527>more <00:20:29.668>important <00:20:29.808>tasks.

340
00:20:32.208 --> 00:20:35.828
<00:20:32.208>I <00:20:32.335>can <00:20:32.462>spend <00:20:32.589>more <00:20:32.717>time <00:20:32.844>working <00:20:32.971>on <00:20:33.098>other <00:20:33.226>things <00:20:33.353>because <00:20:33.480>I'm <00:20:33.608>not

341
00:20:35.868 --> 00:20:38.948
<00:20:35.868>maintaining <00:20:36.101>this <00:20:36.334>old, <00:20:36.568>crusty <00:20:36.801>legacy <00:20:37.034>monitoring <00:20:37.268>system.

342
00:20:39.698 --> 00:20:42.567
<00:20:39.698>That <00:20:39.853>is <00:20:40.009>a <00:20:40.164>more <00:20:40.320>valuable <00:20:40.475>sell <00:20:40.631>to <00:20:40.786>your <00:20:40.942>boss <00:20:41.098>than

343
00:20:44.428 --> 00:20:46.088
<00:20:44.428>saving <00:20:44.707>on <00:20:44.987>hardware <00:20:45.267>in <00:20:45.547>most <00:20:45.828>cases.

344
00:20:49.708 --> 00:20:50.168
And

345
00:20:51.308 --> 00:20:55.288
<00:20:51.308>now <00:20:51.401>that <00:20:51.494>we <00:20:51.588>have <00:20:51.681>a <00:20:51.774>way <00:20:51.868>to <00:20:51.961>sell <00:20:52.054>this <00:20:52.148>to <00:20:52.241>your <00:20:52.334>leadership, <00:20:52.428>we <00:20:52.521>can <00:20:52.614>go <00:20:52.708>through

346
00:20:55.368 --> 00:20:55.748
and

347
00:20:57.228 --> 00:20:59.528
<00:20:57.228>go <00:20:57.383>through <00:20:57.539>the <00:20:57.694>benefits <00:20:57.850>of <00:20:58.005>having <00:20:58.161>these <00:20:58.316>two <00:20:58.472>things <00:20:58.628>together.

348
00:21:00.088 --> 00:21:03.928
<00:21:00.088>And <00:21:00.195>one <00:21:00.303>thing <00:21:00.411>is <00:21:00.518>you <00:21:00.626>have <00:21:00.734>unified <00:21:00.841>tools <00:21:00.949>for <00:21:01.057>management, <00:21:01.164>and <00:21:01.272>you <00:21:01.380>can <00:21:01.488>actually

349
00:21:04.028 --> 00:21:07.848
<00:21:04.028>make <00:21:04.228>deploying <00:21:04.428>the <00:21:04.628>instrumentation <00:21:04.828>mostly <00:21:05.028>one <00:21:05.228>team's <00:21:05.428>problem,

350
00:21:07.908 --> 00:21:09.928
<00:21:07.908>which <00:21:08.082>is <00:21:08.257>likely <00:21:08.433>going <00:21:08.608>to <00:21:08.783>be <00:21:08.957>your <00:21:09.132>SRE <00:21:09.308>team.

351
00:21:10.588 --> 00:21:14.528
<00:21:10.588>So <00:21:10.687>rather <00:21:10.788>than <00:21:10.888>the <00:21:10.988>security <00:21:11.088>team <00:21:11.187>having <00:21:11.288>to <00:21:11.388>work <00:21:11.488>with <00:21:11.588>the <00:21:11.687>IT <00:21:11.788>team <00:21:11.888>or <00:21:11.988>the

352
00:21:14.588 --> 00:21:17.308
<00:21:14.588>ops <00:21:14.788>team <00:21:14.988>to <00:21:15.187>figure <00:21:15.388>out <00:21:15.588>how <00:21:15.788>to <00:21:15.988>get

353
00:21:18.588 --> 00:21:22.488
<00:21:18.588>multiple <00:21:18.763>agents <00:21:18.937>deployed <00:21:19.113>to <00:21:19.288>one <00:21:19.463>place <00:21:19.638>or <00:21:19.812>to <00:21:19.988>all

354
00:21:22.608 --> 00:21:23.568
<00:21:22.608>the <00:21:22.824>endpoints <00:21:23.040>in <00:21:23.255>your <00:21:23.472>fleet,

355
00:21:24.448 --> 00:21:27.868
<00:21:24.448>your <00:21:24.648>security <00:21:24.848>team <00:21:25.048>can <00:21:25.248>say, <00:21:25.448>"Hey, <00:21:25.648>here's <00:21:25.848>the

356
00:21:27.908 --> 00:21:31.317
<00:21:27.908>additional <00:21:28.082>configuration <00:21:28.257>we <00:21:28.433>need <00:21:28.608>to <00:21:28.783>add <00:21:28.957>to <00:21:29.132>our <00:21:29.308>collector,

357
00:21:31.948 --> 00:21:35.258
<00:21:31.948>so <00:21:32.075>that <00:21:32.202>way <00:21:32.329>we're <00:21:32.457>getting <00:21:32.584>the <00:21:32.711>security <00:21:32.838>information <00:21:32.966>along <00:21:33.093>with <00:21:33.220>the <00:21:33.348>observability

358
00:21:35.308 --> 00:21:38.128
<00:21:35.308>stuff <00:21:35.448>you're <00:21:35.588>already <00:21:35.728>doing." <00:21:35.868>And <00:21:36.008>then <00:21:36.148>it's <00:21:36.288>just <00:21:36.428>a <00:21:36.568>config <00:21:36.708>update.

359
00:21:38.168 --> 00:21:39.788
<00:21:38.168>You're <00:21:38.447>not <00:21:38.727>dealing <00:21:39.007>with <00:21:39.287>multiple <00:21:39.568>vendors.

360
00:21:39.828 --> 00:21:41.918
<00:21:39.828>You're <00:21:40.061>not <00:21:40.294>dealing <00:21:40.528>with <00:21:40.761>multiple <00:21:40.994>patch <00:21:41.228>cycles.

361
00:21:41.948 --> 00:21:44.888
<00:21:41.948>You're <00:21:42.075>just <00:21:42.202>deploying <00:21:42.329>one <00:21:42.457>tool <00:21:42.584>with <00:21:42.711>a <00:21:42.838>little <00:21:42.966>bit <00:21:43.093>of <00:21:43.220>extra <00:21:43.348>configuration.

362
00:21:45.848 --> 00:21:46.438
<00:21:45.848>And <00:21:46.379>then

363
00:21:47.608 --> 00:21:51.188
<00:21:47.608>another <00:21:47.735>nice <00:21:47.862>thing <00:21:47.989>too <00:21:48.117>is <00:21:48.244>you <00:21:48.371>don't <00:21:48.498>have <00:21:48.626>the <00:21:48.753>friction <00:21:48.880>between <00:21:49.008>tools.

364
00:21:51.248 --> 00:21:54.748
<00:21:51.248>You <00:21:51.355>don't <00:21:51.463>have <00:21:51.571>people <00:21:51.678>saying, <00:21:51.786>"I <00:21:51.894>have <00:21:52.001>five <00:21:52.109>different <00:21:52.217>agents <00:21:52.324>running <00:21:52.432>on <00:21:52.540>my <00:21:52.648>machine

365
00:21:54.758 --> 00:21:56.178
<00:21:54.758>that <00:21:55.013>are <00:21:55.269>trying <00:21:55.524>to <00:21:55.780>break <00:21:56.035>everything,"

366
00:21:57.328 --> 00:22:00.468
<00:21:57.328>or <00:21:57.468>that <00:21:57.608>are <00:21:57.748>using <00:21:57.888>up <00:21:58.028>all <00:21:58.168>the <00:21:58.308>resources <00:21:58.447>on <00:21:58.588>a <00:21:58.728>machine.

367
00:22:00.508 --> 00:22:02.928
<00:22:00.508>So <00:22:00.708>there's <00:22:00.908>fewer <00:22:01.108>places <00:22:01.308>to <00:22:01.508>put <00:22:01.708>blame <00:22:01.908>on

368
00:22:04.568 --> 00:22:06.388
<00:22:04.568>observability <00:22:05.034>and <00:22:05.501>security <00:22:05.968>tooling.

369
00:22:08.968 --> 00:22:12.588
<00:22:08.968>Another <00:22:09.068>nice <00:22:09.168>thing <00:22:09.268>too <00:22:09.368>is <00:22:09.468>that <00:22:09.568>you <00:22:09.668>don't <00:22:09.768>have <00:22:09.868>20 <00:22:09.968>different <00:22:10.068>tabs <00:22:10.168>open <00:22:10.268>during <00:22:10.368>an

370
00:22:12.628 --> 00:22:16.148
<00:22:12.628>incident. <00:22:12.768>You're <00:22:12.908>looking <00:22:13.048>in <00:22:13.187>the <00:22:13.328>same <00:22:13.467>place <00:22:13.608>and <00:22:13.747>using <00:22:13.888>the <00:22:14.028>same

371
00:22:16.228 --> 00:22:16.988
workflows,

372
00:22:17.888 --> 00:22:21.808
<00:22:17.888>when <00:22:18.043>you're <00:22:18.199>adding <00:22:18.354>in <00:22:18.510>alerts, <00:22:18.665>when <00:22:18.821>you're <00:22:18.976>looking <00:22:19.132>through <00:22:19.288>telemetry,

373
00:22:21.948 --> 00:22:25.248
<00:22:21.948>when <00:22:22.088>something <00:22:22.228>goes <00:22:22.368>wrong, <00:22:22.508>whether <00:22:22.648>that's <00:22:22.788>a <00:22:22.928>security <00:22:23.068>incident <00:22:23.208>or <00:22:23.348>a

374
00:22:26.588 --> 00:22:29.088
<00:22:26.588>infrastructure <00:22:26.868>incident <00:22:27.148>or <00:22:27.428>a <00:22:27.707>software <00:22:27.988>bug.

375
00:22:30.528 --> 00:22:33.548
<00:22:30.528>Everybody's <00:22:30.655>singing <00:22:30.782>off <00:22:30.909>of <00:22:31.037>the <00:22:31.164>same <00:22:31.291>sheet <00:22:31.418>of <00:22:31.546>music, <00:22:31.673>so <00:22:31.800>security <00:22:31.928>can

376
00:22:33.628 --> 00:22:37.388
<00:22:33.628>see <00:22:33.828>when <00:22:34.028>an <00:22:34.227>application <00:22:34.428>version <00:22:34.628>changed, <00:22:34.828>and <00:22:35.028>the

377
00:22:37.468 --> 00:22:40.528
<00:22:37.468>operations <00:22:37.643>team <00:22:37.818>can <00:22:37.993>see <00:22:38.168>if <00:22:38.343>there <00:22:38.518>was <00:22:38.693>anything <00:22:38.868>going

378
00:22:40.608 --> 00:22:42.778
<00:22:40.608>on <00:22:40.888>at <00:22:41.168>that <00:22:41.447>time <00:22:41.727>as <00:22:42.008>well.

379
00:22:44.097 --> 00:22:46.728
<00:22:44.097>And <00:22:44.297>then <00:22:44.497>operations <00:22:44.697>could <00:22:44.897>also <00:22:45.097>receive <00:22:45.297>security <00:22:45.497>alerts.

380
00:22:46.748 --> 00:22:50.377
<00:22:46.748>Because <00:22:46.848>you're <00:22:46.948>using <00:22:47.048>the <00:22:47.148>same <00:22:47.248>alerting <00:22:47.348>pipeline, <00:22:47.448>it's <00:22:47.548>not <00:22:47.648>too <00:22:47.748>tricky <00:22:47.848>to <00:22:47.948>set <00:22:48.048>up <00:22:48.148>a

381
00:22:50.408 --> 00:22:54.348
<00:22:50.408>second <00:22:50.563>notification <00:22:50.719>endpoint, <00:22:50.874>so <00:22:51.030>that <00:22:51.185>way, <00:22:51.341>if <00:22:51.496>the <00:22:51.652>security <00:22:51.808>rules

382
00:22:54.368 --> 00:22:57.788
<00:22:54.368>detect <00:22:54.601>an <00:22:54.834>out-of-date <00:22:55.068>application, <00:22:55.301>they're <00:22:55.534>able <00:22:55.768>to

383
00:22:57.848 --> 00:23:01.548
<00:22:57.848>notify <00:22:57.988>the <00:22:58.128>application <00:22:58.268>owners <00:22:58.408>using <00:22:58.548>the <00:22:58.687>same <00:22:58.828>alerting <00:22:58.967>pipeline <00:22:59.108>that <00:22:59.248>they're

384
00:23:01.608 --> 00:23:02.608
<00:23:01.608>already <00:23:01.908>used <00:23:02.207>to <00:23:02.508>using.

385
00:23:04.948 --> 00:23:08.688
<00:23:04.948>Another <00:23:05.088>benefit <00:23:05.228>too <00:23:05.368>is <00:23:05.508>that <00:23:05.648>the <00:23:05.788>security <00:23:05.928>team <00:23:06.068>can <00:23:06.208>watch <00:23:06.348>application

386
00:23:09.148 --> 00:23:13.017
<00:23:09.148>reliability <00:23:09.275>during <00:23:09.402>pen <00:23:09.529>test, <00:23:09.657>so <00:23:09.784>that <00:23:09.911>way <00:23:10.038>they <00:23:10.166>can <00:23:10.293>be <00:23:10.420>proactive <00:23:10.548>working

387
00:23:13.028 --> 00:23:16.588
<00:23:13.028>with <00:23:13.203>the <00:23:13.378>pen <00:23:13.553>testers <00:23:13.728>rather <00:23:13.903>than <00:23:14.078>having <00:23:14.253>angry <00:23:14.428>engineers

388
00:23:16.848 --> 00:23:20.248
<00:23:16.848>beating <00:23:16.935>down <00:23:17.023>their <00:23:17.110>door <00:23:17.197>saying, <00:23:17.285>"Hey, <00:23:17.373>I <00:23:17.460>know <00:23:17.548>we <00:23:17.635>had <00:23:17.723>a <00:23:17.810>pen <00:23:17.898>test <00:23:17.985>this <00:23:18.072>week, <00:23:18.160>but <00:23:18.248>this

389
00:23:20.288 --> 00:23:22.488
<00:23:20.288>pen <00:23:20.521>test <00:23:20.754>is <00:23:20.988>breaking <00:23:21.221>prod. <00:23:21.454>Please <00:23:21.688>stop."

390
00:23:25.388 --> 00:23:27.368
<00:23:25.388>But <00:23:25.621>it's <00:23:25.854>not <00:23:26.088>all <00:23:26.321>sunshine <00:23:26.554>and <00:23:26.788>roses.

391
00:23:28.728 --> 00:23:32.388
<00:23:28.728>One <00:23:28.928>thing <00:23:29.128>is <00:23:29.328>because <00:23:29.528>most <00:23:29.728>tools <00:23:29.928>decided <00:23:30.128>to

392
00:23:32.428 --> 00:23:36.348
<00:23:32.428>spec <00:23:32.544>into <00:23:32.661>being <00:23:32.777>a <00:23:32.894>really <00:23:33.011>good <00:23:33.128>security <00:23:33.244>tool <00:23:33.361>or <00:23:33.477>a <00:23:33.594>really <00:23:33.711>good <00:23:33.828>observability

393
00:23:36.408 --> 00:23:40.198
<00:23:36.408>tool, <00:23:36.641>a <00:23:36.874>lot <00:23:37.108>of <00:23:37.341>turnkey <00:23:37.574>integrations <00:23:37.808>don't

394
00:23:40.228 --> 00:23:44.088
<00:23:40.228>necessarily <00:23:40.368>work <00:23:40.508>out <00:23:40.648>of <00:23:40.788>the <00:23:40.928>box. <00:23:41.068>To <00:23:41.208>me, <00:23:41.348>it's <00:23:41.488>not <00:23:41.628>the

395
00:23:44.128 --> 00:23:47.088
<00:23:44.128>most <00:23:44.268>important <00:23:44.408>thing <00:23:44.548>in <00:23:44.687>the <00:23:44.828>world <00:23:44.967>because <00:23:45.108>a <00:23:45.247>lot <00:23:45.388>of <00:23:45.528>vendor

396
00:23:47.148 --> 00:23:51.048
<00:23:47.148>integrations <00:23:47.303>don't <00:23:47.459>work <00:23:47.614>as <00:23:47.770>well <00:23:47.925>as <00:23:48.081>they <00:23:48.236>seem <00:23:48.392>to, <00:23:48.548>say,

397
00:23:51.128 --> 00:23:53.868
<00:23:51.128>on <00:23:51.303>the <00:23:51.477>website, <00:23:51.653>and <00:23:51.828>they <00:23:52.003>still <00:23:52.178>require <00:23:52.352>multiple <00:23:52.528>steps.

398
00:23:54.528 --> 00:23:56.748
<00:23:54.528>But <00:23:54.728>it's <00:23:54.928>nice <00:23:55.128>to <00:23:55.328>still <00:23:55.528>have <00:23:55.728>that <00:23:55.928>documentation.

399
00:23:56.778 --> 00:24:00.188
<00:23:56.778>It <00:23:56.894>gets <00:23:57.011>you <00:23:57.128>somewhere, <00:23:57.244>even <00:23:57.361>if <00:23:57.478>it's <00:23:57.594>not <00:23:57.711>where <00:23:57.828>you <00:23:57.944>want <00:23:58.061>to <00:23:58.178>be.

400
00:24:00.248 --> 00:24:04.068
<00:24:00.248>For <00:24:00.364>a <00:24:00.481>lot <00:24:00.598>of <00:24:00.714>self-hosted <00:24:00.831>solutions, <00:24:00.948>it's <00:24:01.064>not <00:24:01.181>the <00:24:01.298>end <00:24:01.414>of <00:24:01.531>the <00:24:01.648>world

401
00:24:04.268 --> 00:24:05.248
<00:24:04.268>because <00:24:04.562>a <00:24:04.856>lot <00:24:05.150>of,

402
00:24:06.348 --> 00:24:10.208
<00:24:06.348>especially <00:24:06.548>for <00:24:06.748>traces, <00:24:06.947>OpenTelemetry <00:24:07.148>pretty <00:24:07.348>much <00:24:07.548>just <00:24:07.748>one,

403
00:24:10.248 --> 00:24:13.738
<00:24:10.248>and <00:24:10.423>then <00:24:10.598>for <00:24:10.773>logs, <00:24:10.948>everything <00:24:11.123>is <00:24:11.298>either <00:24:11.473>coming <00:24:11.648>through

404
00:24:13.948 --> 00:24:15.988
<00:24:13.948>logs <00:24:14.414>for <00:24:14.881>self-hosted <00:24:15.348>applications.

405
00:24:18.088 --> 00:24:22.048
<00:24:18.088>They're <00:24:18.215>going <00:24:18.342>to <00:24:18.469>come <00:24:18.597>through <00:24:18.724>log <00:24:18.851>files <00:24:18.978>or <00:24:19.106>Syslog <00:24:19.233>or <00:24:19.360>Windows <00:24:19.488>events

406
00:24:22.088 --> 00:24:25.868
<00:24:22.088>or <00:24:22.288>standard <00:24:22.488>things <00:24:22.687>that <00:24:22.888>most <00:24:23.088>telemetry <00:24:23.288>systems <00:24:23.488>can

407
00:24:25.908 --> 00:24:29.418
<00:24:25.908>cope <00:24:26.048>with. <00:24:26.187>And <00:24:26.328>then <00:24:26.467>metrics, <00:24:26.608>you <00:24:26.747>have <00:24:26.888>things <00:24:27.027>like <00:24:27.168>OpenTelemetry <00:24:27.308>and

408
00:24:29.468 --> 00:24:32.988
<00:24:29.468>Prometheus <00:24:29.608>that <00:24:29.748>are <00:24:29.888>ubiquitous, <00:24:30.028>especially <00:24:30.168>if <00:24:30.308>you're <00:24:30.448>in <00:24:30.588>an <00:24:30.728>environment <00:24:30.868>like

409
00:24:33.028 --> 00:24:36.228
<00:24:33.028>Kubernetes. <00:24:33.308>But <00:24:33.588>SaaS <00:24:33.868>tools <00:24:34.148>or <00:24:34.428>even

410
00:24:36.948 --> 00:24:40.888
<00:24:36.948>managed <00:24:37.064>services <00:24:37.181>inside <00:24:37.298>of <00:24:37.414>a <00:24:37.531>public <00:24:37.648>cloud <00:24:37.764>can <00:24:37.881>be <00:24:37.998>tricky <00:24:38.114>because <00:24:38.231>you <00:24:38.348>have

411
00:24:40.928 --> 00:24:44.088
<00:24:40.928>to <00:24:41.161>set <00:24:41.394>up <00:24:41.628>a <00:24:41.861>multiple-step <00:24:42.094>pipeline <00:24:42.328>usually

412
00:24:45.048 --> 00:24:48.868
<00:24:45.048>Like <00:24:45.248>getting <00:24:45.448>data <00:24:45.648>to <00:24:45.848>the <00:24:46.048>export <00:24:46.248>from <00:24:46.448>the

413
00:24:48.928 --> 00:24:52.188
<00:24:48.928>cloud-managed <00:24:49.128>service <00:24:49.328>into <00:24:49.527>the <00:24:49.727>cloud's <00:24:49.928>data <00:24:50.128>export <00:24:50.328>tool.

414
00:24:53.408 --> 00:24:57.308
<00:24:53.408>And <00:24:53.501>then <00:24:53.594>you <00:24:53.687>have <00:24:53.781>to <00:24:53.874>go <00:24:53.967>from <00:24:54.061>that <00:24:54.154>export <00:24:54.247>tool <00:24:54.341>into <00:24:54.434>your <00:24:54.527>own <00:24:54.621>environment, <00:24:54.714>so <00:24:54.808>you're

415
00:24:57.388 --> 00:25:01.348
<00:24:57.388>having <00:24:57.487>to <00:24:57.588>set <00:24:57.687>up <00:24:57.788>multiple <00:24:57.888>steps <00:24:57.987>rather <00:24:58.088>than <00:24:58.187>just <00:24:58.288>like, <00:24:58.388>it's <00:24:58.487>another <00:24:58.588>file <00:24:58.687>in <00:24:58.788>var/log

416
00:25:01.488 --> 00:25:03.188
<00:25:01.488>I <00:25:01.688>have <00:25:01.888>to <00:25:02.088>tail <00:25:02.288>in <00:25:02.488>a <00:25:02.688>Prometheus <00:25:02.888>endpoint.

417
00:25:05.188 --> 00:25:09.098
<00:25:05.188>Another <00:25:05.328>thing, <00:25:05.468>too, <00:25:05.608>is <00:25:05.748>especially <00:25:05.888>inside <00:25:06.028>of <00:25:06.168>security <00:25:06.308>tools, <00:25:06.448>there's <00:25:06.588>a

418
00:25:09.188 --> 00:25:13.168
<00:25:09.188>lot <00:25:09.343>of <00:25:09.499>knowledge <00:25:09.654>inside <00:25:09.810>of <00:25:09.965>the <00:25:10.121>dashboards <00:25:10.276>and <00:25:10.432>the <00:25:10.588>alert

419
00:25:13.228 --> 00:25:17.148
<00:25:13.228>rules <00:25:13.344>that <00:25:13.461>can <00:25:13.578>be <00:25:13.694>tricky <00:25:13.811>to <00:25:13.928>port <00:25:14.044>to <00:25:14.161>another <00:25:14.278>system <00:25:14.394>if <00:25:14.511>you're <00:25:14.628>going

420
00:25:17.207 --> 00:25:17.808
<00:25:17.207>from <00:25:17.747>a

421
00:25:19.148 --> 00:25:21.508
<00:25:19.148>security-focused <00:25:19.428>tool <00:25:19.707>into <00:25:19.987>an <00:25:20.267>observability <00:25:20.548>tool.

422
00:25:22.448 --> 00:25:24.548
<00:25:22.448>And <00:25:22.681>those <00:25:22.914>would <00:25:23.148>be <00:25:23.381>things <00:25:23.614>like <00:25:23.848>IP

423
00:25:24.588 --> 00:25:28.058
<00:25:24.588>deny <00:25:25.288>lists <00:25:25.988>or

424
00:25:29.268 --> 00:25:33.098
<00:25:29.268>indicators <00:25:29.395>of <00:25:29.522>compromise <00:25:29.649>that <00:25:29.777>are <00:25:29.904>surfaced <00:25:30.031>inside <00:25:30.158>of <00:25:30.286>the <00:25:30.413>dashboards <00:25:30.540>of <00:25:30.668>your

425
00:25:33.128 --> 00:25:33.768
<00:25:33.128>security <00:25:33.704>tool

426
00:25:34.588 --> 00:25:38.468
<00:25:34.588>that <00:25:34.695>can <00:25:34.803>be <00:25:34.911>tricky <00:25:35.018>to <00:25:35.126>add <00:25:35.234>on <00:25:35.341>top <00:25:35.449>of <00:25:35.557>and <00:25:35.664>add <00:25:35.772>into <00:25:35.880>the <00:25:35.988>ingestion

427
00:25:38.488 --> 00:25:42.438
<00:25:38.488>pipeline <00:25:38.721>for <00:25:38.954>your <00:25:39.188>observability <00:25:39.421>tool <00:25:39.654>that's <00:25:39.888>now

428
00:25:42.528 --> 00:25:46.328
<00:25:42.528>acting <00:25:42.728>as <00:25:42.928>a <00:25:43.128>SIEM. <00:25:43.328>Compliance-related <00:25:43.528>information <00:25:43.728>as <00:25:43.928>well.

429
00:25:46.468 --> 00:25:48.648
<00:25:46.468>A <00:25:46.748>lot <00:25:47.028>of <00:25:47.308>security <00:25:47.588>tools <00:25:47.868>will

430
00:25:49.548 --> 00:25:53.348
<00:25:49.548>relate <00:25:49.688>certain <00:25:49.828>IT <00:25:49.968>issues <00:25:50.108>to <00:25:50.248>SOC <00:25:50.388>controls, <00:25:50.528>and <00:25:50.668>that's <00:25:50.808>not <00:25:50.948>as

431
00:25:53.388 --> 00:25:54.828
<00:25:53.388>common <00:25:53.820>in <00:25:54.252>observability <00:25:54.684>tools.

432
00:25:57.048 --> 00:26:00.968
<00:25:57.048>Another <00:25:57.203>thing <00:25:57.359>is <00:25:57.514>a <00:25:57.670>lot <00:25:57.825>of <00:25:57.981>SaaS <00:25:58.136>tools <00:25:58.292>don't <00:25:58.448>expose

433
00:26:01.008 --> 00:26:03.548
<00:26:01.008>telemetry <00:26:01.474>really <00:26:01.941>at <00:26:02.408>all.

434
00:26:04.228 --> 00:26:05.438
So

435
00:26:06.148 --> 00:26:10.088
<00:26:06.148>those <00:26:06.303>SaaS <00:26:06.459>tools <00:26:06.614>might <00:26:06.770>not <00:26:06.925>expose <00:26:07.081>the <00:26:07.236>data <00:26:07.392>you <00:26:07.548>want,

436
00:26:10.208 --> 00:26:13.948
<00:26:10.208>and <00:26:10.335>if <00:26:10.462>you're <00:26:10.589>using <00:26:10.717>a <00:26:10.844>managed <00:26:10.971>observability <00:26:11.098>tool, <00:26:11.226>that <00:26:11.353>might <00:26:11.480>limit <00:26:11.608>what

437
00:26:13.968 --> 00:26:17.828
<00:26:13.968>data <00:26:14.084>you're <00:26:14.201>allowed <00:26:14.318>to <00:26:14.434>send <00:26:14.551>to <00:26:14.668>them, <00:26:14.784>and <00:26:14.901>they <00:26:15.018>might <00:26:15.134>have <00:26:15.251>rate <00:26:15.368>limits

438
00:26:17.888 --> 00:26:21.808
<00:26:17.888>or <00:26:18.004>certain <00:26:18.121>tier <00:26:18.237>limits <00:26:18.354>that <00:26:18.471>you <00:26:18.588>need <00:26:18.704>to <00:26:18.821>stay <00:26:18.937>within <00:26:19.054>to <00:26:19.171>make <00:26:19.288>sure

439
00:26:21.848 --> 00:26:24.348
<00:26:21.848>you <00:26:21.964>don't <00:26:22.081>have <00:26:22.197>to <00:26:22.314>pay <00:26:22.431>a <00:26:22.548>big <00:26:22.664>overage <00:26:22.781>fee <00:26:22.898>or <00:26:23.014>something <00:26:23.131>like <00:26:23.248>that.

440
00:26:25.708 --> 00:26:26.288
<00:26:25.708>That <00:26:26.230>can

441
00:26:30.368 --> 00:26:33.868
<00:26:30.368>take <00:26:30.495>away <00:26:30.622>the <00:26:30.749>benefit <00:26:30.877>of <00:26:31.004>using <00:26:31.131>those <00:26:31.258>SaaS <00:26:31.386>tools, <00:26:31.513>which <00:26:31.640>is <00:26:31.768>the

442
00:26:33.888 --> 00:26:37.868
<00:26:33.888>responsibility <00:26:34.004>for <00:26:34.121>the <00:26:34.237>care <00:26:34.354>and <00:26:34.471>feeding <00:26:34.588>of <00:26:34.704>those <00:26:34.821>systems <00:26:34.937>is <00:26:35.054>someone <00:26:35.171>else's <00:26:35.288>problem,

443
00:26:37.928 --> 00:26:41.348
<00:26:37.928>not <00:26:38.102>your <00:26:38.277>problem. <00:26:38.453>And <00:26:38.628>the <00:26:38.803>experts <00:26:38.977>that <00:26:39.152>run <00:26:39.328>those

444
00:26:41.388 --> 00:26:42.748
<00:26:41.388>platforms <00:26:42.612>are

445
00:26:44.468 --> 00:26:48.328
<00:26:44.468>usually <00:26:44.584>better <00:26:44.701>than <00:26:44.818>somebody <00:26:44.934>who's <00:26:45.051>running <00:26:45.168>that <00:26:45.284>tool, <00:26:45.401>as <00:26:45.518>well <00:26:45.634>as <00:26:45.751>helping <00:26:45.868>their

446
00:26:48.408 --> 00:26:51.168
<00:26:48.408>users <00:26:48.687>do <00:26:48.967>their <00:26:49.247>job <00:26:49.527>as <00:26:49.808>well.

447
00:26:53.807 --> 00:26:57.108
<00:26:53.807>Another <00:26:54.007>challenge <00:26:54.207>is, <00:26:54.407>again, <00:26:54.607>getting <00:26:54.807>consensus <00:26:55.007>from <00:26:55.207>multiple

448
00:26:57.188 --> 00:27:01.128
<00:26:57.188>stakeholders. <00:26:57.328>You <00:26:57.468>have <00:26:57.608>to <00:26:57.748>make <00:26:57.888>the <00:26:58.028>operations <00:26:58.168>team, <00:26:58.308>the <00:26:58.448>development <00:26:58.588>team,

449
00:27:01.188 --> 00:27:03.628
<00:27:01.188>and <00:27:01.388>the <00:27:01.588>security <00:27:01.788>team <00:27:01.988>happy <00:27:02.188>when <00:27:02.388>you <00:27:02.588>migrate.

450
00:27:03.708 --> 00:27:07.508
<00:27:03.708>And <00:27:03.883>getting <00:27:04.058>three <00:27:04.233>different <00:27:04.408>groups <00:27:04.583>of <00:27:04.758>people <00:27:04.933>with <00:27:05.108>different

451
00:27:07.588 --> 00:27:11.108
<00:27:07.588>desires <00:27:07.763>to <00:27:07.937>agree <00:27:08.113>with <00:27:08.288>each <00:27:08.463>other <00:27:08.638>is <00:27:08.812>extremely <00:27:08.988>challenging.

452
00:27:11.257 --> 00:27:14.488
<00:27:11.257>And <00:27:11.339>if <00:27:11.421>you <00:27:11.504>do <00:27:11.586>need <00:27:11.668>to <00:27:11.751>make <00:27:11.833>a <00:27:11.915>breaking <00:27:11.998>change <00:27:12.080>with <00:27:12.162>that <00:27:12.245>system, <00:27:12.327>you <00:27:12.409>now <00:27:12.492>have <00:27:12.574>to <00:27:12.657>go

453
00:27:14.528 --> 00:27:18.228
<00:27:14.528>back <00:27:14.628>to <00:27:14.728>those <00:27:14.828>three <00:27:14.928>teams <00:27:15.028>and <00:27:15.128>say, <00:27:15.228>"Hey, <00:27:15.328>we <00:27:15.428>need <00:27:15.528>to <00:27:15.628>upgrade <00:27:15.728>to <00:27:15.828>this <00:27:15.928>system

454
00:27:19.168 --> 00:27:22.978
<00:27:19.168>or <00:27:19.275>this <00:27:19.383>new <00:27:19.491>version <00:27:19.598>of <00:27:19.706>the <00:27:19.814>observability <00:27:19.921>tool." <00:27:20.029>But <00:27:20.137>there <00:27:20.244>might <00:27:20.352>be <00:27:20.460>one <00:27:20.568>team

455
00:27:23.068 --> 00:27:26.188
<00:27:23.068>that <00:27:23.184>relies <00:27:23.301>on <00:27:23.418>a <00:27:23.534>feature <00:27:23.651>that <00:27:23.768>was <00:27:23.884>deprecated <00:27:24.001>or <00:27:24.118>removed <00:27:24.234>inside <00:27:24.351>of <00:27:24.468>that

456
00:27:27.228 --> 00:27:31.208
<00:27:27.228>new <00:27:27.321>release. <00:27:27.414>And <00:27:27.508>so <00:27:27.601>you <00:27:27.694>could <00:27:27.788>end <00:27:27.881>up <00:27:27.974>on <00:27:28.068>an <00:27:28.161>older <00:27:28.254>version <00:27:28.348>of <00:27:28.441>a <00:27:28.534>tool <00:27:28.628>that's

457
00:27:31.228 --> 00:27:32.408
<00:27:31.228>missing <00:27:31.493>a <00:27:31.759>feature <00:27:32.024>you <00:27:32.290>want

458
00:27:33.648 --> 00:27:34.448
<00:27:33.648>from <00:27:34.008>the <00:27:34.368>newer

459
00:27:37.508 --> 00:27:38.328
<00:27:37.508>version <00:27:37.754>of <00:27:38.000>that <00:27:38.246>tool.

460
00:27:41.168 --> 00:27:45.008
<00:27:41.168>But <00:27:41.308>there <00:27:41.447>is <00:27:41.588>something <00:27:41.727>that's <00:27:41.868>somewhat <00:27:42.007>pre-canned <00:27:42.148>that <00:27:42.287>can <00:27:42.428>help <00:27:42.568>with

461
00:27:45.048 --> 00:27:46.798
<00:27:45.048>doing <00:27:45.328>security <00:27:45.608>and <00:27:45.888>infrastructure <00:27:46.168>at <00:27:46.448>once,

462
00:27:47.968 --> 00:27:51.748
<00:27:47.968>and <00:27:48.168>it's <00:27:48.368>called <00:27:48.568>ShiftMon. <00:27:48.768>It <00:27:48.968>uses <00:27:49.168>VictoriaMetrics <00:27:49.368>for

463
00:27:51.828 --> 00:27:55.068
<00:27:51.828>storing <00:27:52.108>metrics, <00:27:52.388>VictoriaLogs <00:27:52.668>for <00:27:52.947>logs, <00:27:53.228>VictoriaTraces

464
00:27:56.828 --> 00:27:59.288
<00:27:56.828>is <00:27:57.108>also <00:27:57.388>optionally <00:27:57.668>available <00:27:57.947>as <00:27:58.228>well.

465
00:27:59.308 --> 00:28:03.048
<00:27:59.308>And <00:27:59.408>then <00:27:59.508>it <00:27:59.608>sets <00:27:59.708>up <00:27:59.808>Grafana <00:27:59.908>and <00:28:00.008>deploys <00:28:00.108>it <00:28:00.208>with <00:28:00.308>a <00:28:00.408>bunch <00:28:00.508>of <00:28:00.608>pre-canned <00:28:00.708>alerting

466
00:28:03.128 --> 00:28:07.088
<00:28:03.128>rules <00:28:03.244>and <00:28:03.361>dashboards, <00:28:03.477>as <00:28:03.594>well <00:28:03.711>as <00:28:03.828>uses <00:28:03.944>Telegraf <00:28:04.061>for <00:28:04.178>telemetry <00:28:04.294>collection, <00:28:04.411>and <00:28:04.528>the

467
00:28:07.128 --> 00:28:10.988
<00:28:07.128>link <00:28:07.303>for <00:28:07.477>the <00:28:07.653>project <00:28:07.828>is <00:28:08.003>down <00:28:08.178>here. <00:28:08.352>In <00:28:08.528>terms

468
00:28:11.048 --> 00:28:14.928
<00:28:11.048>of <00:28:11.203>security <00:28:11.359>solutions <00:28:11.514>that <00:28:11.670>have <00:28:11.825>pre-canned <00:28:11.981>integrations, <00:28:12.136>it <00:28:12.292>can <00:28:12.448>act

469
00:28:15.068 --> 00:28:16.348
<00:28:15.068>as <00:28:15.452>a <00:28:15.836>Syslog <00:28:16.220>server.

470
00:28:17.228 --> 00:28:19.088
<00:28:17.228>So <00:28:17.578>you <00:28:17.928>can <00:28:18.278>deploy <00:28:18.628>Telegraf

471
00:28:20.508 --> 00:28:24.208
<00:28:20.508>to <00:28:20.615>all <00:28:20.723>the <00:28:20.831>locations <00:28:20.938>in <00:28:21.046>your <00:28:21.154>fleet <00:28:21.261>and <00:28:21.369>then <00:28:21.477>set <00:28:21.584>up <00:28:21.692>Telegraf <00:28:21.800>as <00:28:21.908>a

472
00:28:24.268 --> 00:28:27.628
<00:28:24.268>Syslog <00:28:24.408>server <00:28:24.548>that <00:28:24.688>can <00:28:24.828>pre-parse <00:28:24.968>structured <00:28:25.108>logs <00:28:25.248>before <00:28:25.388>they <00:28:25.528>come <00:28:25.668>in.

473
00:28:28.088 --> 00:28:32.028
<00:28:28.088>So <00:28:28.263>any <00:28:28.437>application <00:28:28.613>or <00:28:28.788>any <00:28:28.963>old <00:28:29.138>network <00:28:29.312>device <00:28:29.488>that

474
00:28:32.068 --> 00:28:33.868
<00:28:32.068>only <00:28:32.301>supports <00:28:32.534>Syslog <00:28:32.768>can <00:28:33.001>work <00:28:33.234>with <00:28:33.468>this.

475
00:28:34.708 --> 00:28:37.108
<00:28:34.708>There's <00:28:34.988>also <00:28:35.268>SNMP <00:28:35.548>support <00:28:35.828>as <00:28:36.108>well.

476
00:28:38.588 --> 00:28:40.808
<00:28:38.588>Windows <00:28:38.868>Defender <00:28:39.148>is <00:28:39.428>supported <00:28:39.707>for <00:28:39.988>antivirus.

477
00:28:41.548 --> 00:28:45.388
<00:28:41.548>Tetragon <00:28:42.014>and <00:28:42.481>Falco <00:28:42.948>works

478
00:28:45.428 --> 00:28:47.548
<00:28:45.428>as <00:28:45.583>well. <00:28:45.739>It's <00:28:45.894>just <00:28:46.050>a <00:28:46.205>little <00:28:46.361>bit <00:28:46.516>of <00:28:46.672>extra <00:28:46.828>work.

479
00:28:48.608 --> 00:28:50.968
<00:28:48.608>Pretty <00:28:48.763>much <00:28:48.919>every <00:28:49.074>web <00:28:49.230>server <00:28:49.385>under <00:28:49.541>the <00:28:49.696>sun <00:28:49.852>is <00:28:50.008>supported.

480
00:28:51.148 --> 00:28:53.488
<00:28:51.148>There's <00:28:51.497>dashboards <00:28:51.848>and <00:28:52.197>alerting <00:28:52.548>rules

481
00:28:53.528 --> 00:28:56.248
<00:28:53.528>for <00:28:54.228>Traefik, <00:28:54.928>Caddy,

482
00:28:57.508 --> 00:29:00.948
<00:28:57.508>Nginx, <00:28:57.683>and <00:28:57.858>Apache. <00:28:58.033>There's <00:28:58.208>also <00:28:58.383>support <00:28:58.558>for <00:28:58.733>Suricata <00:28:58.908>and

483
00:29:00.988 --> 00:29:03.787
<00:29:00.988>CrowdSec <00:29:01.268>for <00:29:01.548>intrusion <00:29:01.828>detection <00:29:02.108>and <00:29:02.388>prevention.

484
00:29:04.417 --> 00:29:08.228
<00:29:04.417>And <00:29:04.572>for <00:29:04.728>identity <00:29:04.883>management, <00:29:05.039>FreeIPA <00:29:05.194>is <00:29:05.350>supported <00:29:05.505>as <00:29:05.661>well <00:29:05.817>as

485
00:29:08.268 --> 00:29:11.788
<00:29:08.268>Authentec. <00:29:08.501>And <00:29:08.734>for <00:29:08.968>Windows <00:29:09.201>endpoint <00:29:09.434>monitoring, <00:29:09.668>there's

486
00:29:11.848 --> 00:29:15.708
<00:29:11.848>also <00:29:12.023>Sysmon, <00:29:12.197>and <00:29:12.373>Linux, <00:29:12.548>there's <00:29:12.723>a <00:29:12.898>Tetragon <00:29:13.072>integration <00:29:13.248>as

487
00:29:15.748 --> 00:29:15.948
well.

488
00:29:18.228 --> 00:29:22.128
<00:29:18.228>And <00:29:18.461>even <00:29:18.694>if <00:29:18.928>your <00:29:19.161>security <00:29:19.394>solution <00:29:19.628>isn't

489
00:29:22.288 --> 00:29:22.968
<00:29:22.288>listed <00:29:22.594>in <00:29:22.900>there,

490
00:29:25.168 --> 00:29:27.648
<00:29:25.168>for <00:29:25.342>most <00:29:25.517>self-hosted <00:29:25.693>things, <00:29:25.868>it's <00:29:26.043>fairly <00:29:26.217>easy <00:29:26.392>to <00:29:26.568>integrate.

491
00:29:27.708 --> 00:29:31.308
<00:29:27.708>So <00:29:27.908>a <00:29:28.108>lot <00:29:28.308>of <00:29:28.508>antivirus <00:29:28.708>tools <00:29:28.908>support <00:29:29.108>shipping

492
00:29:31.348 --> 00:29:35.148
<00:29:31.348>telemetry <00:29:31.523>locally, <00:29:31.697>or <00:29:31.873>they <00:29:32.048>have <00:29:32.223>documentation <00:29:32.398>of <00:29:32.572>how <00:29:32.748>to

493
00:29:35.308 --> 00:29:39.288
<00:29:35.308>feed <00:29:35.448>a <00:29:35.588>Syslog <00:29:35.728>endpoint <00:29:35.868>or <00:29:36.008>an <00:29:36.148>HTTP <00:29:36.288>endpoint <00:29:36.428>for <00:29:36.568>shipping <00:29:36.708>data

494
00:29:39.388 --> 00:29:42.648
<00:29:39.388>out <00:29:39.668>of <00:29:39.947>those <00:29:40.227>endpoint <00:29:40.507>detection <00:29:40.788>tools.

495
00:29:42.668 --> 00:29:44.448
<00:29:42.668>Most <00:29:43.017>firewalls <00:29:43.368>are <00:29:43.717>fairly <00:29:44.068>straightforward.

496
00:29:44.988 --> 00:29:48.668
<00:29:44.988>ShiftMon <00:29:45.221>does <00:29:45.454>support <00:29:45.688>SNMP <00:29:45.921>and <00:29:46.154>Syslog, <00:29:46.388>which

497
00:29:48.708 --> 00:29:52.688
<00:29:48.708>helps. <00:29:48.815>Or <00:29:48.923>if <00:29:49.031>you're <00:29:49.138>like <00:29:49.246>me, <00:29:49.354>I <00:29:49.461>just <00:29:49.569>run <00:29:49.677>a <00:29:49.784>Linux <00:29:49.892>machine <00:29:50.000>as <00:29:50.108>my

498
00:29:52.708 --> 00:29:56.448
<00:29:52.708>router. <00:29:52.848>pfSense <00:29:52.988>and <00:29:53.128>OPNsense <00:29:53.268>are <00:29:53.408>actually <00:29:53.548>supported <00:29:53.688>as <00:29:53.828>well <00:29:53.968>if <00:29:54.108>you're

499
00:29:56.508 --> 00:30:00.068
<00:29:56.508>using <00:29:56.663>those. <00:29:56.819>And <00:29:56.974>most <00:29:57.130>self-hosted <00:29:57.285>solutions, <00:29:57.441>like <00:29:57.596>I <00:29:57.752>was <00:29:57.908>saying

500
00:30:00.208 --> 00:30:00.648
earlier,

501
00:30:01.468 --> 00:30:05.408
<00:30:01.468>support <00:30:01.643>either <00:30:01.818>OpenTelemetry, <00:30:01.993>which <00:30:02.168>works <00:30:02.343>with <00:30:02.518>the <00:30:02.693>solution, <00:30:02.868>or

502
00:30:05.748 --> 00:30:09.588
<00:30:05.748>a <00:30:05.923>Prometheus <00:30:06.098>endpoint, <00:30:06.273>or <00:30:06.448>there's <00:30:06.623>a <00:30:06.798>built-in <00:30:06.973>Telegraf <00:30:07.148>integration.

503
00:30:10.048 --> 00:30:13.648
<00:30:10.048>If <00:30:10.164>you <00:30:10.281>needed <00:30:10.398>to <00:30:10.514>add <00:30:10.631>Active <00:30:10.748>Directory <00:30:10.864>support, <00:30:10.981>it's <00:30:11.098>something <00:30:11.214>that <00:30:11.331>would <00:30:11.448>be

504
00:30:13.668 --> 00:30:17.308
<00:30:13.668>trivial <00:30:13.784>to <00:30:13.901>add <00:30:14.017>because <00:30:14.134>you <00:30:14.251>can <00:30:14.368>add <00:30:14.484>performance <00:30:14.601>counters <00:30:14.717>and <00:30:14.834>Windows <00:30:14.951>events <00:30:15.068>into

505
00:30:17.368 --> 00:30:21.108
<00:30:17.368>ShiftMon. <00:30:17.523>It's <00:30:17.679>just <00:30:17.834>I'm <00:30:17.990>not <00:30:18.145>an <00:30:18.301>AD <00:30:18.456>admin, <00:30:18.612>and <00:30:18.768>I'm

506
00:30:21.208 --> 00:30:24.668
<00:30:21.208>shy <00:30:21.315>about <00:30:21.423>putting <00:30:21.531>my <00:30:21.638>opinions <00:30:21.746>out <00:30:21.854>in <00:30:21.961>the <00:30:22.069>wild <00:30:22.177>about <00:30:22.284>how <00:30:22.392>to <00:30:22.500>monitor <00:30:22.608>Active

507
00:30:24.728 --> 00:30:25.258
Directory.

508
00:30:28.288 --> 00:30:31.728
<00:30:28.288>Some <00:30:28.381>things <00:30:28.474>that <00:30:28.568>are <00:30:28.661>going <00:30:28.754>to <00:30:28.848>be <00:30:28.941>tricky, <00:30:29.034>again, <00:30:29.128>are <00:30:29.221>going <00:30:29.314>to <00:30:29.408>be <00:30:29.501>those <00:30:29.594>SaaS <00:30:29.688>tools

509
00:30:31.948 --> 00:30:34.968
<00:30:31.948>and <00:30:32.148>public <00:30:32.348>cloud <00:30:32.548>integrations <00:30:32.748>because <00:30:32.948>there's <00:30:33.148>a <00:30:33.348>multi-step

510
00:30:35.008 --> 00:30:38.968
<00:30:35.008>process <00:30:36.408>for

511
00:30:38.988 --> 00:30:41.078
<00:30:38.988>getting <00:30:39.221>telemetry <00:30:39.454>from <00:30:39.688>those <00:30:39.921>tools <00:30:40.154>into <00:30:40.388>your

512
00:30:42.608 --> 00:30:46.308
<00:30:42.608>observability <00:30:42.888>solution. <00:30:43.168>So <00:30:43.447>like <00:30:43.727>M365, <00:30:44.008>Entra

513
00:30:46.388 --> 00:30:50.308
<00:30:46.388>ID, <00:30:46.495>Google <00:30:46.603>Workspace, <00:30:46.711>or <00:30:46.818>the <00:30:46.926>big <00:30:47.034>three <00:30:47.141>in <00:30:47.249>the <00:30:47.357>public <00:30:47.464>cloud, <00:30:47.572>you're <00:30:47.680>going <00:30:47.788>to

514
00:30:50.368 --> 00:30:51.368
<00:30:50.368>have <00:30:50.592>to <00:30:50.818>deal <00:30:51.043>with <00:30:51.268>their

515
00:30:52.452 --> 00:30:54.841
<00:30:52.452>like <00:30:52.802>data <00:30:53.152>export <00:30:53.502>service. <00:30:53.852>And

516
00:30:56.032 --> 00:30:59.992
<00:30:56.032>so <00:30:56.139>that'd <00:30:56.247>be <00:30:56.355>like <00:30:56.462>Google <00:30:56.570>Pub/Sub <00:30:56.678>and <00:30:56.785>GCP, <00:30:56.893>and <00:30:57.001>then <00:30:57.108>you're <00:30:57.216>going <00:30:57.324>to <00:30:57.432>have

517
00:31:00.032 --> 00:31:03.992
<00:31:00.032>to <00:31:00.148>figure <00:31:00.265>out <00:31:00.381>how <00:31:00.498>to <00:31:00.615>get <00:31:00.732>the <00:31:00.848>data <00:31:00.965>into <00:31:01.081>Chiffon <00:31:01.198>using <00:31:01.315>an <00:31:01.432>OpenTelemetry

518
00:31:04.032 --> 00:31:07.872
<00:31:04.032>exporter <00:31:04.159>or <00:31:04.286>something <00:31:04.413>like <00:31:04.541>that. <00:31:04.668>And <00:31:04.795>SaaS <00:31:04.922>products, <00:31:05.050>if <00:31:05.177>they <00:31:05.304>offer <00:31:05.432>it,

519
00:31:08.132 --> 00:31:11.972
<00:31:08.132>usually <00:31:08.239>the <00:31:08.347>endpoint <00:31:08.455>for <00:31:08.562>it <00:31:08.670>has <00:31:08.778>to <00:31:08.885>be <00:31:08.993>public, <00:31:09.101>or <00:31:09.208>you <00:31:09.316>might <00:31:09.424>have <00:31:09.532>to

520
00:31:12.072 --> 00:31:16.032
<00:31:12.072>ask <00:31:12.179>the <00:31:12.287>SaaS <00:31:12.395>provider <00:31:12.502>very <00:31:12.610>nicely <00:31:12.718>to <00:31:12.825>let <00:31:12.933>you <00:31:13.041>get <00:31:13.148>access <00:31:13.256>to <00:31:13.364>the <00:31:13.472>telemetry

521
00:31:16.132 --> 00:31:16.932
<00:31:16.132>for <00:31:16.492>your <00:31:16.852>deployment.

522
00:31:19.632 --> 00:31:21.912
<00:31:19.632>Along <00:31:19.982>with <00:31:20.332>Chiffon, <00:31:20.682>there's <00:31:21.032>other

523
00:31:23.352 --> 00:31:27.012
<00:31:23.352>people <00:31:23.527>that <00:31:23.702>are <00:31:23.877>gluing <00:31:24.052>together <00:31:24.227>open <00:31:24.402>source <00:31:24.577>solutions, <00:31:24.752>like

524
00:31:27.072 --> 00:31:30.912
<00:31:27.072>NVIDIA <00:31:27.246>for <00:31:27.421>a <00:31:27.597>while <00:31:27.772>has <00:31:27.947>used <00:31:28.121>Loki <00:31:28.296>as <00:31:28.472>a

525
00:31:30.932 --> 00:31:34.782
<00:31:30.932>SIEM. <00:31:31.072>There's <00:31:31.212>a <00:31:31.352>really <00:31:31.492>cool <00:31:31.632>project <00:31:31.772>that's <00:31:31.912>similar <00:31:32.052>to <00:31:32.192>Chiffon, <00:31:32.332>but

526
00:31:34.832 --> 00:31:38.812
<00:31:34.832>more <00:31:35.065>security-focused <00:31:35.298>rather <00:31:35.532>than <00:31:35.765>operations-focused, <00:31:35.998>called <00:31:36.232>SIEMinabox.

527
00:31:39.992 --> 00:31:43.272
<00:31:39.992>Datadog <00:31:40.147>and <00:31:40.303>Elastic <00:31:40.458>also <00:31:40.614>have <00:31:40.769>commercial <00:31:40.925>options <00:31:41.080>in <00:31:41.236>this <00:31:41.392>space.

528
00:31:43.792 --> 00:31:47.202
<00:31:43.792>So <00:31:43.966>it's <00:31:44.141>becoming <00:31:44.317>a <00:31:44.492>more <00:31:44.667>popular <00:31:44.841>thing <00:31:45.016>to <00:31:45.192>put

529
00:31:47.232 --> 00:31:50.532
<00:31:47.232>observability <00:31:47.465>and <00:31:47.698>security <00:31:47.932>telemetry <00:31:48.165>in <00:31:48.398>one <00:31:48.632>place.

530
00:31:52.752 --> 00:31:53.312
<00:31:52.752>And <00:31:53.255>then

531
00:31:54.852 --> 00:31:57.052
<00:31:54.852>some <00:31:55.027>times <00:31:55.202>where <00:31:55.377>Chiffon <00:31:55.552>has <00:31:55.727>helped <00:31:55.902>me <00:31:56.077>a <00:31:56.252>lot.

532
00:31:57.412 --> 00:32:01.112
<00:31:57.412>The <00:31:57.539>reason <00:31:57.666>why <00:31:57.793>I <00:31:57.921>started <00:31:58.048>making <00:31:58.175>Chiffon <00:31:58.302>was <00:31:58.430>actually <00:31:58.557>for <00:31:58.684>host <00:31:58.812>compliance.

533
00:32:01.752 --> 00:32:05.412
<00:32:01.752>So <00:32:01.879>in <00:32:02.006>my <00:32:02.133>lab, <00:32:02.261>to <00:32:02.388>configure <00:32:02.515>all <00:32:02.642>my <00:32:02.770>laptops <00:32:02.897>and <00:32:03.024>all <00:32:03.152>my

534
00:32:05.452 --> 00:32:09.372
<00:32:05.452>servers, <00:32:05.579>I <00:32:05.706>use <00:32:05.833>Ansible, <00:32:05.961>but <00:32:06.088>I <00:32:06.215>use <00:32:06.342>Ansible <00:32:06.470>Pull <00:32:06.597>for <00:32:06.724>the <00:32:06.852>most

535
00:32:09.412 --> 00:32:13.292
<00:32:09.412>part. <00:32:09.552>So <00:32:09.692>the <00:32:09.832>way <00:32:09.972>Ansible <00:32:10.112>Pull <00:32:10.252>works <00:32:10.392>is <00:32:10.532>you <00:32:10.672>put <00:32:10.812>your

536
00:32:13.872 --> 00:32:14.772
<00:32:13.872>Ansible <00:32:14.682>roles

537
00:32:16.012 --> 00:32:19.972
<00:32:16.012>on <00:32:16.128>some <00:32:16.245>public <00:32:16.361>accessible <00:32:16.478>point, <00:32:16.595>and <00:32:16.712>then <00:32:16.828>you <00:32:16.945>say, <00:32:17.062>"Hey, <00:32:17.178>I <00:32:17.295>need <00:32:17.412>you

538
00:32:20.012 --> 00:32:20.752
<00:32:20.012>to <00:32:20.345>pull <00:32:20.678>down

539
00:32:21.572 --> 00:32:25.392
<00:32:21.572>this <00:32:21.688>role <00:32:21.805>using <00:32:21.921>the <00:32:22.038>Ansible <00:32:22.155>Pull <00:32:22.272>command." <00:32:22.388>And <00:32:22.505>then <00:32:22.621>you <00:32:22.738>can <00:32:22.855>wrap <00:32:22.972>that

540
00:32:25.452 --> 00:32:29.132
<00:32:25.452>inside <00:32:25.579>of <00:32:25.706>a <00:32:25.833>systemd <00:32:25.961>timer, <00:32:26.088>so <00:32:26.215>then <00:32:26.342>every <00:32:26.470>night <00:32:26.597>at <00:32:26.724>midnight, <00:32:26.852>my

541
00:32:29.172 --> 00:32:32.512
<00:32:29.172>services <00:32:29.299>will <00:32:29.426>pull <00:32:29.553>down <00:32:29.681>the <00:32:29.808>latest <00:32:29.935>configuration <00:32:30.062>and <00:32:30.190>packages <00:32:30.317>that <00:32:30.444>should <00:32:30.572>be

542
00:32:32.572 --> 00:32:33.172
<00:32:32.572>applied <00:32:32.842>to <00:32:33.112>them.

543
00:32:34.012 --> 00:32:37.772
<00:32:34.012>But <00:32:34.167>because <00:32:34.323>you're <00:32:34.478>not <00:32:34.634>running <00:32:34.789>a <00:32:34.945>job <00:32:35.100>in <00:32:35.256>some <00:32:35.412>tool

544
00:32:37.852 --> 00:32:41.652
<00:32:37.852>like <00:32:38.052>Ansible <00:32:38.252>Automation <00:32:38.452>Platform <00:32:38.652>or <00:32:38.852>Semaphore <00:32:39.052>UI, <00:32:39.252>you're

545
00:32:41.712 --> 00:32:44.652
<00:32:41.712>not <00:32:41.867>getting <00:32:42.023>a <00:32:42.178>notification <00:32:42.334>when <00:32:42.489>those <00:32:42.645>jobs <00:32:42.800>fail <00:32:42.956>to <00:32:43.112>run.

546
00:32:45.172 --> 00:32:47.552
<00:32:45.172>And <00:32:45.405>I <00:32:45.638>needed <00:32:45.872>a <00:32:46.105>way <00:32:46.338>to <00:32:46.572>grab

547
00:32:48.752 --> 00:32:52.252
<00:32:48.752>that <00:32:48.868>information, <00:32:48.985>and <00:32:49.101>I <00:32:49.218>started <00:32:49.335>off <00:32:49.452>trying <00:32:49.568>to <00:32:49.685>tail <00:32:49.802>the <00:32:49.918>logs <00:32:50.035>from <00:32:50.152>the

548
00:32:52.292 --> 00:32:56.252
<00:32:52.292>systemd <00:32:52.408>service, <00:32:52.525>but <00:32:52.641>ended <00:32:52.758>up <00:32:52.875>finding <00:32:52.992>out <00:32:53.108>that <00:32:53.225>Telegraf <00:32:53.341>has <00:32:53.458>a <00:32:53.575>cool <00:32:53.692>plugin

549
00:32:56.292 --> 00:32:58.272
<00:32:56.292>which <00:32:56.492>tracks <00:32:56.692>the <00:32:56.891>state <00:32:57.091>of <00:32:57.292>each <00:32:57.492>systemd <00:32:57.692>service.

550
00:32:58.792 --> 00:33:02.772
<00:32:58.792>So <00:32:58.947>now <00:32:59.103>I <00:32:59.258>can <00:32:59.414>get <00:32:59.569>notified <00:32:59.725>when <00:32:59.880>something <00:33:00.036>goes <00:33:00.192>wrong

551
00:33:02.792 --> 00:33:03.732
<00:33:02.792>with <00:33:03.215>my <00:33:03.638>automation.

552
00:33:07.252 --> 00:33:09.152
<00:33:07.252>And <00:33:07.452>I <00:33:07.652>receive <00:33:07.851>an <00:33:08.052>alert <00:33:08.252>for <00:33:08.452>service <00:33:08.652>failures.

553
00:33:09.592 --> 00:33:13.532
<00:33:09.592>So <00:33:09.732>I <00:33:09.872>get <00:33:10.012>notified <00:33:10.152>whenever <00:33:10.292>automated <00:33:10.432>updates <00:33:10.572>don't <00:33:10.712>fail, <00:33:10.852>which <00:33:10.992>is

554
00:33:13.552 --> 00:33:15.461
<00:33:13.552>really <00:33:13.752>nice. <00:33:13.952>And <00:33:14.151>what <00:33:14.351>that <00:33:14.552>looks <00:33:14.752>like <00:33:14.952>is,

555
00:33:16.332 --> 00:33:18.432
<00:33:16.332>I <00:33:16.472>get <00:33:16.612>the <00:33:16.752>alert <00:33:16.892>that <00:33:17.032>you <00:33:17.172>saw <00:33:17.312>on <00:33:17.452>the <00:33:17.592>previous <00:33:17.732>page.

556
00:33:18.532 --> 00:33:22.412
<00:33:18.532>This <00:33:18.687>points <00:33:18.843>me <00:33:18.998>to <00:33:19.154>a <00:33:19.309>dashboard <00:33:19.465>where <00:33:19.620>I <00:33:19.776>can <00:33:19.932>see

557
00:33:22.632 --> 00:33:23.862
<00:33:22.632>that <00:33:23.001>Ansible <00:33:23.370>Pull <00:33:23.739>failed,

558
00:33:24.732 --> 00:33:28.662
<00:33:24.732>and <00:33:24.819>I <00:33:24.907>can <00:33:24.994>even <00:33:25.081>go <00:33:25.169>further <00:33:25.257>down <00:33:25.344>the <00:33:25.432>dashboard, <00:33:25.519>and <00:33:25.607>I <00:33:25.694>can <00:33:25.782>see, <00:33:25.869>here <00:33:25.956>are <00:33:26.044>the <00:33:26.132>logs

559
00:33:28.692 --> 00:33:32.292
<00:33:28.692>from <00:33:28.832>when <00:33:28.972>it <00:33:29.112>failed. <00:33:29.252>So <00:33:29.392>I <00:33:29.532>see <00:33:29.672>exactly <00:33:29.812>which <00:33:29.952>play <00:33:30.092>that

560
00:33:32.352 --> 00:33:35.732
<00:33:32.352>failed. <00:33:32.479>And <00:33:32.606>so <00:33:32.733>before <00:33:32.861>I <00:33:32.988>even <00:33:33.115>have <00:33:33.242>to <00:33:33.370>touch <00:33:33.497>a <00:33:33.624>box, <00:33:33.752>and

561
00:33:37.292 --> 00:33:41.152
<00:33:37.292>if <00:33:37.391>the <00:33:37.492>problem <00:33:37.591>is <00:33:37.692>happening <00:33:37.792>on <00:33:37.891>multiple <00:33:37.992>machines, <00:33:38.091>I <00:33:38.192>have <00:33:38.292>an <00:33:38.391>idea <00:33:38.492>of <00:33:38.591>where <00:33:38.692>that

562
00:33:41.172 --> 00:33:43.632
<00:33:41.172>problem <00:33:41.347>is <00:33:41.522>before <00:33:41.697>I <00:33:41.872>even <00:33:42.047>SSH <00:33:42.222>into <00:33:42.397>the <00:33:42.572>box.

563
00:33:44.092 --> 00:33:47.812
<00:33:44.092>And <00:33:44.185>most <00:33:44.278>of <00:33:44.372>this <00:33:44.465>information <00:33:44.558>I <00:33:44.652>could <00:33:44.745>look <00:33:44.838>at <00:33:44.932>on <00:33:45.025>my <00:33:45.118>phone <00:33:45.212>or <00:33:45.305>on <00:33:45.398>my <00:33:45.492>desktop.

564
00:33:47.892 --> 00:33:50.912
<00:33:47.892>So <00:33:48.032>before <00:33:48.172>I'm <00:33:48.312>even <00:33:48.452>on <00:33:48.592>my <00:33:48.732>computer, <00:33:48.872>I <00:33:49.012>know <00:33:49.152>what's <00:33:49.292>wrong.

565
00:33:51.612 --> 00:33:55.572
<00:33:51.612>Or <00:33:51.719>if <00:33:51.827>I'm <00:33:51.935>helping <00:33:52.042>somebody <00:33:52.150>else <00:33:52.258>who <00:33:52.365>is <00:33:52.473>on <00:33:52.581>call <00:33:52.688>and <00:33:52.796>they've <00:33:52.904>escalated <00:33:53.012>the

566
00:33:55.612 --> 00:33:59.392
<00:33:55.612>issue <00:33:55.694>to <00:33:55.776>me, <00:33:55.859>I <00:33:55.941>can <00:33:56.023>just <00:33:56.106>look <00:33:56.188>at <00:33:56.270>the <00:33:56.353>issue <00:33:56.435>and <00:33:56.517>I <00:33:56.600>might <00:33:56.682>be <00:33:56.764>able <00:33:56.847>to <00:33:56.929>point <00:33:57.012>them

567
00:33:59.432 --> 00:33:59.772
back

568
00:34:01.512 --> 00:34:05.392
<00:34:01.512>at <00:34:01.619>the <00:34:01.727>telemetry <00:34:01.835>and <00:34:01.942>it's <00:34:02.050>like, <00:34:02.158>"Hey, <00:34:02.265>look <00:34:02.373>here." <00:34:02.481>And <00:34:02.588>now <00:34:02.696>they <00:34:02.804>can <00:34:02.912>fix

569
00:34:05.452 --> 00:34:05.632
it.

570
00:34:08.852 --> 00:34:10.252
<00:34:08.851>Another <00:34:09.272>nice <00:34:09.692>thing <00:34:10.112>is

571
00:34:11.372 --> 00:34:15.252
<00:34:11.371>because <00:34:11.547>Chiffon <00:34:11.721>supports <00:34:11.897>Windows <00:34:12.071>hosts <00:34:12.246>and <00:34:12.422>networking <00:34:12.596>equipment <00:34:12.772>and

572
00:34:15.352 --> 00:34:18.932
<00:34:15.351>various <00:34:15.507>other <00:34:15.663>tools, <00:34:15.818>you <00:34:15.974>can <00:34:16.129>use <00:34:16.285>it <00:34:16.440>to <00:34:16.596>investigate <00:34:16.752>incidents.

573
00:34:19.473 --> 00:34:23.352
<00:34:19.473>So <00:34:19.600>there's <00:34:19.727>Sysmon <00:34:19.854>support. <00:34:19.982>I <00:34:20.109>can <00:34:20.236>go <00:34:20.363>through <00:34:20.491>and <00:34:20.618>see <00:34:20.745>which <00:34:20.873>process

574
00:34:23.392 --> 00:34:24.493
<00:34:23.391>is <00:34:24.382>querying

575
00:34:26.252 --> 00:34:30.212
<00:34:26.252>which <00:34:26.391>endpoints, <00:34:26.532>and <00:34:26.672>I <00:34:26.812>can <00:34:26.951>start <00:34:27.092>from, <00:34:27.232>I <00:34:27.371>see <00:34:27.512>a <00:34:27.652>weird

576
00:34:30.252 --> 00:34:33.493
<00:34:30.252>packet <00:34:30.379>go <00:34:30.506>through <00:34:30.633>the <00:34:30.761>firewall <00:34:30.888>or <00:34:31.015>a <00:34:31.142>weird <00:34:31.270>query <00:34:31.397>go <00:34:31.524>through <00:34:31.652>DNS.

577
00:34:33.712 --> 00:34:37.412
<00:34:33.712>I <00:34:33.945>can <00:34:34.178>go <00:34:34.411>to <00:34:34.645>that <00:34:34.878>endpoint <00:34:35.112>and

578
00:34:37.473 --> 00:34:41.272
<00:34:37.473>see <00:34:37.600>if <00:34:37.727>there's <00:34:37.854>been <00:34:37.982>a <00:34:38.109>large <00:34:38.236>number <00:34:38.363>of <00:34:38.491>events <00:34:38.618>happening <00:34:38.745>on <00:34:38.873>that

579
00:34:41.292 --> 00:34:44.112
<00:34:41.292>machine <00:34:41.491>or <00:34:41.692>an <00:34:41.891>anomalous <00:34:42.092>amount <00:34:42.292>of <00:34:42.491>queries <00:34:42.692>happening,

580
00:34:45.292 --> 00:34:49.033
<00:34:45.292>and <00:34:45.419>drill <00:34:45.546>into <00:34:45.673>the <00:34:45.801>individual <00:34:45.928>events <00:34:46.055>that <00:34:46.182>have <00:34:46.310>happened <00:34:46.437>on <00:34:46.564>that <00:34:46.692>machine,

581
00:34:49.112 --> 00:34:51.192
<00:34:49.112>down <00:34:49.312>to <00:34:49.512>the <00:34:49.712>user <00:34:49.912>and <00:34:50.112>executable <00:34:50.312>as <00:34:50.512>well.

582
00:34:53.792 --> 00:34:57.482
<00:34:53.792>Another <00:34:53.931>thing <00:34:54.072>that's <00:34:54.212>super <00:34:54.351>useful <00:34:54.491>is <00:34:54.632>I <00:34:54.772>can <00:34:54.911>go <00:34:55.052>through <00:34:55.192>and

583
00:34:57.692 --> 00:35:00.732
<00:34:57.692>look <00:34:57.925>at <00:34:58.158>firewall <00:34:58.392>metrics. <00:34:58.625>So <00:34:58.858>I <00:34:59.092>can

584
00:35:00.852 --> 00:35:04.652
<00:35:00.852>see <00:35:00.991>very <00:35:01.132>quickly <00:35:01.272>over <00:35:01.412>a <00:35:01.551>long <00:35:01.692>range <00:35:01.832>of <00:35:01.971>time <00:35:02.112>how <00:35:02.252>much

585
00:35:04.672 --> 00:35:08.632
<00:35:04.672>bandwidth <00:35:04.827>I've <00:35:04.983>used. <00:35:05.138>So <00:35:05.294>a <00:35:05.449>common <00:35:05.605>thing <00:35:05.760>that <00:35:05.916>happens <00:35:06.072>during

586
00:35:08.642 --> 00:35:12.132
<00:35:08.642>attack <00:35:08.841>is <00:35:09.042>data <00:35:09.241>exfiltration. <00:35:09.442>And <00:35:09.642>because <00:35:09.841>I'm <00:35:10.042>able

587
00:35:12.272 --> 00:35:12.672
to

588
00:35:13.612 --> 00:35:14.012
<00:35:13.612>collect <00:35:13.972>the

589
00:35:15.672 --> 00:35:19.552
<00:35:15.672>bandwidth <00:35:15.779>utilization <00:35:15.887>as <00:35:15.995>a <00:35:16.102>metric <00:35:16.210>rather <00:35:16.318>than <00:35:16.425>having <00:35:16.533>to <00:35:16.641>aggregate <00:35:16.748>logs <00:35:16.856>like <00:35:16.964>what <00:35:17.072>a

590
00:35:19.572 --> 00:35:20.922
<00:35:19.572>lot <00:35:19.745>of <00:35:19.919>SIEMs <00:35:20.092>would <00:35:20.266>do <00:35:20.439>to <00:35:20.613>do <00:35:20.787>this,

591
00:35:22.972 --> 00:35:26.592
<00:35:22.972>I <00:35:23.127>can <00:35:23.283>quickly <00:35:23.438>see <00:35:23.594>patterns <00:35:23.749>over <00:35:23.905>a <00:35:24.060>long <00:35:24.216>range <00:35:24.372>for

592
00:35:26.632 --> 00:35:28.222
<00:35:26.632>things <00:35:27.098>because <00:35:27.565>metrics <00:35:28.032>are

593
00:35:29.072 --> 00:35:30.812
<00:35:29.072>significantly <00:35:29.352>cheaper <00:35:29.632>to <00:35:29.912>store <00:35:30.192>than <00:35:30.472>logs.

594
00:35:32.312 --> 00:35:36.152
<00:35:32.312>And <00:35:32.419>I <00:35:32.527>can <00:35:32.635>see <00:35:32.742>if <00:35:32.850>there's <00:35:32.958>been <00:35:33.065>any <00:35:33.173>issues <00:35:33.281>on <00:35:33.388>the <00:35:33.496>router <00:35:33.604>as <00:35:33.712>well.

595
00:35:38.712 --> 00:35:42.272
<00:35:38.712>I'm <00:35:38.819>also <00:35:38.927>able <00:35:39.035>to <00:35:39.142>see <00:35:39.250>the <00:35:39.358>top <00:35:39.465>talkers <00:35:39.573>on <00:35:39.681>a <00:35:39.788>network, <00:35:39.896>so <00:35:40.004>which <00:35:40.112>ports

596
00:35:46.152 --> 00:35:49.792
<00:35:46.152>have <00:35:46.245>the <00:35:46.338>most <00:35:46.432>traffic <00:35:46.525>on <00:35:46.618>them. <00:35:46.712>Like <00:35:46.805>you <00:35:46.898>can <00:35:46.992>see <00:35:47.085>here, <00:35:47.178>there's <00:35:47.272>a <00:35:47.365>weird <00:35:47.458>amount <00:35:47.552>of

597
00:35:49.832 --> 00:35:53.622
<00:35:49.832>DNS <00:35:49.948>queries <00:35:50.065>that <00:35:50.182>are <00:35:50.298>going <00:35:50.415>through <00:35:50.531>the <00:35:50.648>firewall, <00:35:50.765>and <00:35:50.882>I <00:35:50.998>can <00:35:51.115>see <00:35:51.232>where

598
00:35:53.652 --> 00:35:57.592
<00:35:53.652>those <00:35:53.827>events <00:35:54.002>are <00:35:54.177>occurring. <00:35:54.352>And <00:35:54.527>I'm <00:35:54.702>also <00:35:54.877>seeing <00:35:55.052>who's

599
00:35:57.632 --> 00:35:58.832
<00:35:57.632>coming <00:35:57.848>into <00:35:58.064>the <00:35:58.279>network <00:35:58.496>as <00:35:58.712>well.

600
00:36:01.752 --> 00:36:05.472
<00:36:01.752>And <00:36:01.852>another <00:36:01.952>nice <00:36:02.052>thing <00:36:02.152>is <00:36:02.252>everything <00:36:02.352>I've <00:36:02.452>talked <00:36:02.552>about <00:36:02.652>so <00:36:02.752>far <00:36:02.852>with <00:36:02.952>Chiffon <00:36:03.052>has <00:36:03.152>been

601
00:36:05.492 --> 00:36:08.071
<00:36:05.492>open <00:36:05.692>source, <00:36:05.892>but <00:36:06.092>there <00:36:06.292>is <00:36:06.492>a <00:36:06.692>commercial <00:36:06.892>service

602
00:36:08.892 --> 00:36:12.772
<00:36:08.892>called <00:36:09.067>VM <00:36:09.241>Anomaly, <00:36:09.417>where <00:36:09.591>I'm <00:36:09.767>able <00:36:09.942>to <00:36:10.116>generate <00:36:10.292>expected

603
00:36:12.832 --> 00:36:15.152
<00:36:12.832>ranges <00:36:13.031>for <00:36:13.232>metrics, <00:36:13.432>and <00:36:13.632>I'm <00:36:13.832>able <00:36:14.031>to <00:36:14.232>check

604
00:36:16.712 --> 00:36:20.622
<00:36:16.712>if <00:36:16.828>there <00:36:16.945>has <00:36:17.062>been <00:36:17.178>an <00:36:17.295>issue. <00:36:17.412>So <00:36:17.528>if <00:36:17.645>the <00:36:17.762>security <00:36:17.878>team <00:36:17.995>does <00:36:18.112>get

605
00:36:20.652 --> 00:36:24.112
<00:36:20.652>blamed <00:36:20.807>for <00:36:20.963>some <00:36:21.118>security <00:36:21.274>scan <00:36:21.429>or <00:36:21.585>some <00:36:21.740>other <00:36:21.896>assessment <00:36:22.052>causing

606
00:36:24.172 --> 00:36:28.072
<00:36:24.172>issues <00:36:24.372>for <00:36:24.572>the <00:36:24.772>infrastructure <00:36:24.972>team <00:36:25.172>or <00:36:25.372>for <00:36:25.572>the

607
00:36:28.112 --> 00:36:31.772
<00:36:28.112>development <00:36:28.252>team, <00:36:28.392>the <00:36:28.532>security <00:36:28.672>team <00:36:28.812>can <00:36:28.952>go <00:36:29.092>through <00:36:29.232>and <00:36:29.372>say, <00:36:29.512>"Hey,

608
00:36:33.392 --> 00:36:37.122
<00:36:33.392>there <00:36:33.499>was <00:36:33.607>or <00:36:33.715>wasn't <00:36:33.822>an <00:36:33.930>anomaly <00:36:34.038>here." <00:36:34.145>And <00:36:34.253>they're <00:36:34.361>able <00:36:34.468>to <00:36:34.576>look <00:36:34.684>at <00:36:34.792>response

609
00:36:37.172 --> 00:36:40.142
<00:36:37.172>time, <00:36:37.299>and <00:36:37.426>they're <00:36:37.553>also <00:36:37.681>able <00:36:37.808>to <00:36:37.935>go <00:36:38.062>through <00:36:38.190>and <00:36:38.317>look <00:36:38.444>at <00:36:38.572>availability.

610
00:36:40.262 --> 00:36:44.152
<00:36:40.262>And <00:36:40.355>if <00:36:40.448>they <00:36:40.542>see <00:36:40.635>a <00:36:40.728>dashboard <00:36:40.822>like <00:36:40.915>this, <00:36:41.008>they <00:36:41.102>can <00:36:41.195>go <00:36:41.288>to <00:36:41.382>the <00:36:41.475>infrastructure <00:36:41.568>team <00:36:41.662>and

611
00:36:44.212 --> 00:36:48.192
<00:36:44.212>assure <00:36:44.328>them <00:36:44.445>that, <00:36:44.562>"Hey, <00:36:44.678>there <00:36:44.795>isn't <00:36:44.912>a <00:36:45.028>security <00:36:45.145>issue <00:36:45.262>here," <00:36:45.378>or, <00:36:45.495>"The <00:36:45.612>issue's

612
00:36:48.232 --> 00:36:52.212
<00:36:48.232>been <00:36:48.407>resolved," <00:36:48.582>before <00:36:48.757>they <00:36:48.932>have <00:36:49.107>to <00:36:49.282>go <00:36:49.457>communicate <00:36:49.632>with

613
00:36:52.252 --> 00:36:55.412
<00:36:52.252>the <00:36:52.392>team. <00:36:52.532>So <00:36:52.672>one <00:36:52.812>of <00:36:52.952>the <00:36:53.092>big <00:36:53.232>benefits <00:36:53.372>of <00:36:53.512>having <00:36:53.652>these

614
00:36:55.452 --> 00:36:58.542
<00:36:55.452>two <00:36:55.802>tools <00:36:56.152>together <00:36:56.502>is <00:36:56.852>that

615
00:36:59.236 --> 00:37:02.796
<00:36:59.236>It <00:36:59.469>can <00:36:59.702>have <00:36:59.935>people <00:37:00.169>have <00:37:00.402>their <00:37:00.636>moods

616
00:37:02.816 --> 00:37:05.856
<00:37:02.816>deescalated <00:37:03.165>beforehand. <00:37:03.515>I've <00:37:03.866>had <00:37:04.216>people

617
00:37:07.016 --> 00:37:10.326
<00:37:07.016>immediately <00:37:07.171>blame <00:37:07.327>me <00:37:07.482>as <00:37:07.638>the <00:37:07.793>infrastructure <00:37:07.949>person <00:37:08.104>for <00:37:08.260>something <00:37:08.416>changing,

618
00:37:10.976 --> 00:37:14.956
<00:37:10.976>and <00:37:11.256>I've <00:37:11.536>honestly <00:37:11.816>been <00:37:12.096>the <00:37:12.376>person

619
00:37:15.155 --> 00:37:18.356
<00:37:15.155>blaming <00:37:15.295>security <00:37:15.435>for <00:37:15.575>stuff. <00:37:15.715>But <00:37:15.855>if <00:37:15.995>I <00:37:16.135>had <00:37:16.275>the <00:37:16.415>ability <00:37:16.555>to

620
00:37:19.376 --> 00:37:23.236
<00:37:19.376>see <00:37:19.503>the <00:37:19.630>same <00:37:19.757>picture <00:37:19.885>that <00:37:20.012>the <00:37:20.139>security <00:37:20.266>team <00:37:20.394>I <00:37:20.521>was <00:37:20.648>looking <00:37:20.776>at,

621
00:37:24.096 --> 00:37:27.986
<00:37:24.096>I <00:37:24.203>would <00:37:24.311>have <00:37:24.419>been <00:37:24.526>much <00:37:24.634>calmer <00:37:24.742>when <00:37:24.849>I <00:37:24.957>went <00:37:25.065>to <00:37:25.172>go <00:37:25.280>talk <00:37:25.388>to <00:37:25.496>that

622
00:37:28.016 --> 00:37:28.836
<00:37:28.016>security <00:37:28.754>person.

623
00:37:32.476 --> 00:37:35.706
<00:37:32.476>I've <00:37:32.676>recently <00:37:32.876>been <00:37:33.076>adding <00:37:33.276>OpenTelemetry <00:37:33.476>to <00:37:33.676>ShiftOn <00:37:33.876>as

624
00:37:35.756 --> 00:37:39.656
<00:37:35.756>well. <00:37:35.931>And <00:37:36.106>one <00:37:36.281>of <00:37:36.455>the <00:37:36.631>things <00:37:36.806>that <00:37:36.981>was <00:37:37.156>a

625
00:37:39.696 --> 00:37:41.036
<00:37:39.696>struggle <00:37:39.937>for <00:37:40.178>me <00:37:40.419>was <00:37:40.660>the <00:37:40.902>first

626
00:37:42.116 --> 00:37:45.136
<00:37:42.116>application <00:37:42.316>I <00:37:42.516>tried <00:37:42.716>implementing <00:37:42.916>with <00:37:43.116>OpenTelemetry <00:37:43.316>was <00:37:43.516>public-facing,

627
00:37:45.736 --> 00:37:49.396
<00:37:45.736>and <00:37:45.969>figuring <00:37:46.202>out <00:37:46.435>whether <00:37:46.669>I <00:37:46.902>had <00:37:47.136>OpenTelemetry

628
00:37:49.436 --> 00:37:53.026
<00:37:49.436>misconfigured <00:37:49.611>or <00:37:49.786>if <00:37:49.961>it <00:37:50.136>was <00:37:50.311>a <00:37:50.486>network <00:37:50.661>issue <00:37:50.836>was

629
00:37:54.776 --> 00:37:56.316
<00:37:54.776>actually <00:37:55.238>facilitated <00:37:55.700>by <00:37:56.162>ShiftOn.

630
00:37:56.516 --> 00:38:00.356
<00:37:56.516>So <00:37:56.632>you <00:37:56.749>can <00:37:56.866>see <00:37:56.982>on <00:37:57.099>the <00:37:57.216>left <00:37:57.332>here, <00:37:57.449>I <00:37:57.566>can <00:37:57.682>see <00:37:57.799>that <00:37:57.916>a

631
00:38:00.396 --> 00:38:04.186
<00:38:00.396>trace <00:38:00.489>was <00:38:00.582>going <00:38:00.676>all <00:38:00.769>the <00:38:00.862>way <00:38:00.956>through, <00:38:01.049>and <00:38:01.142>I <00:38:01.236>was <00:38:01.329>able <00:38:01.422>to <00:38:01.516>confirm <00:38:01.609>that <00:38:01.702>the <00:38:01.796>network

632
00:38:04.256 --> 00:38:08.016
<00:38:04.256>wasn't <00:38:04.411>the <00:38:04.567>issue. <00:38:04.722>So <00:38:04.878>when <00:38:05.033>I <00:38:05.189>was <00:38:05.344>setting <00:38:05.500>up <00:38:05.656>OpenTelemetry

633
00:38:08.026 --> 00:38:11.646
<00:38:08.026>Collector, <00:38:08.133>I <00:38:08.241>needed <00:38:08.349>to <00:38:08.456>open <00:38:08.564>up <00:38:08.672>a <00:38:08.779>new <00:38:08.887>port <00:38:08.995>to <00:38:09.102>my <00:38:09.210>DMZ <00:38:09.318>because <00:38:09.426>that's

634
00:38:11.676 --> 00:38:15.056
<00:38:11.676>where <00:38:11.909>the <00:38:12.142>host <00:38:12.375>for <00:38:12.609>the <00:38:12.842>application <00:38:13.076>lived.

635
00:38:15.116 --> 00:38:19.056
<00:38:15.116>And <00:38:15.271>I <00:38:15.427>was <00:38:15.582>only <00:38:15.738>getting <00:38:15.893>traces <00:38:16.049>from <00:38:16.204>Caddy <00:38:16.360>and <00:38:16.516>Traefik,

636
00:38:19.116 --> 00:38:20.106
<00:38:19.116>but <00:38:19.413>I <00:38:19.710>wasn't <00:38:20.007>getting

637
00:38:21.236 --> 00:38:24.256
<00:38:21.236>them <00:38:21.391>from <00:38:21.547>the <00:38:21.702>application <00:38:21.858>which <00:38:22.013>lived <00:38:22.169>on <00:38:22.324>a <00:38:22.480>different <00:38:22.636>machine,

638
00:38:25.596 --> 00:38:28.176
<00:38:25.596>and <00:38:25.751>they <00:38:25.907>were <00:38:26.062>using <00:38:26.218>different <00:38:26.373>protocols <00:38:26.529>for <00:38:26.684>telemetry <00:38:26.840>as <00:38:26.996>well.

639
00:38:28.776 --> 00:38:29.176
So

640
00:38:30.316 --> 00:38:33.936
<00:38:30.316>it <00:38:30.409>was <00:38:30.502>really <00:38:30.596>nice <00:38:30.689>to <00:38:30.782>be <00:38:30.875>able <00:38:30.969>to <00:38:31.062>go <00:38:31.156>through <00:38:31.249>the <00:38:31.342>network <00:38:31.435>flow <00:38:31.529>logs <00:38:31.622>from <00:38:31.716>Suricata

641
00:38:34.536 --> 00:38:38.476
<00:38:34.536>and <00:38:34.691>compare <00:38:34.847>them <00:38:35.002>to <00:38:35.158>the <00:38:35.313>OpenTelemetry <00:38:35.469>logs <00:38:35.624>to <00:38:35.780>see <00:38:35.936>whether

642
00:38:38.496 --> 00:38:40.636
<00:38:38.496>or <00:38:38.696>not <00:38:38.896>OTel <00:38:39.096>was <00:38:39.296>being <00:38:39.496>blocked. <00:38:39.696>And <00:38:39.896>it

643
00:38:42.236 --> 00:38:45.176
<00:38:42.236>turned <00:38:42.352>something <00:38:42.469>that <00:38:42.586>was <00:38:42.702>like <00:38:42.819>a <00:38:42.935>coin <00:38:43.052>flip <00:38:43.169>into <00:38:43.286>something <00:38:43.402>that <00:38:43.519>was <00:38:43.636>certain

644
00:38:46.076 --> 00:38:47.296
<00:38:46.076>as <00:38:46.259>to <00:38:46.442>what <00:38:46.625>the <00:38:46.808>root <00:38:46.991>cause <00:38:47.174>was.

645
00:38:49.636 --> 00:38:53.576
<00:38:49.636>There's <00:38:49.811>some <00:38:49.986>resources <00:38:50.161>for <00:38:50.336>the <00:38:50.511>SIEMinABox <00:38:50.686>project, <00:38:50.861>the <00:38:51.036>talk

646
00:38:53.636 --> 00:38:57.276
<00:38:53.636>for <00:38:53.869>NVIDIA's <00:38:54.102>threat <00:38:54.336>hunting <00:38:54.569>process, <00:38:54.802>the <00:38:55.036>VictoriaMetrics

647
00:38:57.296 --> 00:38:59.856
<00:38:57.296>documentation, <00:38:57.529>and <00:38:57.762>the <00:38:57.995>Sysmon <00:38:58.229>config <00:38:58.462>I'm <00:38:58.696>using.

648
00:39:01.896 --> 00:39:03.296
<00:39:01.896>And <00:39:02.106>thanks <00:39:02.316>for <00:39:02.526>listening <00:39:02.736>to <00:39:02.946>my <00:39:03.156>talk.