DEF CON 33 - Hacking Context for Auto Root Cause and Attack Flow Discovery - Ezz Tahoun
Source: YouTube · DEFCONConference · published Oct 10, 2025 · 1:03:46
Blue team security struggles with false positives and data correlation. Correlation involves both grouping similar data points and constructing attack stories.
Key Takeaways:
• Traditional correlation rules are too narrow and lack context for grouping related events
• Security data contains massive duplication - single activities can generate thousands of redundant events
• Machine learning approaches are more effective than rules for grouping events and identifying attack chains
• Implementing proper grouping and deduplication before SIEM systems can reduce storage costs by up to 93%
The solution requires a two-step process: first grouping related events to reduce noise, then identifying sequential attack patterns that tell the complete security story.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
So now it is 5:00 top of the hour. Good a good afternoon everyone. Uh thank you so much for being here. Before I introduced to you Ed Cahoun, right? >> Oh yes. >> So we want to give a shout out to our sponsors uh for the packet hacking village sponsors this year. Uh platinum sponsors area security gold deoid Canada vigilant uh bronze T-Mobile copper BPM 909 cyber and 4542. Thank you so much for their support and helping us get our village up and running this year. It is now my honor to introduce to you our speaker uh for the packet hacking village creative stage talks. Uh and our final one is uh actually someone that we know, Ed Tahon. Ed, >> thank you 100%. I appreciate you. >> There you go. >> Oh, there we go. Beautiful. >> Hello. Hello everybody. I hope you had a fantastic second day at…