Ep 112 | 6.17.24

The current state of XDR: A Rick-the-toolman episode.

Show Notes

Rick Howard, The CSO, Chief Analyst, and Senior Fellow at N2K Cyber, discusses the current state of “eXtended Detection and Response” (XDR) with CyberWire Hash Table guests Rick Doten, Centene’s VP of Security, and Milad Aslaner, Sentinel One’s XDR Product Manager.

For a complete reading list and even more information, check out Rick’s more detailed essay on the topic.

References:

Alexandra Aguiar, 2023. Key Trends from the 2023 Hype Cycle for Security Operations [Gartner Hype Cycle Chart]. Noetic Cyber.

Daniel Suarez, 2006. Daemon [Book]. Goodreads.

Dave Crocker, 2020. Who Invented Email, Email History, How Email Was Invented [Websote]. LivingInternet.

Eric Hutchins, Michael Cloppert, Rohan Amin, 2010, Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains [Paper] Lockheed Martin Corporation.

Jon Ramsey, Mark Ryland, 2022. AWS co-announces release of the Open Cybersecurity Schema Framework (OCSF) project [Press Release]. Amazon Web Services.

Nir Zuk, 2018. Palo Alto Networks Ignite USA ’18 Keynote [Presentation]. YouTube.

Raffael Marty, 2021. A Log Management History Lesson – From syslogd(8) to XDR [Youtube Video]. YouTube.

Raffael Marty, 2021. A history lesson on security logging, from syslogd to XDR [Essay]. VentureBeat.

Rick Howard, 2020. Daemon [Podcast]. Word Notes.

Rick Howard, 2021. XDR: from the Rick the Toolman Series. [Podcast and Essay]. CSO Perspectives, The CyberWire.

Rick Howard, 2023. Cybersecurity First Principles: A Reboot of Strategy and Tactics [Book]. Goodreads.

Staff, n.d. Open Cybersecurity Schema Framework [Standard]. GitHub.

Staff, 2019. What is EDR? Endpoint Detection & Response Defined [Explainer]. CrowdStrike.

Staff, 2020. Log Formats – a (Mostly) Complete Guide [Explainer]. Graylog.

Stephen Watts, 2023. Common Event Format (CEF): An Introduction [Explainer]. Splunk.

Thomas Lintemuth, Peter Firstbrook, Ayelet Heyman, Craig Lawson, Jeremy D’Hoinne, 2023. Market Guide for Extended Detection and Response [Essay]. Gartner.

CISO Perspectives (Pro)

Podcast Info

HOST(S):

Kim Jones is an intelligence, security, and risk management expert with nearly 40 years of experience in information security strategy, governance and compliance, and security operations. He has built, operated, and led security programs across industries, and is the principal architect of one of Arizona State University's cybersecurity education programs. Kim also teaches in SANS' leadership curriculum and UC Berkeley's MICS program. He holds a B.S. in Computer Science from West Point, an M.S. in Information Assurance from Norwich University, and CISM and CISSP certifications.

Schedule: Tuesdays (in season)

Creator: N2K CyberWire