Detection engineers must constantly adapt as attackers evolve tactics
The claim
The authors assert that attackers continuously evolve their tactics to outpace traditional defenses.
Published as: “From federal SOCs to Talos: Ryan Fetterman on practical security research”
The five-minute version
Ryan Fetterman discusses his career path from federal SOC work to Talos, emphasizing his early work with host-based analytics in Splunk. He describes an early APT incident (Pandora Song) that highlighted the need for proactive detection engineering. The interview underscores that attackers constantly change tactics, forcing blue-team engineers to innovate and avoid burnout through project-based learning and work-life balance.
What they found 1
- Early host-based analytics work in Splunk was used to investigate an APT incident.
“I was looking at a lot of host-based sensors and writing analytics in Splunk, actually, and we had been tipped off to this incident by a third party.”
Artifacts & methods 3
- Splunksystem
- host-based sensorsprimitive
- Pandora Song APTprimitive