Velociraptor

All right.

"Today I fucked up by demanding that my girlfriend show me where she buried our beans in the woods, causing her to break up with me."

[laughs] Jack and the beanstalk.

That's what I was gonna say.

"I thought this is a reasonable amount of beans and chickpeas to have every now and then, and would last for quite some time.

However, earlier this week, I opened the cabinet because I wanted to make a vegetarian chili using two cans of beans, but all of the beans were gone.

What the hell? I asked my girlfriend and she told me she buried all of the beans in the woods.

At first I thought she was joking, but she explained no, she had buried the beans in the woods.

... itself, um, is, is not a thing that like necessarily exis- Like there are other tools.

There's Velociraptor, there's CrowdStrike's thing.

Like every operating system also has some like built-in operating system telemetry thing.

Like Windows Sysmon is, is like an example of something like that.

Um, the people I think today that use OS Query, I could be wrong, so someone who possibly is listening and knows more about this, please tell me, of the 100-plus l-listeners we have now.

Um, my understanding is that the people who still, like, actively use OS Query, um, are, like, IR people.

Um, which for what it's worth, most of them use, like, Velociraptor, I think, from Rapid7, 'cause I think it's more built for, like, with, like, forensics and whatnot.

Um, th-but I think that, uh, I think that, like, the market of people who need something with OS Query-like capabilities, so are, are the following.

And from that, let's say, uh, you know, the incident response team comes in to quarantine everything, right? Everything's looking good.

Well, we actually have an open source tool called Velociraptor, where-

Oh, yeah

...

it does threat hunting, it gathers, you know, it's a, a forensics tool.

Our SOC will actually go in afterwards, pull all the artifacts using our agent with Velociraptor tied to it, and then give you a lessons learned incident report, say, "Hey, this is how they got in.

This is what you need to do to ensure this never happens again." Um, on top of that, the cybersecurity advisor, again, they're a part of your team.

They're an extension.

I know.

He's the lead singer of Velociraptor.

You know him and love him.

It's Jeremy Neal.

If I can observe what you've done and I can take a thing that branches off of it and then continue to extend that out and then receive royalties back for that work, can we collaborate better? Can we find other ways to be able to really extend my thought, my work into these nodes and edges to come up with new problems and solve for those instead.

So again, trying to pull it back, Velociraptor smart.

These agents, these models, it's not just that they're getting smarter, it's that they can scale to levels that we can't.

They can have 10,000 of them or 100,000 of them work and then disappear.