Nebulock’s Alex Hurtado on why current logs fail to distinguish AI agents from info stealers

That's interesting.

So, uh, obviously, uh, you know, anybody who went to Black Hat, I've heard a few comments that it's, it felt more like an AI conference than a security conference.

Oh man.

Yeah.

Yeah.

From the detection engineering standpoint, what kind of things are you seeing or developing and like what kind of questions are you asking now as organizations like, uh, in develop and like bring into their fold like these new AI tools, and like what kind of detection engineering techniques, tactics, et cetera, are you looking at?

Yeah.

So there's multiple ways I feel like you could think about this.

So if we think about the end-to-end detection engineering life cycle process, you can, um, you can apply AI in a way that makes sense across maybe the way that you ingest data, uh, and you are parsing it a certain way or you're enriching it during the time when you extract it.

Um, then...

Or you could do it as it, once it's already lands in the storage, you can, um, figure out, uh, y- you can use it to generate the query logic, I guess, against where it, where it's, uh, being stored.

Uh, I think a lot, I think a lot of us are in this space where, I mean it, it's a no-brainer to use AI to help you generate that SQL or whatever you're building in CQL, right, in, in the case of CrowdStrike or SPL 'cause, 'cause that...

I hate writing SPL queries.

Um, [laughs] trauma.

Trauma.

Or, or, or, uh, QRadar was AQL, the Aerial Query Language, uh, flash- flashback.

Um, but so that, I feel like that's where the space where if it's already gonna get you, what, 80% of the way there, why not, right? Why not use it? So not only in the query generation, but also I, I've, I've, you know, we- we've been toying in the space too where once an alert has been created, um, and let's say it does give you a bad result, like a false positive, uh, using it on a larger scale to figure out maybe what are some tuning opportunities and how you can make that logic better, uh, and that is where I feel like it's gonna have the most impact.

And, or, or when you're creating or you're deciding what net- new detection to write, having an agentic workflow to tell you, "Hey, maybe you don't wanna write that new rule because it's very similar to something you already have," and having that kind of guide you through this CI/CD, hence the CI/CD thinking process of what you should validate, what sh- you should consider, what phases you should bring a detection across until it becomes like a fully like blessed sc- like de- absolutely deploy this detection out there.

Um, and that's, I feel like it's the, the growing levels of maturity where you can, uh, where detection engineering has really evolved.