Talos interview covers Ryan Fetterman's path into detection research
Original title: From federal SOCs to Talos: Ryan Fetterman on practical security research
He recounts 15 years from federal SOC work and Splunk's SURGe team into Talos, including an early Pandora Song case.
Cisco Talos published an interview in which Ryan Fetterman describes moving from consulting and federal security operations in the Washington, DC area to Splunk research and then Talos after Cisco acquired Splunk. He discusses detection engineering, host-based analytics in Splunk, and his first APT incident, which he identifies by the Pandora Song command-and-control name. The published text cuts off before the incident details and points readers to the full video.
- Fetterman says he has worked in security for about 15 years, including about a decade in the DC area.
- He says querying logs and building analytics in Splunk led him toward security operations.
- He names Pandora Song as the C2 from his first APT incident at a federal SOC.
- Products
- Splunk
- Malware
- Pandora Song
- Organizations
- Cisco Talos
From the original article
3 min read at blog.talosintelligence.com
What does it mean to be "blue collar" for the blue team? Ryan Fetterman discusses the realities of detection engineering, and shares his philosophy on building a career in security without burning out.
By Amy Ciminnisi · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.