Cover of AI Blue

Book 8 · Presentation

AI Blue

How Artificial Intelligence Transforms the Blue Team in European Enterprises and Public Authorities

67 slidesPowerPoint · 2.1 MB

Download the deck (.pptx) Read the book online

All presentations / AI Blue

All slides

Select a slide to see it larger; use the arrow keys to move through the deck.

  1. Slide 1: AI Blue1
  2. Slide 2: The Blue Team in Question2
  3. Slide 3: Introduction: The Blue Team Transformed3
  4. Slide 4: Introduction: The Blue Team Transformed4
  5. Slide 5: What the Blue Team Does: Five Functions, Tiers and the Alert Queue5
  6. Slide 6: What the Blue Team Does: Five Functions, Tiers and the Alert Queue6
  7. Slide 7: The Pressure on the Blue Team: Machine-Speed Adversaries, Alert Volume and Scarce Talent7
  8. Slide 8: The Pressure on the Blue Team: Machine-Speed Adversaries, Alert Volume and Scarce Talent8
  9. Slide 9: The Transformed Blue Team Defined: Mandate, Functions and Degrees of Delegation9
  10. Slide 10: The Transformed Blue Team Defined: Mandate, Functions and Degrees of Delegation10
  11. Slide 11: The Craft11
  12. Slide 12: Anticipate: Threat Intelligence and Exposure at Machine Speed12
  13. Slide 13: Anticipate: Threat Intelligence and Exposure at Machine Speed13
  14. Slide 14: Detect: Detection Engineering as Code14
  15. Slide 15: Detect: Detection Engineering as Code15
  16. Slide 16: Triage Transformed: From Alert Queue to Verified Case16
  17. Slide 17: Triage Transformed: From Alert Queue to Verified Case17
  18. Slide 18: Investigate: Hypotheses, Timelines and Evidence with AI18
  19. Slide 19: Investigate: Hypotheses, Timelines and Evidence with AI19
  20. Slide 20: Threat Hunting Transformed: Hypotheses, Data and Agents20
  21. Slide 21: A hunt from hypothesis to query, finding, detection and coverage statement21
  22. Slide 22: Respond: Playbooks, Bounded Containment and the Stop Path22
  23. Slide 23: Respond: Playbooks, Bounded Containment and the Stop Path23
  24. Slide 24: Learn: Post-Incident Review, Purple Teaming and Detection Debt24
  25. Slide 25: Learn: Post-Incident Review, Purple Teaming and Detection Debt25
  26. Slide 26: The Blue Team's AI Team26
  27. Slide 27: The Analyst's Own Use of AI: Querying, Drafting and Summarising in Modes 1 to 327
  28. Slide 28: The Analyst's Own Use of AI: Querying, Drafting and Summarising in Modes 1 to 328
  29. Slide 29: An AI Agent Team for the SOC: Skills, Mandates and Containment29
  30. Slide 30: An AI Agent Team for the SOC: Skills, Mandates and Containment30
  31. Slide 31: Verifying What the AI Concludes: Review for Soundness When the Analyst Depends on the AI31
  32. Slide 32: Verifying What the AI Concludes: Review for Soundness When the Analyst Depends on the AI32
  33. Slide 33: Defending the Defenders' AI: Poisoned Telemetry, Hostile Tickets and the SOC as Tier 033
  34. Slide 34: Defending the Defenders' AI: Poisoned Telemetry, Hostile Tickets and the SOC as Tier 034
  35. Slide 35: The Team in the Organisation35
  36. Slide 36: Operating Models: In-House, Managed, Hybrid and Sovereign Security Operations36
  37. Slide 37: Operating Models: In-House, Managed, Hybrid and Sovereign Security Operations37
  38. Slide 38: Team Design and Roles: After the Tier-1 Pyramid38
  39. Slide 39: Team Design and Roles: After the Tier-1 Pyramid39
  40. Slide 40: Decision Rights and Escalation: Who May Contain, Isolate and Disclose40
  41. Slide 41: Decision Rights and Escalation: Who May Contain, Isolate and Disclose41
  42. Slide 42: Regulation as Constraint: NIS 2, DORA, CRA, GDPR, the AI Act and the Reporting Clock42
  43. Slide 43: Regulation as Constraint: NIS 2, DORA, CRA, GDPR, the AI Act and the Reporting Clock43
  44. Slide 44: Measuring the Transformed Blue Team: Speed, Coverage and Quality of Judgement44
  45. Slide 45: Measuring the Transformed Blue Team: Speed, Coverage and Quality of Judgement45
  46. Slide 46: People and Career46
  47. Slide 47: The Analyst at Work: Fatigue, On-Call and Being Managed by Metrics47
  48. Slide 48: The Analyst at Work: Fatigue, On-Call and Being Managed by Metrics48
  49. Slide 49: Competences, Training and Exercises: A Framework for the Transformed Blue Team49
  50. Slide 50: Competences, Training and Exercises: A Framework for the Transformed Blue Team50
  51. Slide 51: Keeping the Craft and Making New Analysts: The Apprenticeship Problem51
  52. Slide 52: Keeping the Craft and Making New Analysts: The Apprenticeship Problem52
  53. Slide 53: The Future of the Blue Team: Will There Be a SOC in 2036?53
  54. Slide 54: A horizon register with three scenarios for the blue team in 203654
  55. Slide 55: Experience and Conclusions55
  56. Slide 56: Case Studies and Anti-Patterns56
  57. Slide 57: Seven anti-patterns of the transformed blue team, each with its control57
  58. Slide 58: A Year on the Blue Team: Nordvik Region and Hansa Mutual58
  59. Slide 59: A Year on the Blue Team: Nordvik Region and Hansa Mutual59
  60. Slide 60: Nordvik Region and Hansa Mutual: Conclusions for Two Organisations60
  61. Slide 61: Nordvik Region and Hansa Mutual: Conclusions for Two Organisations61
  62. Slide 62: Conclusions: The Blue Team Transformed62
  63. Slide 63: Conclusions: The Blue Team Transformed63
  64. Slide 64: Appendices64
  65. Slide 65: Code Examples: Detection, Case, Playbook and Mandate Artefacts65
  66. Slide 66: Templates and Tools66
  67. Slide 67: AI Blue67