Where to start with RBA

[ZachTheSplunker]

Question from "The Office Hours" meetup

Where do I start? And how often do I review the detections?

[ZachTheSplunker]

Answer from "The Office Hours" meetup

• 3-5 detections/rules (for smaller companies)
• make sure they tell a story - spanning a breadth of ATT&CK phases
• discuss with your internal RBA committee on a weekly basis to discuss alerts, and maybe monthly with the leadership to discuss trends

NOTE: don't be afraid to set the risk score to zero

[ZachTheSplunker]

Answer from "The Office" Hours meetup

• Leverage MITRE ATT&CK framework if you're at the start of your journey OR leverage you existing alert landscape and focus on noisy ones
• Paint a picture
• If engaging PS, stick to one use per day, no more
• Don't try to boil the ocean - stick to crawl, walk, run approach