Home Grown Machine Learning Implementation for the SOC

The machine learning deployment, integration, and release pipeline is unique and unlike any typical software, application or detection life cycle. A SOC has a blend of infrastructure, team dynamics, disparate logs and data sets, a SEIM, ticketing systems and a need for analytics to better serve and improve their defenses, cyber security posture and incident response. Proper implementation of using machine learning for cyber security defenses can be done with both team and engineering integrations. This talk will walk through an example of machine learning implementation for the SOC in an enterprise environment with lessons learned and best practices.