AI Hunting with the Cybereason Platform: A SANS Review
SANS reviewed Cybereason's AI hunting platform, which offers a lightweight, behavior-focused model of host-based protection that can help intrusion analysis and investigations teams more rapidly and efficiently prevent, detect and analyze malicious behavior in their environments.
38525 (PDF, 3.29MB)
23 Jul 2018Related Content
AI-Driven SecOps: Unifying Controls, Automating Response, and Advancing the Modern SOC Using Cortex XSIAM
Research PaperNew research from IDC reveals the tangible business value of rigorous, practitioner-led training from SANS: faster threat detection and response, reduced operational risk, stronger team cohesion, and millions in annual cost savings.
- 29 Jul 2025
- Dave Shackleford
Trust But Verify: Evaluating the Accuracy of LLMs in Normalizing Threat Data Feeds
Research PaperThis paper examines whether Large Language Models (LLMs) can be reliably applied to the normalization of Indicators of Compromise (IOCs) into Structured Threat Information Expression (STIX) format.
- 16 Jul 2025
Do AI Coding Assistants Make Bad Coders Worse? A Security Evaluation of GitHub Copilot
Research PaperThis paper examines whether the overall security posture of a project affects the quality of the code produced by Copilot.
- 11 Jul 2025
Dropzone AI Can Make Internal SOC Teams More Effective
Research PaperIn this paper, SANS Certified Instructor Mark Jeanmougin examines how Dropzone AI can integrate into existing security stacks and help SOC teams stay focused on high-impact decisions.
- 17 Jun 2025
- Mark Jeanmougin
Threat Intelligence-Driven Attack Surface Management
Research PaperDefenders struggle to keep up with the pace of digital transformation in the face of an expanding...
- 9 Aug 2022
How to Build and Use an Incident Response Playbook Effectively
Research PaperAn effective incident response playbook provides structure and clarity during high-pressure security events.
- 25 Jul 2022
Windows 10 vs. Windows 11, What Has Changed?
Research PaperWindows 10 was released on July 29, 2015. It has since become the most installed desktop operating...
- 25 Jul 2022
Malware Function-based encryption technique
Research PaperRecent malware often uses techniques to evade detection by cybersecurity products. One of the...
- 22 Jun 2022
Detecting Unauthorized Behavior From Legitimate Accounts
Research PaperIncident Responders face an almost insurmountable amount of log events, and the move to the Cloud...
- 22 Jun 2022
Recommendations for small/medium-sized businesses enabling incident response
Research PaperSecurity incidents are inevitable. While large businesses can afford security teams to prepare and...
- 17 Jan 2022
Cloud Forensics Triage Framework (CFTF)
Research PaperDigital media forensic investigations come in multiple forms and span single assets - from thumb...
- 28 Jul 2021
EDR Evasion: Stranger Things In A Payload
Research PaperTackling enterprise security has many pitfalls. Yet, the emergence of Endpoint Detection and Response (EDR) products has paved a way for threat hunters to act at scale.
- 28 Jul 2021
CIS CSC Controls vs. Ransomware: An Evaluation
Research PaperCybercriminals continue to develop and enhance both new and existing ransomware variants, exploiting...
- 19 May 2021
Missing SQLite Records Analysis
Research PaperThis article will specifically discuss the identification of missing records, within the SQLite...
- 12 Mar 2021
- Ian Whiffin
Insider Threat The Theft of Intellectual Property in Windows 10
Research PaperThe prevalence of the theft of intellectual property investigations has grown over the past years...
- 11 Mar 2021
A Forensic Analysis of the Encrypting File System
Research PaperEFS or the Encrypting File System is a feature of the New Technology File System (NTFS). EFS...
- 24 Feb 2021
Tactical Linguistics: Language Analysis in Cyber Threat Intelligence
Research PaperThe capability to effectively collect and analyze data in strategic foreign languages when...
- 15 Jan 2021
Practical Process Analysis - Automating Process Log Analysis with PowerShell
Research PaperWindows event log analysis is an important and often time-consuming part of endpoint forensics. Deep...
- 29 Dec 2020
Incident Response in a Security Operation Center
Research PaperCybercrime dates back to the late 1700s and remains a threat today. By observing current threats,...
- 27 Aug 2020
Applying the Scientific Method to Threat Hunting
Research PaperThreat hunting is a proactive approach to discover attackers within an organization. Without the use...
- 28 May 2020