Topology Beats Noise: Entity-Centric Detection of SSLVPN Abuse
Building an entity-centric ES|QL hunting model for SSLVPN abuse by prioritizing topology over raw alert volume.
Topic
detection engineering
3 posts from the blog archive.
2026
2024
Chainsaw Hunt & Rules
Chainsaw's hunt feature, along with Chainsaw's rule engine, is an excellent way to hunt for evil at scale and create reusable, maintainable queries for rapid triage.
Chainsaw Search
A brief introduction to Chainsaw's search feature and the document tagging engine, Tau, that WithSecure released in the most recent major Chainsaw update.