Threat Detection and Response at Scale with Dominique Brezinski
4 likes2,416 views
The document discusses Apple's information security focus on threat detection and response via a data platform approach that manages diverse threats and data sets. It highlights the scale of operations, with over 300 billion events processed daily and an architecture enabling efficient data ingestion and analytics. The document also emphasizes data reduction techniques that significantly lessen the volume of data scanned for analysis.
Related topics:1 of 25
Downloaded 142 times
More Related Content
What's hot (20)
Ad
Similar to Threat Detection and Response at Scale with Dominique Brezinski (20)
Ad
More from Databricks (20)
Recently uploaded (20)
Threat Detection and Response at Scale with Dominique Brezinski
- 1. Dominique Brezinski — Apple Information Security • Threat Detection and Response • at Scale
- 2. This is about the data platform aspect, not the specific analytics
- 3. Agenda • Use Cases, Scale, • and Challenges/Solutions
- 5. Enabling Detection and Analytics
- 6. Diverse threats require diverse data sets
- 7. Streams (left joined) with context and filtered or (inner joined) with indicators
- 8. Large time window, multi-dataset graphs
- 9. Enabling Triage and Containment
- 10. Search and Query
- 11. WHERE date > current_date() - 30 days
- 12. Scale
- 14. >100TB new data a day
- 15. >300 billion events per day
- 16. Most queried table: 504,761,911,529,518 bytes, 11,149,012,553,409 rows Yeah, trillions!
- 24. WHERE src_ip = x AND dst_ip = y Total data size: 504 terabytes, 11,149,387,374,965 rows Scanned data size: 36.5 terabytes, 722,630,063,648 rows Additional reduction thanks to data skipping (bytes): 92.4% Additional reduction thanks to data skipping (rows): 93.2%
- 25. Simple. Unified.