Medium

Alex Ott

Alex Ott

·

Nov 2

On measuring MITRE ATT&CK coverage

The detection coverage is a measure for known adversary techniques, behaviors, or attack lifecycle stages that a security operations center…

On measuring MITRE ATT&CK coverage

Alex Ott

·

Oct 26

Scoring and clustering domain indicators with the Common Crawl web graph

A single domain indicator gives an analyst little context. A proxy log or a threat feed produces a domain, but it does not show whether the…

Scoring and clustering domain indicators with the Common Crawl web graph

Alex Ott

·

Oct 22

Databricks SQL: Flexible time windows for security analytics with time_bucket

Time windows are heavily used in security analytics. A brute-force rule counts failed logins in 5 minutes, a beaconing hunt checks whether…

Databricks SQL: Flexible time windows for security analytics with time_bucket

Alex Ott

·

Oct 18

Deploying Databricks Genie Agents to multiple environments with DABs

Genie Agents (formerly Genie spaces) are now supported in Declarative Automation Bundles (DABs) as a separate resource type (still under…

Deploying Databricks Genie Agents to multiple environments with DABs

Alex Ott

·

Oct 8

Inside the Databricks Terraform exporter: more implementation details

In the previous post, Introduction to the Databricks Terraform exporter, I described what the Databricks Terraform exporter does and how to…

Inside the Databricks Terraform exporter: more implementation details

Alex Ott

·

Oct 5

Inside the Databricks Terraform exporter: referential integrity

In the previous post, Introduction to the Databricks Terraform exporter, I described what the Databricks Terraform exporter does and how to…

Inside the Databricks Terraform exporter: referential integrity

Alex Ott

·

Oct 1

Introduction to the Databricks Terraform exporter

The initial version of this blog was written a few years ago, together with Serge Smertin, who was the initial author of this…

Introduction to the Databricks Terraform exporter

Alex Ott

·

Sep 28

Speeding up the Databricks Terraform exporter

The Databricks Terraform provider includes a Terraform exporter component. It generates Terraform configuration (.tf files) for the…

Speeding up the Databricks Terraform exporter

Alex Ott

·

Sep 21

Detecting attack sequences in Databricks SQL with MATCH_RECOGNIZE, Part 2

Part 1 covered the parts of the MATCH_RECOGNIZE clause and demonstrated how to apply it to simple detections: beaconing and impossible…

Alex Ott

·

Sep 21

Detecting attack sequences in Databricks SQL with MATCH_RECOGNIZE, Part 1

Many cybersecurity detections are about the order of events over time, not just about a count of specific events:

Detecting attack sequences in Databricks SQL with MATCH_RECOGNIZE, Part 1

Alex Ott

Alex Ott

Principal specialist architect at Databricks. Big data, Cybersecurity, Terraform/Automation, and related topics. https://alexott.net. Opinions here are my own.

Following

Help

Status

About

Careers

Press

Blog

Store

Privacy

Rules

Terms

Text to speech