Phish Fights and Not So Long Nights with Security Onion and Sublime Platform
Channel: Security Onion
Date: 2023-10-12

Featuring Wes Lambert and Josh Kamdjou

In this presentation, we will explore the integration of Security Onion and Sublime Platform, an innovative open email security platform designed to prevent email attacks such as BEC, malware, and credential phishing. Sublime Platform's unique domain-specific language (DSL) enables detection-as-code, allowing for highly customizable email security detection.
Throughout the presentation, we will cover how we can effectively triage Sublime email alerts within Security Onion, streamlining incident response and reducing the time needed to identify and remediate threats. We will also cover how we can pivot to Sublime for in-depth investigation and analysis of suspicious emails, extracting valuable context and indicators to inform security decisions.

Last, we will discuss how we can enrich and correlate Sublime alerts with the various data sources in Security Onion, such as Zeek HTTP/DNS/TLS records, Suricata alerts, and full PCAP to answer questions with network metadata such as: Did the user click on the link? Has anyone ever visited this domain or link before? And more. By combining Security Onion's robust capabilities with Sublime Platform's innovative approach to email security, participants will better understand how to create a comprehensive defense against email-based attacks.

Speaker Bio(s)
Wes Lambert is a Principal Engineer at Security Onion Solutions, where he helps companies to implement enterprise security monitoring solutions and better understand their computer networks. He is a huge fan of open source software projects, and loves to solve problems and enhance organizational security using free and easily deployable tools. While not at the computer, Wes enjoys Indian food, playing soccer, and spending time with his family.
Josh Kamdjou has been doing offensive security-related things for the past 12 years. He's spent most of his professional career breaking into networks via spear-phishing and other methods, and building software for both the public (Department of Defense) and private sectors. Josh is the Founder and CEO of Sublime Security, and in his private life enjoys weight lifting, Martial Arts, soccer, and spending time with his niece and nephew.