About

About Chester Le Bron


I am a Cyber Security Professional based out of Milwaukee, Wisconsin, specializing in Threat Detection & Response with a focus now on Cloud Threat Detection & Response.

I still consider myself very new to Information Security/Cloud Security with everything I know coming from standing on the shoulders of giants.

If I am not in my home lab, I am likely playing/watching a sport or just vibin'. Oh, and yes, my last name is Le Bron (with a space). It's Puerto Rican and I have no relation to LeBron James...I know you were thinking it 😂.



Popular posts

My Methodology to AWS Detection Engineering (Part 1: Object Selection)

Image
Introduction  Welcome to the first installment of my new blog series discussing my methodology for threat detection engineering in AWS. This blog assumes you are familiar with Splunk Enterprise Security, its terminology, and/or similar SIEM functionality related to "Risk-Based Alerting" concepts. If not, you can read some reference docs  here  and  here  or if you prefer videos you can go here  and  here .   Also, if you need a refresher on AWS CloudTrail userIdentity fields, see the official documentation here .  To be clear, this is just what I have been doing, and it doesn't mean that it is prescriptive. While this approach may use Splunk at its core, the concepts apply to any SIEM that allows you to perform risk scoring or has the components to do so, such as creating indices, performing lookups, and using eval commands. That said,  this concept is better stated t
Read more

My Methodology to AWS Detection Engineering (Part 2: Risk Assignment)

Image
Introduction  Welcome back to the second installment of the blog series discussing my methodology for threat detection engineering in AWS. I am humbled by the response to Part One, so thank you to everyone who reached out. I'm very happy that some of you found it helpful. In case you missed it, we covered RBA object selection for AWS and how an example of how that could be of use. I recommend reading  Part One  before continuing here. But since you're back, I assume you are here for Part Two, so let's get into it. We will look at an example application of risk score assignment with the concepts discussed in Part One and the lessons I've learned using the available RBA features in Splunk ES. This will be a shorter post as I want to focus on the key components that make up the risk assignment rule. Let's start by jumping right into the logic needed in this methodology. Core Components:  Initial Filter 1 in
Read more