sroberts

for ($fqdn, $ipv4) in $rows {
	[ inet:dns:a = ( $fqdn, $ipv4 ) +#ioc +#adversary.nsogroup +#infrastructure ]
}

sroberts

Slides

Homemade Ramen & Threat Intel

A recipe for both

• Scott J Roberts
  • Instructor: SANS FOR578 Cyber Threat Intelligence
  • Author: Intelligence Driven Incident Response
• Metaphor Warning!!!

sroberts

Keybase proof

I hereby claim:

• I am sroberts on github.
• I am sroberts (https://keybase.io/sroberts) on keybase.
• I have a public key ASCkaqzoKIRjKiuUTpAnkRKZtNSZ2G-7D7VMh5w8QlVi2wo

To claim this, I am signing this object:

sroberts

Here is an overview of my past (and sometimes upcoming) speaking opportunities.

2017

• Mind The Sec: TBD
• SANS DFIR Summit: Japanese Manufacturing, Killer Robots, & Effective Incident Handling

2016

• SANS Leadership Summit: Crisis Communication for Incident Response
• ArchC0n: Chasing Shiny Objects: InfoSec budget decisions in a hype driven world
• SANS DFIR Summit: Responding @ Scale - osquery for Mass Incident Detection &amp Response (Slides)

sroberts

Keybase proof

I hereby claim:

• I am sroberts on github.
• I am sroberts (https://keybase.io/sroberts) on keybase.
• I have a public key ASBN2JRFuuB8vzXzq06VSCrmaXjHU9q0LR4K6aM6UUujkgo

To claim this, I am signing this object:

sroberts

# Set up your Transform object. This is the basis for returning results.
trx = MaltegoTransform()

sroberts

# This returns the transform as an XML representation that Maltego
# uses to update the graph.
trx.returnOutput()

sroberts

# Import MaltegoTransform-Python library
# from MaltegoTransform import MaltegoEntity
from MaltegoTransform import MaltegoTransform

sroberts

# Create a Maltego Transform Exception
trx.addException("We're out of gummy bears!!! Abort.")
 
# ThrowExceptions returns the errored transform.
trx.throwExceptions()

sroberts

# For a 1-1 transform, so we create one location entity based
# on the geolocation data.
trx.addEntity("maltego.Location", "New York, NY")

# This can also be placed in a loop and will result in multiple entities.
locations = ["New York", "Washington DC", "San Francisco"]
for location in locations:
  trx.addEntity("maltego.Location", location)