ABSTRACT
In the cyber domain seconds make a difference. SIEM tools continue to be an important component in cyber defense but focus on collection and then providing retroactive query or batch analysis. Relying upon this alone can often lead to lengthy gaps between incidents, discovery, and remediation. An additional challenge is that data volumes in this domain are often huge and varied making the collection and storage very difficult or cost prohibitive. This often forces tough decisions on what data can actually be kept. To be effective cyber missions must move to leveraging techniques directly against the real-time streams of data. This hands-on workshop will guide participants through how to apply data streaming to defensive cyber operations. Simulated and real network and system data will be generated and made available in Apache Kafka and participants will use open technologies ksqlDB and Confluent SIGMA to analyze, transform and work with it in real-time.

BIOGRAPHY
As Field CTO Americas for Confluent, Mr. LaForest works with customers across a broad spectrum of industries and government enabling them to realise the benefits of a data in motion and event driven architecture. Mr LaForest also serves as an independent consultant to industry and government on data architectures. Most recently, he served as the industry advisor for US DIA's MARS program but has worked throughout the DoD. He is passionate about innovation in data technology and has spent 26 years helping customers wrangle data at massive scale. His technical career spans diverse areas from software engineering, NoSQL, data science, cloud computing, machine learning, and building statistical visualisation software but began with code slinging at DARPA as a teenager. Mr. LaForest holds degrees in mathematics and physics from the University of Virginia.