Wylie Bayes
  • Home
  • Resume
  • About
  • PGP Key
  • Consulting Services
  • Contact

Building A Detection Lab With Security Onion

  • Wylie Bayes

Wylie Bayes

Oct 4, 2019
Building A Detection Lab With Security Onion

Google Docs Slides - https://docs.google.com/presentation/d/1ojFY5Jvc6M9dKXs1qSuh6UoWc2zqL6xREbojRL921bU/edit?usp=sharing

PDF Slides - https://wmfb.co/txt/SecOnion_DetectLab.pdf

Above are the slides that were presented at the Security Onion + Bsides Augusta conference on October 4th 2019.

Recorded talk on YouTube: https://youtu.be/JOvWCQ-PHHY

Detecting Anomalies with Elastic Machine Learning Jobs

Writing static KQL or EQL rules is highly effective for catching known threats (e.g., "Alert me if mimikatz.exe runs"). However, static rules struggle immensely against the "unknown unknowns" or attacks that mimic legitimate behavior. How do you write a static rule for data exfiltration?
Aug 28, 2026 3 min read

Leveraging Elastic Defend (Agent) for Deep Endpoint Visibility

When organizations first deploy the Elastic Stack for security, they primarily use it as a SIEM—a giant repository for network logs, firewall traffic, and Windows Event logs. However, Elastic is no longer just a passive observer. With the introduction of Elastic Defend (formerly known as Elastic Endpoint Security/Endgame)
Aug 28, 2026 3 min read

Building Custom SIEM Detection Rules in Elastic Security

Elastic Security comes with hundreds of pre-built detection rules out-of-the-box, created and maintained by Elastic’s security research team. While these rules provide a fantastic baseline, every corporate environment is unique. A behavioral pattern that is highly malicious in one company might be a standard daily
Aug 28, 2026 2 min read
Wylie Bayes © 2026
Powered by Ghost