Operations | Monitoring | ITSM | DevOps | Cloud

An engineer in an incident does not have a metrics problem, a logs problem and a traces problem. They have one question, and answering it today means opening three interfaces and retyping the same timestamp, service name and tenant into each one.

Watch the full episode: MCP vs CLI: Does it even make a difference? Live Laugh Logs ep. 3.

In this Black Hat talk, Nicole Beckwith introduces APEX (Adversarial Pattern Extraction and Correlation), a detection framework—not a Cribl product—that clusters TTP-based signals around entities to support behavioral detection. It is intended for security practitioners, SOC and detection teams, and threat hunters who want to learn how to use raw telemetry or OCSF data, TTP chaining, time windows, criticality, and cross-correlation to detect behavior beyond static indicators and rule-count coverage.