EP170 Redefining Security Operations: Practical Applications of GenAI in the SOC

Security.

Hi there, welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the Senior PM for Risk Analytics and Cloud Threat in Google SecOps, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of our Cloud Security Podcast listeners all on the Google Cloud Security Community page. You find the link to that in our show notes. Anton, this is a special episode because we accomplished not quite a childhood dream of mine, but my dream of live streaming a show within a show. We livestreamed this from Next, and listeners, if you're worried about the audio quality, it's just because we are on a show floor. But we had an awesome, awesome episode talking about AI, the future of SecOps. This was a banger, was it not?

This was a really fun one, and our guest's energy was also quite good. Well, I should say incredible, but it's actually really incredible energy all over us because it was in the middle of the Next floor. And ultimately, if you're willing to tolerate the quality of audio and video, definitely enjoy both.

Yes. And what insights can users look forward to? Because I think users— you guys aren't users, you're listeners. That's such a PM thing to say. But I think the interesting thing is where we get into the future and where we talk about— there's this thing that happens when the future gets created. We stop feeling like it's special anymore. And I think we get into a really interesting discussion of what won't feel special in the future.

That's a very good point. And of course, of course, it involves AI. I think that we managed to make it to minute 2 of the intro without saying AI. And I think we have to say AI. AI. AI.

AI.

We had a lot of AI in this episode, listeners. And so without further ado or further AI, let's turn things over to today's guest.

Thank you for joining us. We are live on the floor of Google Cloud Next 2024. We're here in Vegas this year, which is a big departure from previous years in, well, San Francisco, and for me personally, London back in 2019. Delighted this morning that we're joined by Payal Chakravarti, one of the directors in Chronicle, Google SecOps. We get to work together closely. It's a joy to have you on the podcast finally. First off, you know, what are you up to next? What are you doing here?

Thanks, Tim. It's been fun. Just the first morning, we've seen great announcements from the keynote.

A little bit of AI.

Sorry?

A little bit of AI.

A little bit of AI. Or one of those memes that says AI, AI, AI. So, I'm excited about all the security AI agents that we are launching now at Next. That includes the Security Operations Investigation Assistant. It helps SecOps teams accelerate their remediation by investigating, hunting, triaging, and using a natural language conversational chat and getting recommendations along the way. We've seen announcements on SCC, that gives human-readable explanations of multi-stage attack paths, and Threat Intel Assistant that helps, you know, tap into Mandiant's corpus of frontline threat intel to get insights faster. IAM Recommender that provides you straightforward recommendations to remove roles from over-permissioned accounts. So lots of great things happening with AI and security.

So it sounds like you read about 1/3 of the announcements, right? What about the rest?

Well, these were all things I was involved in, so—

Oh, no.

Some, yes. And I've been, you know, part of the security organization, yeah.

So let me ask you, you mentioned hunting and AI. So people often ask us about the use cases for GenAI and security. And sometimes we say that it's emerging, it's not fully clear yet. But of course, your team is doing some of the fun use cases with GenAI for security. Can you give us through a bit of a structured view about the different use cases of GenAI for security operations and which ones are kind of better? Like, do we know which ones are best?

Yeah, it will take time to kind of determine the best, right? But I can tell you how— what we are seeing, what's evolving in the space. So when it comes to security operations, there is immense toil in day-to-day things on which— in what security analysts do. And GenAI brings the capability. There are some low-hanging fruit that GenAI brings to the table, like artifact generation, summarization, Q&A, that really can expedite response, triage, and investigation. As an example, anything that requires learning a new coding language or new syntax, right? So you, I mean, security analysts of the future do not need to, in fact, it's happening already, happening now do not need to really learn a new language. They can write rules, they can write queries, they can create playbooks, all with natural language. Summarizations, right? Gone are the days when you have to summarize and write incident summaries, or even summarizing results from a search, you know, like how Google Search presents data, or summarizing what happened in an incident, in a case which has like 30 alerts. Those things are low-hanging fruit that we are solving for. And then there's of course investigations where you can— connecting the dots between different parts of a product, different products, different datasets, different parts in a UI is very cumbersome, right? Today, an analyst, when they're investigating, they have to look at many, many different artifacts. And what if we could just remove that barrier and give you a conversational interface that helps connect the dots and answer the questions and takes you on a guided journey and how to remediate a problem. I think those are real great applications of GenAI. And then there are, you will, you know, in the future you'll see a lot more about more personalized recommendations, more proactive guidance, more prioritization, data correlation, those kind of things as well.

So there's one that sort of, I would say, gently triggers me in the use cases you mentioned.

Gently?

Gently in this case, yes. And the use case is about natural language for query building or rule writing. So I think the motivation for doing this is, of course, to reduce the requirements from the junior analysts, junior engineers. But would there be some trust issues like the fact that does the GenAI-based model, GenAI-based tool, would write the right queries? They would miss anything? So how does the trust work in this case? How are we evolving to trust in the machine-written queries and rules?

So, you know, trust, and we are in this phase where we are gaining trust every day from our users with our natural language query capabilities. So trust comes from one, getting value, and two is getting accurate results, right? And we know we are like, some of our accuracy rates are really high, 93%, but what are we doing? There's a lot of work going on in the background to make those queries accurate. So one is reducing hallucinations. Fine-tuning the model. How are we fine-tuning the model? We are actually constantly learning from the searches that are going on in the platform. We are bringing those and putting it back in the model in terms of in-context learning, right? So when— what in-context learning means is that you are introducing in the prompt itself, you introduce the prompt as well as the correct query. So that helps fine-tune and steer the model towards the accurate So there's a lot going on in the background to improve accuracy, and hence we see a lot of repeat users coming back and we see customers saying, oh, it's great on the new platform. We don't need to train our user, like train our users who are onboarding. They're getting started easily. They have a starting point to learn how to use the platform. So that's how we are evolving it.

So I wanted to pick at that one because I think that's a really interesting space. How are we seeing the intersection here? For like the future of junior team members? Because what I worry about is, you know, what if AI takes the jobs of junior people and then, well, where do you get the senior people?

Right, unless they grow out of junior people who are now robots. Like, that's the— it's a little naive, but we do hear this scenario quite a bit when we discuss SOC with clients.

So we think of it as actually scaling talent, right? If a junior analyst in the first few months of their job can actually triage and respond to pretty straightforward cases without needing help. And then AI is doing most of the work, guiding them, assisting them, and then they have the time. Instead of spending 8 hours on a case, they spend 1 hour on the simple cases, and then they're spending 7 hours learning about the complex cases which cannot be point-blank sort of solved by AI, right? That's how we are thinking about it, which is, again, as I mentioned, take away the menial tasks, the repetitive tasks away from them, automatically triage the things that are low-hanging, that are well understood, and then help them scale themselves to the next level.

So I think one of those Anton comments is coming.

Oh, I can't wait.

So this is actually a shockingly good answer. And the reason I think that is because instead of thinking, Oh my God, robots coming to my job. You hear, well, I actually have time to learn how to run machinery rather than shovel manually all the time. So if I shovel manually, I have less time to learn advanced things.

And this gets back to our steam shovels up front.

Yes, exactly. And I think to me this is actually accurate. It's also very motivating as opposed to like, oh my God, robots are coming. Like, it's more about, well, yes, and now you wouldn't have to shovel holes manually. Now you have to learn how to deeper, more interesting things rather than just repetitively do simple manual things that may not produce learnings. I like that. That pays for the episode already.

And trust me, all of us will be doing that in a few years.

So what about— not that I want to switch back to negatives, this was very positive. There are still kind of challenges and risks associated with using GenAI in SecOps, and sometimes when people ask me about both using AI for security and securing AI, I kind of imply that if you use AI for security, you have to then secure that AI because you don't want this syndrome of you are compromised through a security tool, whether AI-based or not. So give us a little bit of challenges and risks of GenAI and SecOps.

There are actually quite a few risks. So I mean, let's think about it. One is GenAI is successful, only when you feed in tons of datasets. You have to ensure there's no data leak in those datasets that you're training with. That's a huge problem. It could be copyright infringement, it could be a codebase leak, it could be credentials. So you have to be extremely careful about the data that goes into training the model. The second thing that we worry about is hallucinations. Misinformation means that when a model actually is generating false or incorrect or misleading information and presenting it confidently as a fact, right? And what happens if—

We're worried about that because we don't want the model to take the job of product managers.

No. That's a low blow.

I'll talk to you about that later. But think of it like, what if you're misleading the threat analysis, or if you're misleading, or is there bias in the system to say this threat is actually not a threat, but it is actually a threat? So those are real risks. So if you become over-reliant on models and you don't have enough sort of hybrid detection systems that combines both rule-based, signature-based, human reinforcement, you have to have all those things in place to ensure that you're not— Those are the primary risks, right? The overreliance on models and data.

So it's kind of excessive trust, or maybe trust where it shouldn't be trusted kind of thing? Like, I think there's a subtle thread to pull, but I'm not quite grasping it. Like, if you trust the model to always be right, then you would trip over hallucinations, right? But are there safeguards against it? Like, are there—

Yeah, how do we do the verify part of this?

Because otherwise, if If you naively assume that verify means your humans need to be as skilled as before AI, then some of the value goes away, right?

No, I think even those systems can be automated, right? Like I was mentioning feedback loops, how can you have really good feedback loops, not just human-driven, but machine-driven feedback loops, right? Hybrid detection systems, or you have like a simple way to put it is instead of saying, okay, I'm going to tune your rule and I'm going to deploy a new playbook. Maybe you say, I've tuned your rule, here's a suggestion. I've introduced a new step in your playbook, or there's a new playbook, we need you to approve it before you deploy it. There's some— I think there has to be— it's sort of like the machine assisting the human in doing their jobs rather than completely taking over and doing the job.

Because this comes up about— was there a story somewhere in a different domain where a human is presented results from an AI-based machine and he approves the first 1,000 with thinking and then the next 1,000 he just clicks okay. But that breaks that flow, right? Because ultimately, if you grow trust in a machine that actually isn't absolutely reliable, then how do you— I don't know the answer, so I'm not trying to trick you.

I'm genuinely curious.

I probably don't know the answer either. Okay. We found something hard we haven't figured out yet.

The challenges we have to solve for and the things at least we know that we are keeping an eye on and the datasets that we feed in, the hallucinations, bias, those are very, very critical right now and we are taking care of them now. But yeah.

Got it. So, one of the things we've seen before in the life of SOX is UEBA and SOAR. They both wanted to bring machine decision-making, machine thinking to the stock. And I think we maybe look back on the eras of UEBA and SOAR and feel a little bit of disappointment about unrealized expectations. I struggle to look at AI and not see it as the 3rd version of that, but with more matrix multiplication. What are we learning this time around that we screwed up last time around?

Yeah, I—

That is the hardest question, by the way. So everything else will be easier.

sort of an— I would say for SOAR, let me talk about SOAR, right?

Yeah.

SOAR was good at automating repetitive tasks, right? Which is great. But where it becomes hard to maintain and manage SOAR is that if there are any changes, then you have to go back and update the playbooks, update your automation. So keeping up with changes is hard, right? And then you have the manual labor in creating, dragging and dropping, configuring 100 boxes, is testing it, right? So if I break it into those 2 parts, the first part we're trying to solve is, okay, how do we make the creation of those playbooks easy so that you don't have to do all the menial labor? Like, you can type in a prompt, say, okay, go enrich these events, bring me this data, if this then do that. Like, if you just say it in natural language and it's able to create that for you, it reduces the toil. That's one part. The second part is the contextual learning. So AI models they are continuously learning. So if they can keep track of changes in context, let's say an asset was not critical before, but they now became critical and that needs an update, can they go and automatically use that knowledge to update a playbook and then again ask for approval? Hey, do you approve this change?

Yeah, yeah.

Then you're reducing— then you're bringing down this automation problem also to be more of a learning-based continuous improvement rather than— I mean, that's one way to think how we can make that better.

I buy this answer, not to give a very Anton response.

That makes sense. I think that to me, kind of a hopeful as opposed to like excessively optimistic answer. I think it's— yeah.

That's a very realistic answer. I like that.

That's good.

We have to think realistically to build.

Yeah, you can be—

you can't hallucinate.

I guess there's a degree of positivity which doesn't go into crazy, but yes. But let me ask you a strange sub-question to that question.

Yes, you ask the strange one. Thank you.

Please.

This whole Saur and Yuba question to us came from me kind of reminiscing that Yuba was supposed to be the brain and Saur was supposed to be kind of hands and arms, like automated action versus automated thinking. With the AI, we are kind of doubling down on the thinking part, right? So, or are we doing both potentially? Because AI helps store, GenAI helps store quite a bit, right?

So.

Yeah, I think we're doing both. We're automating the actions. I mean, earlier it was primarily automating the actions, right? Now we are extending that to automating the thinking, which is what playbooks do I need? When do I need it? What changes do I need to make? Can you recommend automation steps based on how I've solved problems in the past. So you are also introducing that automation of thinking. So, so it's a combination of both.

Both.

Both. Are we going to let her answer the question with both? That feels like—

No, I, I think that it's a fair answer because it is not— GenAI in security tools is not a Uber 2.0. It's— so I think she is right in that sense that it's not just—

it's a layer under both And I love how concretely you've tied it to both too. That's really good.

And Yuba, I think there is one more advantage that AI models can probably provide is AI is good at understanding patterns really at scale. Like, of course, it depends on how well the data is fed in, but if you can establish the normal patterns better than what traditional ML models could have done. And you can then also detect subtle deviations because traditional systems may miss those subtle deviations. So if AI can do better in those 2 aspects, like normally establishing the baseline from no patterns and then detecting the subtle deviations, you might have better behavioral detection quality.

So that's how possibly we could enhance I think there's also another subtle advantage also for the camp Yuba. Back when Yuba was born, I was at Gartner and a lot of people were coming to us with naive questions about, so this can detect unknown threats because it's based on ML, not rules. So they made this jump, absolutely erroneous jump.

Yes, I know.

It doesn't require a precise rule to— it would detect unknown threats, which we had to explain sometimes a few times a day. that no, it doesn't work like this, then ML-based Yuba is not an answer to unknowns and absolutely not an answer to unknown unknowns. But funny enough, with GenAI as kind of like a bit of a lateral thinking approach to some of the data, I would probably be more trusting to uncovering some of the unknown-ish threats. Am I being naive and too positive or not?

I mean, unsupervised learning and GenAI, they actually learn without explicitly labeled examples of anomalies. That's how it learns. Well, how well it applies to UBA, Tim, why don't you figure that out?

Yeah, I'll get right on that. I'll just go leave the show and go work on my PRD. Listeners, the funny joke that's happening is I'm actually the PM on Chronicle responsible for our UEBA feature. So this is great. I want to shift gears now and ask you to predict the future, which Of course, it's always a fun question. Imagine a SOC or a DNR shop in like 2029.

How did you pick the date? Do you remember?

It's 5 years from now.

Oh, sorry.

That's the easiest question I've gotten all day. What AI-based magic is going to be seen as totally routine at that point? Because technology has this funny thing where until it's real, it's magic, and then it's totally blasé. So what will be boring 5 years from now, in your opinion?

Yeah. So as I said, all the low-hanging fruit like code generation, anything that's like syntax generation, summarization, the menial repetitive tasks, I really do think that in 5 years those will be GenAI-driven and humans will— let's put it this way, humans will be spending less time on those, right? The other areas, there's a lot of great areas in which we can make progress. What about AI assisting detection engineers?

Yeah.

What if you could learn about your gaps, coverage gaps, and you could understand the context in your environment and automatically create rules and tune rules, right? Today it's all a manual process. The entire rule detection engineering is a complete manual process.

Yes.

How can we assist that better, right? So understanding gaps, understanding where rules can be written, maybe making suggestions on what rules can be written, suggestions on how to customize it to your environment, this one area.

I really like that.

I really like that. And it may come sooner than 2029, actually.

Yes.

Yeah. I would say 2029 is where it's probably running somewhere. The other one I think of is in terms of hunting, right? Like, you could be— today, hunting is, It's also more or less a manual act. Like you're—

By design, by charter, it's manual.

It is. And I'm not saying it will never be a manual task, but what if you could spend more of your time on the real complex hunts and some of the simpler hunts of emerging threats, which we're already doing some of this in Chronicle today. Emerging threats are being brought into Chronicle, matched against your telemetry, and told— and you're told that, you know, you have an active breach or not, but take that experience further where emerging— like, you're constantly learning and reading from emerging threat reports, and you're bringing those threat reports, those insights, and creating those, you know, either detection rules or creating those hunts and assisting the hunter, right? You're saying, hey, you know, you need to look at this, and let me tell you what are the search queries you need to run because XYZ is running a spear phishing campaign and it's relevant to your industry. So you're expediting. So those are areas where I think we can really make significant progress and let the, you know, human analysts actually do the higher-order tasks.

So before the final question, I wanted to ask a subtle sub-question to this question.

You have? Okay.

Yeah, I didn't know about these sub-questions.

Well, in this case, it's actually written on the sheet. So in this case, I mean, what would humans do? It's almost like we are— all 3 of us, I think, are pretty sure that in detection and response once operation of 2029, humans will play a role.

Yeah.

Yeah.

And this is interesting because we have a complete consensus and we even think of it as a safe bet. We are not like robots will take all the jobs in 2 years kind of crazy. But what would humans do in that model that you kind of had in your mind?

I think humans are getting more productive at doing their day-to-day jobs, right? Like if, let's say, in the life of our PM life, if there was a PRD assistant who wrote a first version of the PRD, that reduces time for us to spend on that, right?

Totally.

So just think of it— I would think of it in that way, which is, you can take the different personas like a SOC analyst, threat hunting, you know, CTI analyst, or a detection engineer. If you take those 3 primary personas, a SOC analyst would be definitely not sitting and triaging every single case. They would have an inbox that says, here, 80% of the cases have been auto-triaged. You need to approve the actions, or here are 3 cases that we really need you to look at because we couldn't find past incidents similar to this, right?

That's interesting.

Right? So that's— think of it that way. Similarly, if you go to a detection engineer and you're telling them, look, we found these 3 gaps and these are similar rules that we found in the community or from other places, and we are suggesting you use these rules. But there's an emerging threat and we are not sure exactly— we just know about this, but we don't know exactly how you're going to create a detection for this, or MITRE introduced something new, or, you know, we don't know how to create a threat. Go spend your time researching that. So if we can think of it that way, I think—

And I think research would also be AI-assisted. But human-led. It's very clear from that model that you would be—

There are some things that will be more semi-autonomous or autonomous, like triaging incidents that are very similar to past could be more semi-autonomous. But some of these things are the ones I just talked about are more assistance to the—

I think that was a really good answer to our—

I believe her.

That's awesome.

Yeah.

We're both finding you very credible. We don't think you're hallucinating.

Because you work for the same team.

Our reporting structure is complicated. But I think it's the time where I have to ask our traditional closing questions. One, do you have recommended reading? And 2, do you have advice to help people get the most out of their AI in SecOps?

Recommended reading for AI specifically?

It can be a launch blog. I mean, it's not, we're not going to hold it against you. Tim only holds my blog against me, but not their blog.

Yeah, the SRE book is awesome. But we've had everything. We've had people recommend Dune, The Art of War, Mary Oliver. What do you want people to read? You can tell 'em anything.

It's a good question because in my mind right now I'm reading a fiction. So it's called The Covenant of Water by Ibrahim Varghese. It's a pretty interesting novel set over many decades in India, in a part of India. So it's a, I highly recommend the book. it has very nuanced socioeconomic historical references, and I love reading books that put you in this historical fiction situation. And what was the other question?

A tip to help people get the most out of their use of GenAI in SecOps.

GenAI in SecOps. I think I talked about this a lot, but maybe just start by using the summarizations. If you're new to this. I would say start by looking at your things that you're spending time reading through documents or reading through a lot of unstructured data that should be automated. If you're spending a lot of time building things that are sort of structured code, that those things should— the toil should go away.

Okay, perfect.

That's a great answer.

Start with the toil, start with the stuff that you can build trust with.

Trust but verify. Anton once taught me how to say it in Russian, but I won't butcher it today. So, Payal, I can't thank you enough for joining us. I think I tremendously enjoyed this. I hope you did too. And great.

Thank you. Thanks, Anthony and Tim, for having me.

See you.

And now we are at time. Thank you very much for listening, and of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast.

Please subscribe so that you don't miss episodes.

You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter, @Anton_Chuvakin and @_TimPico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Bye.

Security. Security.