0:03My name is Tyler Greenfield. I am with SentinelOne and I'm going to be talking about from the endpoint to the end, simplifying security in the AI era. So we're going to talk a little bit about how we can make security easier, especially with the integration that Cloudflare and SentinelOne have been building over the last couple of years. So again, I'm Tyler Greenfield. I am the manager of our partner solutions engineering team in the American that means that we work with a lot of the people who resell technology to people to help them understand what they need in their IT stacks. And specifically, I focus on that security resale motion. I've been in security for about 15 years. I've been at Sentinel one for, it'll be five years in May. So cybersecurity, a lot of things are changing, obviously, because of AI, right? And the way things are changing are similar, but different.

0:49In cybersecurity, we're seeing trend that's continued for probably the past 20 some odd years, right? The attacks that last year were targeted at larger organizations and nation states are being targeted at smaller organizations, right? And AI is helping to accelerate that. It's making social engineering easier. It's making privilege escalation easier. I mean, we've all read about what's been happening with some of the frontier models and how they've been hacking things. There's a strong argument to be made that that is due to a lack of responsibility in the testing. being done. But regardless, these capabilities are making it much easier for attackers to carry out sophisticated attacks against a larger array of targets. That doesn't necessarily mean that security as a problem space has gotten easier, right?

1:36And it's something I talk about very commonly. Security is a complex discipline. It's not an entry -level discipline in IT or technology, right? You have to understand the surface you're managing before you understand how to secure it because you have to understand how it might be exploited. So, especially when you're at a smaller organization or an organization that is not inherently focused on technology. I don't know how many of you work for non -pure tech companies where you might be the tech people maintaining your infrastructure and all of that, but it is not the focus of your organization. So, getting the resources, even in very technically focused organizations, to deal with this complex sector that's not necessarily making money for the business can be difficult, but we all have to. manage this right we can't ignore it so um we are seeing that again um these attacks are ramping up everybody is having to pay more and more attention to it and send the one has been built from the beginning to make this problem easier for people when we were founded 14 years ago our vision was the autonomous sock we're not fully there yet but i'm sure you guys have been hearing a lot of that kind of talk recently we are getting to a place where we have a lot of the technology in place to make it possible and to make it possible at scale to bring enterprise great security to the masses, right?

2:52The people in the process to put that in place is really the difficult part that we're seeing these days. Cloudflare is very similarly, right? Making management of complex infrastructure, cloud infrastructure, SaaS infrastructure, zero trust, a lot more accessible to everyday companies and IT teams. So how have we been kind of pursuing this together? So again, a couple of years ago, always had a kind of an integration with Sentinel-1 and Cloudflare. Going back, it was very simple zero -trust integration. Powerful, important, but they had the WolfCoin on an endpoint. We had our endpoint protection agent on an endpoint. They would check with us to see whether something was clear before it could connect into the broader environment, right? We were the gatekeeper. We were the source of that signal because we are one of the best DDR companies in the world, so we could see whether or not advice was infected.

3:40There's a lot more that we could do. do because we've built more and set in one over the past few years we have a full data lake um and security um sim if you know the term but security incident and event management system as well as an automation harness that allows you to go out and do things right um we are also an ai security company going back 15 years i know that term has meant a lot of different things over the last 15 years um for us at the beginning it was let's put behavioral learning deep learning behavioral analysis on the endpoint where compromise happens to see things where there going to happen and automatically take action. As AI and automation has advanced over the last decade and a half, we've stayed at the forefront of that. We've stayed at the forefront of researching it, developing, integrating it into the security solution space. So a few years ago, I was actually in Chicago with a few of the Cloudflare essays, and we were at a happy hour sponsoring for a partner of ours.

4:33And we started talking about what we could do with some of the new stuff that we've been building and they've been building. the last few years, we have massively improved how we talk together because, again, Cloudflare owns that edge, right? They know what's going on in the transport layer. They know what's coming into the network. They know what's crossing the boundaries. Sentinel One knows what's happening on the devices that do compute. That's where we live. That's where we start, right? Anywhere that compute happens, we consider an endpoint. It doesn't have to be a laptop. It could be Kubernetes pod. It could be a sensor and a SCADA system, right? But by- having that unified visibility, right? And being able to share that data back and forth in near real time, we can start unifying our visibility of that complex problem space. And that's really a lot of what security has always been about.

5:18How can I get visibility into this complex infrastructure and it gets more complex every single year? And then how can I take from that complex, large picture, the things that actually matter and put them in front of the people who need to take action or automate those actions? So we have, since then, we started out, like I said, up here. We have since expanded to a large number of other use cases. I'm going to be talking through specifically these two today, and I'll show a little demo on that. And one of the main things that we started doing was we said, hey, you guys have a lot of data from a lot of different products that do a lot of different things. We love data, and we love correlating it and using our specific expertise on security to be able to analyze what's going on.

6:04on and take control of the environment. So we worked to get log push from all of the various products. I think there's 20 some odd today that we have that natively go into Sentinel-1. You go into your Cloudflare console, you point it at Sentinel-1, we will ingest it, parse it, detect on it in real time. We also built out a wide array of detections based on the kind of things that, you know, we see in environments and we see attacking environments. And then further, we have built a bunch of automation workflows. Our automation platform, and I'll show you a little bit about that at the end here, but it's incredibly powerful. It's a no-code, low-code version, which for those of us who write code, you start getting a little, you know, your hackles raised, but you can write the JSON objects and just upload them if you want to do it that way. But what that does is it makes for an incredibly flexible and powerful framework.

6:50If you've ever worked with something like Torque or Tynes, they're great products, but you have to have a lot of investment and technical resources to manage them and to manage those workflows, right? And because we're an AI security company, we've had LLMs embedded in the product since they started coming to market commercially available. We were one of the first to bring an LLM SecOps assistant to the generally available public. And we've continued to iterate on that. And that also increases the flexibility we have in how we can build automations.

7:19So, again, when we're seeing, when we're looking at that kind of first phase of do I know that a device is clear before it comes into my environment, right, whatever that device is. That's a critical portion of your workflow, right? Once something is inside past your controls, no matter, and the more you can put, you know, micro-segmentation and additional layers of checks, the better off you are, but that becomes complex. Once you're past a control point, it becomes not trivial, but easier to flow these days. And in fact, it's almost becoming trivial. We're starting to see privilege escalation go from minutes, hours, days, weeks to milliseconds because we're using it. workflows to just hammering things and get through it. This is one of the most powerful and simple ways of doing an integration security, right? Sentinel-1 protects the endpoint, protects where people are logging in, where compute is happening.

8:08It communicates with the SASE layer so that Cloudflare knows when to allow devices into the environment to access broader corporate resources. But beyond that, and this is a little bit more of a complex architecture side, we're trying to make it somewhat simple, but We have all of this information that's coming from Cloudflare, right? So Cloudflare is sitting there protecting a web application. I'm going to pull one of those up in a second here, and we're going to attack it live.

8:37That information is going in real time in Sentinel-1. We have a highly performant, highly scalable data lake that is incredibly quick to parse data and start doing detection. So it'll detect almost as the logs are coming in. Like everything, there's going to be a few seconds or milliseconds delays, but we'll see that it really... quickly then moves on to that second phase where we can start running automated workflows and one of the things i've been talking a lot about the last year again is we're trying to make security a little bit more autonomous because that makes it easier to manage this complex space i think in my sector of the world we've been talking for about 25 years about alert fatigue and not enough resources and i finally started like acknowledging in the last three years like it's not going to change guys like nobody's coming over the hill to save us right we need to make our tools work for us um Hyper automation is part of how we're addressing that problem, because once we can look at workflows and we can understand how they're going to happen repeatedly, a lot of what our analysts, a lot of what our people that are overwhelmed are doing is they're doing complex tasks, but tasks that are the same over and over and over again.

9:39Right. So if we can automate that and we can go hands off and we have a workflow we can trust, we can reduce some of that burden. We see a lot of people now moving into SentinelOne has kind of chart. at is phases zero one two three and four for autonomy phase five is the holy grail fully autonomous right you know basically our version of that would be you log into the security console and it's like a happy face or a sad face right um that's not here yet but we are seeing people in phase three which means particle autonomy we're seeing somewhere between 40 and 50 percent of the workflows that they're using in a given sector are either partially or fully automated and we're even helping some people move into phase four high autonomy where they're getting into around 70% of their workflows are automated. And that automation can still include human-in-the-loop decision-making. I'm a very big advocate of this.

10:26We're doing a lot of this because it's a complex and growing problem space, and the experts that we have to manage this are not growing at the same rate the problem is, right? So we still need those experts. We still need that strategic decision-making, but we're turning into a place where we have those people working as orchestrators and managers of work. flows, as opposed to just somebody who's getting an alert, chasing it down, and then going on to the next one and doing that again and again and again, until they go home and cry into their pillow because they've got an on-call page.

10:59So getting into the demo and the interesting portion, what we built out over the last year, and I'll show you what this kind of looks like, this is our OneFlare Lab. This is not the official marketing name for the Alliance, but we thought it was fun and we made a cool little joint. logo up here so please don't tell our marketing um but we have this architecture we have all these attack scripts that are going to run and what we have over here is our cloudflare infrastructure we have a fake e -commerce website that we built um if any of you are fans of like really nice sneakers you know that they do like drops of special editions and there'll be bot swarms just like with concert tickets snatching all that up selling it on the secondary market um so we're going to fire one of those at our fake shoot drop website. And then what's going to happen is all of the logs from everything here, as this multi -phase attack rolls out, is going to get pushed over to Sentinel -1 in real time.

11:47While that's happening, we're going to do detections on those logs across multiple different sources, correlate that data, see what's going on. We're then going to fire off our hyperautomation, which the hyperautomation in this case is going to be detecting attacks that are bypassing the WAF because the WAF rules are not updated. for this particular scenario.

12:12It is then going to send a Slack message to our SOC to say, hey, here's what we found. Here's what we're suggesting. Do you want me to go ahead and block this at Cloudflare or is this a false positive, right? Is this maybe a penetration test that's being run and we don't actually need to do anything? And then you're gonna see the hyper automation will kick out and it updates Cloudflare. So again, we've got our little fake sneaker website. here, which if you want any of these highly sought after shoes, you're going to have to contact the engineer on my team who built this website and he will get into his 3D printer and make you a very uncomfortable pair. So we're going to go in here and we're going to go to our scenarios

13:00and you can see we've got a whole bunch of different attacks, but we're going to do our little campaign here. We're going to go ahead and run. this. So this is going to start out and it's going to go through a progression of things that you'd see from someone attacking an e -commerce website. Denial of service, privilege escalation, cross -site scripting, session stealing, all those kinds of fun things that we all love to have happen against our production websites. And as it runs through this scenario, which will start in a second here to use up the script, we're going to see that data start streaming into Cloudflare. And I did run earlier so you can see there'll be starting to be spikes on requests visitors right um we'll start getting details and again all the information that we're taking action on and sent on it's in cloudflare right you could go through individual screens here you could start sorting through this but the reality is cloudflare has a lot of great security built into its product cloudflare is not a pure security company right that's not what they're doing it's an infrastructure company there's a lot of things we don't do you can't build an application and manage it in sent a lot right you protect it um but once this comes through and let's see where we're at with our attack here so yeah we've already got some of these coming through and if i go here

14:15that's from this morning should be coming through in a second here but we'll start seeing in a minute um some of these same alerts that i have from the morning run here come through um and again what's going on here is if i click block it's going to go ahead and i can actually do this now because I didn't click on these earlier, but it will go ahead and block it Cloudflare. And then we will get a response here that will tell us whether it was successful or whether this rule already existed in Cloudflare and thus there was no change made to the environment. But all of this is being done in the hyper automation layer and the integration between Sentinel-1 and Cloudflare. And the reason that this is so important is, again, some of these things could be done purely in one, purely in the other, but the integration of the two is what allows us to right? These workflows, they take a little bit to build out. We built them for you, right?

15:03We've built them with Cloudflare to understand what is needed for most environments. Now, if you want to go and build your own, it's very easy to build custom workflows. So this is our hyper -automation template. And again, as I said, no code, load code. So we can go in here, drag in our different blocks, conditions, do our different decision trees, right? Very flexible. You can build these out from scratch, you can make them as complex as you want, as simple as you want. We did an exercise earlier this year with a group of engineers that I work with, where we had a contest to solve a problem with hyper automation. And there were two prizes. One was for the quickest. The other one was for the most Rube Goldberg solution they could come up with, with making a complex, unnecessarily complex workflow, which is obviously not what you want to do in production, but to show kind of the flexibility and the power.

15:53And you'll... see that we have things like our alien vault integration here um we have uh i think this is abuse .ch yes it's a little small there and then we have virus total um there are known integrations that we have as part of our hyper automation platform what's really flexible about it though is if i go and look in this library you'll notice all these like aaa123 this is us just building random integrations with random applications that we built in aws because this hyper automation platform can touch anything that it can reach on the internet and later this year we will build building on-prem connectors to do this same kind of workflow with on-prem software but as long as i understand what the connection is where the endpoint is what the authentication method is and i know what the api is behind it i can build a integration for an in -house custom application that you guys are using and then i can build a hyper automation workflow to pull information from it to do things on it right it depends on what the api that sits behind it is to do.

16:50But the flexibility of this and how you can build these workflows out to automate that whole environment is an incredibly powerful portion of that alliance that we've had with Cloudflare. And again, this is a result of us kind of sitting down and saying, hey, we have a great integration with this zero trust, you know, the client-to-client stuff, but what else could we do? And the reality is a lot of the workflows that we're building and that we see and that we have out of the box, they're things that we came up with. Sentinel-1 because we are security people, and that's how we look at the world and the lens we have. Cloudflare has come up with some ideas looking at the problem from their view, you know, managing the SASE infrastructure, everything on the internet. What we really have here, though, is we have a data lake, we have an ingestion pipeline, and we have an automation lines, all of which can be interacted with through an LLM assistant, so you don't actually have to know all of the query language.

17:42That means there's a lot of things that you guys can build off of this that we will never think of, right? We actually had a customer come to us and say they have retail gas stations. They wanted to avoid people using fraudulent credit cards to pay for gas and then ride off into the sunset and not actually get any money from that. So they built a loop where we're processing credit card transactions. Again, not something you usually do in a credit security tool. We are comparing that against a list of fraudulent credit cards, something security adjacent, but really more of a finance and risk and compliance And then based on that match, we're reaching out to their video management system, not something that has anything to do with either of those. It's usually physical security. And we're grabbing the video of that pump at the time that that's happened. All of that has to happen in less than a minute for us to be able to grab the evidence of that person.

18:27And we're using that across the nation with them now. And again, this is not something that we thought up. It's something they came to us and they said, Hey, is this possible? Um, it was, so we have a lot more of these kinds of things that we'd love to figure out how to build with you guys. But again, the ideas for some of those are going to come from you for the security though uh sentinel one and cloudflare are working hard to make sure that we have out of the box workflows that you guys can just put and plug and play so that all you have to do is you point your cloudflare at sentinel one you go into sentinel one you turn on the relevant detections and workflows and then it just works so with that i will pause and if there's any questions and it looks like we started getting our first of the new alerts in here yep six new messages in my slack We appreciate you guys showing up and thank you for coming to my talk.