SIEMposium Agenda

We'll start small and build a working parser together, turning a simple JSON login log into a valid UDM event—and meeting a few helpful errors along the way.

We'll level up our first parser with dates, numbers, arrays, nested objects and enums—then tackle KV and CSV logs without changing the final UDM event.

After lunch, we'll wrangle unruly timestamps, extract useful values from messy text, and discover how JavaScript 🤯 can make complicated parser logic surprisingly painless.

We'll extend an existing parser, explore how parsing connects data into the entity graph, and then bring everything together in the final competition.

Hypothesis building is fundamental to rule writing. Start with the evidence, explore it five different ways, and use filters and pivots to form a hypothesis before writing any detection logic.

Turn the morning's investigation into a working detection, then progressively add boolean logic, regex, data tables, thresholds and grouping.

Take the rule beyond individual events: correlate behavior across time, calculate meaningful outcomes and connect activity with contextual findings in the entity graph.

Teach the rule what "normal" looks like, then correlate detections themselves to turn multiple low-confidence observations into one meaningful alert.

Start with SOAR's smallest building blocks and watch them come alive: simulate an event, turn it into an alert and case, map its entities, and discover how those entities connect, group and power response.

Now make the case do something. Pass data into actions, inspect what comes back, chain the results into a playbook, and build a view that shows analysts exactly what they need.

After lunch, move from using SOAR to building it. Write a Python action, give it integration and action parameters, return structured results, and run the whole chain inside a playbook.

Connect your action to live SOAR data using built-in authentication, return the results as JSON, and turn that data into a polished analyst experience.