Vibe Investigating with Lakewatch and Genie

Summary

Genie enables 'vibe investigating'—security analysts ask natural-language questions to pivot across network, endpoint, and DNS telemetry rather than writing complex query-language syntax, dramatically accelerating investigations.
This video demonstrates a full investigation arc against a simulated Corentus Energy attack scenario, uncovering prompt injection, credential theft, C2 beaconing, lateral movement, and OT compromise across multiple data sources.
Lakewatch Genie Code provides governed queries, investigation skills, and opsec configuration that allow analysts to establish baselines, detect anomalies, and have Genie autonomously build complete attack timelines.

Vibe Investigating with Lakewatch and Genie

For decades, security investigations have required equal parts query-language incantations, instinct, and raw persistence. Lakewatch and Genie use AI to change the game, allowing analysts to investigate by simply asking questions in natural language, extracting patterns, pivoting, and getting results fast. In this video, we'll demonstrate "vibe investigating" using Genie against real-world security datasets. We'll uncover multi-stage attacks including prompt injection, credential theft, C2 beaconing, lateral movement, and a few more surprises! We'll show the full investigation arc — establishing baselines, detecting anomalies, pivoting across data sources, and building attack timelines. No query languages — just questions, answers, and a faster path to results. Attendees will leave with practical patterns for using Lakewatch Genie, crafting effective investigation prompts and supercharging their security investigations.
Talk By: Dave Herrald, Cybersecurity, Databricks ;

Chapters

FAQs

What is vibe investigating in security?

Vibe investigating is an approach where security analysts investigate threats by asking natural-language questions rather than writing specialized query-language syntax. This video shows how Lakewatch and Genie combine good investigative practices with AI acceleration to let analysts pivot across data sources and extract patterns faster.

What attack types does this video demonstrate detecting with Genie?

The video works through a simulated Corentus Energy attack scenario that includes prompt injection, credential theft, C2 beaconing, lateral movement, LSASS memory dumps, and OT network compromise. Genie autonomously builds a complete attack timeline by pivoting across network, endpoint, and DNS telemetry.

What is Lakewatch Genie Code?

Genie Code is the component inside Lakewatch that powers trusted, governed SQL queries against Databricks security datasets. It includes configurable investigation skills and opsec settings that allow analysts to ask questions and receive grounded, auditable answers from their actual security data.

How does Genie support a human-in-the-loop investigation workflow?

This video describes an investigation theory based on human-in-the-loop and 'middle-to-middle AI,' where the analyst defines the investigation direction and Genie handles query execution, pattern extraction, and pivoting. Humans remain in control of the investigative arc while AI handles the mechanical query work.

Full transcript

[00:07] Thanks everybody for coming. Uh I know it's the last presentation. I think this is the last slot for breakout breakout presentations at the conference. So um yeah, pre premier spot they that they put me in. But um I think maybe this
[00:19] morning possibly could have been worse with with everybody who went to the show last night. Did you guys go to the show? Yeah, it was good. I thought I was just telling Dom though it was a little bit loud to discuss the nuances of like
[00:31] detection engineering with with the other other nerds there but um it was it was good. Um so yeah, thanks for coming. My name is Dave Herold. I work at data bricks. Um the the topic of the talk
[00:43] today is about investigating with Genie and in doing that in the context of Lakewatch and and I put Vibe in the title hoping hoping to get a few extra people here because Vibe investigating sounds like a lot of fun. Um but really
[00:56] this is um invest it's like starting to marry up like I think good investigative practices with um the acceleration that we can get from uh from agents and so um
[01:10] I don't actually think there's too many forward-looking statements in here but if there are any please be aware of them. Um yeah, so Dave Herald, I I've been at data bricks for about a year. Uh I worked at Google Cloud Security for a
[01:22] few years before that on their SEC ops uh Chronicle Cloud SIM team. Um before that I worked at Splunk for quite a number of years and then before that I was a practitioner operator CISO at
[01:34] smaller organizations. Um and yeah, I would love to connect with everybody here. Um, so one thing about me over the last 10 or so years is I've actually thought about investigation a lot and and tried
[01:46] to contribute to the community around this area quite a bit. Um, when I was at Splunk, we started this thing called Boss of the Sock, which was a um a capture the flag, but it really was a a
[01:58] you know, it was really an instructional vehicle for us to like teach people how to do investigations. We had a lot of fun with that over the years. I think I talked to the guy who still runs it. Um I think they have sort of kept track of
[02:12] the people that have gone through that program from its inception when when I started it and it's like a 100,000 people have kind of gone through that program learning about security investigations. Um and then um
[02:24] interestingly um it's kind of a long story but there's some folks uh from the the who run this uh conference called graph the planet and they picked up some of these data sources from the Splunk bots and said hey we're actually using
[02:37] these data sets and the questions for evalgent training which was a lot of fun and and that that sort of inspired me to start creating data sets again that we can use for investigation. Um, and I also was um
[02:50] part of the the Google cyber security certificate um which was a big program that um kind of takes folks from different backgrounds and um uh not cyber and gets them into cyber and so um
[03:04] I I think about these things a lot. So um I am going to talk a little bit about lakewatch not too much. So Lakewatch is the SIM that we're building on top of data bricks, right? It's a security analytics platform. Like some people
[03:17] call it a SIM, some people don't or you know does it, you know, there's arguments about whether it it meets like Gartner's definition of SIM and all these things, but it's a place to store security data, a way to store security
[03:29] data at scale on top of data bricks. And you know it's not for the folks who uh like Dom who sort of invented the idea of storing uh security data on top of data bricks but it's okay how do how do
[03:42] we take that idea to the other 99.9% of organizations who um would love nothing more than to have the sharp edges of doing that sort of uh filed off and and make that process a lot a lot
[03:55] easier. So, um, a few things about about Lakewatch. Um, because it's built on data bricks, there's a separation of storage and compute, which just means that it's much cheaper than the SIM solutions that are out there today
[04:07] because you can store your data in cloud object storage and not in some, you know, in some sort of blackbox um um, you know, data format.
[04:19] We use all open formats and data bricks. As you know, a lot of security people really like this. They like being able to control the the bucket. They like being able to control the encryption key on the data and in that bucket. They
[04:32] like to invite data bricks in to operate on that data sort of when when they when they want to, but they also like the idea of like, hey, we could turn this off and we own all that data and it's
[04:44] encrypted with our keys and we could just shut off all external access to it. Um, so I think that's something unique that um, I've seen a lot of SIMs and I think that level of of openness is is
[04:57] something that that our customers really uh, kind of gravitate toward. Um, we have massive scale and performance um, with with data bricks. you can kind of scale up or with lake watch on data bricks kind of scale up from zero or
[05:10] scale back down to zero um as as as you need to um you know define like you know more um more like compute resources maybe for a
[05:22] certain investigation that you're running um and and maybe scale that back down as needed and and the governance and and and uh those types of things are really transparent and so I think again really aligns well with with how
[05:35] security people think of of data uh about with about you know how they want to manage their security data. So uh this is like this is a screenshot of Lakewatch. Lakewatch is in private preview still. Um it'll be available
[05:49] probably later this year. No no no commit that's a forward-looking statement. I said there wasn't going to be one. Um probably be available later this year. Um and at and pretty confident of that but it's not a commitment. Um nonetheless this is lake
[06:03] watch. So, you know, one of the things that we wanted to do with Lakewatch is make it look like other SIM products because that's kind of what what some C what customers were really kind of expecting it to look like. Um, this is
[06:16] the data sources page. So, you can see here and we're going to talk about a lot of these. Let's see if this works. Look at that. Um, we'll talk about a lot of these today, but you know, there's some some AWS data in there. There's some I
[06:29] have Microsoft Exchange data coming in, some Linux, some Windows event log, etc. Right? But maybe the first thing I'll show you today from a from an agent perspective is just telling
[06:42] Genie to actually summarize the data. Right? We can look at that list that I just looked at, but we can look at the way that Genie uh thinks about it. And I'm not doing too many live demos today. Most of these are recordings, but I am
[06:55] going to switch over once in a while to um in I'll switch over once in a while to show you kind of the live system. But um the first thing I said is just like hey uh tell me what kind of data I have.
[07:08] And I mean this is guidance that I've given for a long long time about you know what do you do when you sit down at at a at a you know in a new system right like it might be in the context of playing in a capture the flag or it
[07:21] might be a in the context of getting a new job or it might be in the context of doing incident response or something right but um you know we basically say hey um you know te tell me what what we
[07:34] have in here right and I'll just kind of scroll through some of these things, but excuse me, do this.
[07:46] And so it kind of says, hey, you know, I'm looking through all the data that you have here, right? And this is this is a genie space. So if you're familiar with that, um, and so it's basically saying, okay, I'm looking through all your your bronze tables, your gold
[07:58] tables. We in Lakewatch, we organize our data in a a pretty common um medallion architecture. So bronze is raw data, gold is is normalized. Um and so this is
[08:12] just kind of saying, hey, you know, look, you have a bunch of endpoint data. You have and that's, you know, across Windows and and Linux and you have some CrowdStrike data in there and you have um some Zeke data to show us some
[08:25] network stuff and cloud and um and this is all really accurate, right? So like and because I'm the one who put the data in there, I'm like, okay, this is this is good. And then you know I can just sort of get these um typical right um
[08:41] kind of chatbot types of responses but then you know at the end I can say things like see if this is the one that's that's that.
[08:53] Yes. So this will say like give me a summary of of all that data. This is really just a setup because I want you all to know the kind of data that we have that we're going to be talking about for the rest of the talk. Um, oh, yep. Looks like I
[09:07] looks like I had typos. Probably didn't matter for me to fix that, but I fixed it. Um, but you know, so, so, so GD goes back and says, hey, you have look, you have endpoint data, you have network data,
[09:19] you have some identity, some thread intel. Then it even goes further, right? And it says, hey, you know, the kind of data that you have would be useful generally for looking at tactic or
[09:32] techniques across these tactics and MITER attack, which which is is useful, right? Looking at at coverage through that lens can be useful. Um, this one's not that useful because some data sources are just really voluminous more
[09:46] so than others, right? So this is to total this is total like events per per source but still maybe maybe kind kind of interesting um but then um I'll just show you like what what some of those
[09:58] things were right so so this is the kind of thing this is not a feature in lake watch right this is just genie looking at the data and introspecting and say hey this is maybe a summary of the kind of data that you have so that when I go
[10:10] in to start investigating in a few minutes with you all um we generally know like oh do you have endpoint data? Yeah, we do. Do you have network data like network telemetry? Yeah, we have ZEK data. Um, and so that can shape like
[10:24] the investigative questions that we might craft later. So, um, with that, yeah, and there's a few other ways to slice and dice that. Genie's are super good at at at doing that. This is just a summary of some of
[10:36] those things, but yeah, so now we're going to jump. This is this is some a version of this slide I've put in almost every presentation on this topic forever. Anytime I'm generating data, even if
[10:50] it's like I feel like is a really good generation, a really faithful and I'm doing emulation, you know, not just like writing Python to like like completely synthesize uh uh events, right? There
[11:02] there's there's always um a little bit of this that has to happen, right? You have to suspend your disbelief. In a few places you'll see the cracks around the edges of of this data. Right? Mostly I've actually removed I think a a good
[11:15] good amount of that. But if you see that um just grant me a little bit of uh grant me a little grace on that. Um so I'll talk about
[11:30] worked at a few different sim companies now. Each one now three for three. Uh, I've I've written a re a data replay tool. So, we wrote one at Splunk. We wrote an open sourced one at Google and
[11:43] I was like, "Hey, we really need this again." So, I wrote another one. It's called Echol Lake. This is a way to replay data sets um into a SIM, but really just replay them. You doesn't necessarily have to be a SIM. Um but the
[11:56] idea is you take these data sets or some metadata around it and you can replay that data and you can control sort of the time that it gets replayed. So basically like yeah maybe I recorded it
[12:08] 10 years ago for the bots data set for example but I want it to look like it happened 10 days ago. So Echol Lake will will handle that right? it'll say, I'm going to sort of reposition all these events temporally into something that's
[12:21] more current, but I'm going to keep all of the the the deltas the same. Um, make sure that nothing gets played into the future that could could mess up, you know, sims that that that don't like future data, things like that. Um, so
[12:35] check that out. There's a couple these are both open source and today's data set is open source as well, so you can go you can go check that out. Um, and and there's a there's a whole bunch of stuff in the data sets repo. Like I I
[12:47] took all the old open source boss of the sock data sets and moved them up to current. Um, I executed about I 16 or 1,800 different atomic red team um, uh,
[12:59] you know, atomic red team tests against some Windows systems. And there's like 1,800 of those data sets there. I took all the Splunk ones that they that they publish open source with their detections and and then there's one from
[13:12] from a talk I did a few months ago that's it's out there as well. But the idea with these is um I won't go there just yet. The idea with these for for me when I create
[13:24] these scenarios is to make them as realistic as I can and I generally like to collect the data directly from systems that generate the telemetry. So although there's some there's some um there's some work going on around you
[13:37] know actually just syn completely synthesizing data but I found that that is oftent times uh it's not perfect and there's there's some shortcomings uh around that and so I like getting it
[13:49] sort of from the source but once it's created I like replaying it a lot with with uh with something like echolink so um check that out and so one thing about um security investigation Right. Um,
[14:03] we'll we'll see this on a on a slide in a second, but we're we're not quite to the point where we just say, "Hey, AI, do this." Right? We still need to be expert investigators, right? We're going to accelerate a lot of parts of
[14:15] investigation, but we still need to be in charge. We still need to be able to know what good looks like. Um, and so I thought I'd put a definition up here. So, I took this from the Chris Sanders investigation theory class, which I
[14:28] which I highly recommend. Um, if you're want to get into security investigation, you want to learn actually good core investigative techniques, highly recommend um, looking uh, look into Chris's stuff. I have a slide on it in a
[14:41] second, but I'll just define security investigation as an inquiry, an examination of evidence to, you know, gain an accurate perception of a whether a compromise has occurred and to what extent. So, this is what we're trying to
[14:54] do in in um when we're doing security investigations. And and by the way, there's there's there's related activities like threat hunting, right? And thread hunting is going to use a lot of the same techniques. It's just maybe
[15:07] has a slightly different starting point and a different u maybe maybe a slightly different u motivation around it, but a lot of the same techniques uh apply to threat hunting as well. Um Oops. Yeah.
[15:22] So,
[15:35] um do a lot and do it really fast, but AI is still largely middle to middle, right? There's there's these there's these parts on the end that that still require humans, right? Um and and may
[15:47] you know maybe we'll we'll we'll stretch that out more and more and maybe there'll be literally end to end things that we can do but in this case be prepared that it's still you know it's still a middle to middle as far as what
[16:00] the AI can do for you right um and you know the this I I actually found the the source for this. I put the the link up there if you wanted to check out that that that idea a little bit more. But you know, your job is to know what good
[16:14] looks like. And there because there's times when the agent will do things that you that are wrong or you didn't expect. I have at least at least one good example of that in here where I was like, "Okay, you're crushing it,
[16:26] crushing it, crushing it." Oh, no. Like that is that's not right. And I like had to, you know, go back and challenge the the agent. So, um, you know, be prepared for that. And you know, I think one thing that I've noticed using AI for for
[16:39] many of these things is that um it it does a lot of the easy stuff for you and it leaves all the hard stuff for for for you, right? So, you're you're the one that ends up having to make the tough calls and the more nuanced um uh the
[16:53] more the more nuanced choices, things of that nature. Um yeah, I do I do recommend checking out the the Chris Sanders course. I mentioned it earlier. He has a whole class on investigation theory. It's it's uh sort of technology
[17:06] agnostic. Um it's like $600. It's like the highest value training you'll ever find in in in security. Um and or you could pay 10 times as much for also really great stuff from SANS. There's a
[17:18] link to the SANS stuff at the at the bottom. Love SANS. Um keep this in mind as you're thinking about investigation, right? There's this thing called the bitter lesson. A lot of
[17:30] you have probably heard he heard of this, right? The bitter lesson says, hey, when you're when you're thinking about using AI to to um take over some something or you know to to do some task
[17:42] that that humans have done, um usually when you try to over sort of prescribe to the AI sort of to follow the way that humans have done this task, it usually
[17:56] underperforms compared with just letting the AI do its thing, right? And so there there's I've I've found in a few different areas that there's like this balance point right now that we're at
[18:08] where um I definitely had to to tell like the genie agent as I was working on this, hey, you um you you you should do things this way, right? There's certain
[18:20] like guard rails and then certain cases just like imperative direction like you must do this in this certain way. Um but you know I anticipate right as we go forward if we did this talk next year
[18:32] right there would be less of that and less of that and like we're kind of in this point of figuring out where that where that is where that sort of um that right kind of balance point is right but
[18:44] just just just be aware of that and eventually agents are going to be extremely good at doing uh these types of investigations and need very little sort of input from us.
[18:59] Yeah. So, talking about Lakewatch, we talked about Lakewatch. So, we have Genie Code, which is embedded inside of Lakewatch. Um, in addition to the Genie space that we looked at a couple minutes ago, Genie Code is where we're going to do most of
[19:11] this investigation, or might just call it Genie in general. We we kind of changed all the names of all the Genie things this week. So, um, but it it's Genie, right? and and specifically it's a multi-turn um uh reasoning agent that
[19:26] lives in that can write code that can write queries that lives inside of our product and helps you do things like like security investigations and so um within Genie we can put instructions in there. We can put workspace
[19:40] level instructions that apply to the whole workspace. We can put skills in there and then at the user level we can do the same thing. Um, if you want to see the ones that I put in for this presentation, you can go check. There's
[19:52] a link to a GitHub down there that has just my markdown files of my configuration for this if you want to uh play with that or you know certainly you let me know if if you uh find some
[20:04] improvements. Um, a lot of it honestly is stuff that that I've picked up over the years. Also, there's a lot of stuff from the Chris Sanders school of thought because I subscribe to that kind of so closely. So, um, but but you generally
[20:18] will want to, um, configure your your genie space, um, to to to have, you know, fine-tune it for for the way that you do investigations. Like one thing that that I that I sort of um always
[20:31] harp about is like really close uh re sort of like conservative like opsac around investigations like like never you know capital letters like never
[20:43] submit a hash you know never submit a sample to you know a virus total or something like that like that would be something maybe I would choose to do as a human but I don't want genie just to start doing that and like you know maybe
[20:56] sort of tip off any adversary that we're we're we're like um you know investigating something that they're working on. So like opsec and things like that are are are like good examples of things I might put put in there.
[21:10] Yeah. So uh we'll talk about search language just a little bit. So you on the left here we have some SPL from Splunk which I love. Like I love SPL. I'm super good at it. like I'm it's
[21:22] something I'm known for being good at and like I'm great at troubleshooting it, writing it, you know, helping other people with it. Like paid, you know, lots of mortgage payments and tuition bills for my kids, like knowing SPL,
[21:35] like I love it. Um and and you know what we have to what we have to do now is understand, hey, it's not about knowing a query language, right? If you're spending time working on uh optimizing a
[21:48] query like an hour or two and not using AI to assist you, then you're definitely doing it wrong, right? And I would even take that a step further and say that that you know the domain specific
[22:01] language or DSL for security is is now natural language. Um and even a year ago, I don't think I would have said maybe that much, but I think that's kind of where where we're at, right?
[22:13] So um yeah, start thinking in natural language uh and and stop uh worrying about like the nuances of of of query languages. Um but I will say that if you
[22:26] if you really like pipe based uh query languages uh we do have pipe syntax for our SQL dialect inside of of data bricks and spark. Um, and I think that's really
[22:38] cool and that's how when I do write SQL, I write it in pipe syntax because that's makes me uh makes me feel like home. Uh, but nonetheless,
[22:50] time working on. You should should have your LLMs writing that for you. Okay. So, um, this goes back to the boss of the sock days. We always create we always would create these, uh, fun little
[23:03] companies, right, that that were fictitious. So this is our fictitious company, Corentus Energy. It's not a real not a real company. Um but you know, and I'll just give a little little
[23:16] bit of history. When I used we used to build these for bots, um it we would spend months and we would spin up you know VMs and we would have human beings like doing things on these um like
[23:30] taking on the role of of of different characters from this like fictitious organization and then we'd like sort of like curate these attacks and we would run the attacks and and then we
[23:42] afterward we would after we would do all this post-p production on the data and all this stuff take months, right? Um and and now this is sort of the second one that I've created in this way and it it takes like a day
[23:56] because you can just assign agents to be all the people and you can have another agent that spins up all the infrastructure and another agent that plums all of the connectors from all the different security controls to your SIM
[24:08] and gets data flowing and another agent that sets up the the u the the you know parsing and what have you, right? Um, and you're, you know, uh, a friend of mine said they were sitting in a meeting
[24:20] the other day just saying yes, yes, yes, yes, yes to all their their clawed agents. And it's, it's an activity like that.
[24:33] domain controller, there's an Exchange server, there's uh, Windows endpoints, they're using Slack, they have Exchange, I think I just mentioned. Um, but it's also it's an energy company, so they have a little OT part of their network
[24:46] separate and they have a jump server that um they use for for you know secure access to from to get from the IT side of the house to the OT side of their house. Um, and there's there's a little
[24:58] bit of a there's a couple spoilers in here. So, you see how I said patient zero. Um, and so this is this is Rachel. So my my my goal in this talk is not to
[25:10] make it into something like at the end it's like a who done it. My goal is to show you like hey here's some data that we're generating. We know exactly what's in it because I because my agents created it for me and then I'm going to
[25:23] do an investigation against that data and compare these two, right? Like how is the investigation compared to what we know is actually in there. So, um, turns out that Rachel and and the the machine
[25:35] that they work on is is our patient zero. Um, but there's a few other personas, uh, in in in the data set as well. And there's, um, we'll kind of come back to this
[25:47] throughout the the talk, right? But this is sort of the attack that that went down. And and really, I would say that this started out as like five bullet points of like me kind of telling this planning agent like this is roughly what I want. I want somebody to install
[26:01] OpenClaw I in order to to sort of make their job better. I want them to that attach it to their email, right? So that give access to their email to OpenClaw. Um and I want them to uh tell OpenClaw
[26:15] to to be proactive and and take uh take action when it receives email from when when that person receives email from a regulatory agency, right? Um and that's sort of the basis of of everything else.
[26:27] And then there's there's you know command and control that gets installed. There's some uh credential stealing and then you know there's some pivoting and that sort of thing. So we're going to we're going to now kind of just like talk about this investigation how we
[26:40] would do that in lakewatch. Um so this is this is lakewatch little video here. Um but you know looks like a sim right we have our data sources we have our detections. We have these
[26:53] security cases. just have one right now. But um if I if I kind of go and check those out, right, I have this security case. I go look at it and there's a few things that
[27:05] I see here, right? There's open state. It'sformational. Informational is the lowest that you can be in Lake. We have a we have a low, but
[27:17] informationational is lower than low. Um and you know, there's nobody looking at this yet. And if you look at what what this is, right, it's, you know, outbound to a possible C2 ser, you know, IP. This
[27:31] is just a random IP that appears on a C2 list, uh, that's published on GitHub. Um, but just a connection, right, to something on a threat list. And, and this is typically something I wouldn't even advise you to like create alerts of
[27:45] any kind on unless you like really trust that feed. is generally I would say like this is kind of stepping on the rake if you will with with thread intel like creating alerts that humans have to go look at when it's just a connection and
[27:59] you don't have a lot of uh you don't have a lot of of trust or or in the fidelity of of the of the intel list but nonetheless we have this right um and this is absolutely the kind of alert
[28:11] that you wouldn't investigate right you might say oh you know if I ever had like a thousand analysts in my sock you maybe we to go investigate all the lows or the the informationals, but a lot of times
[28:23] you just don't, right? You just skip those. Um, one thing I would say that um, you know, we're talking about a lot of human in the loop types of of investigation here, but you know, as we start to say, hey, some of this stuff
[28:35] can be uh, and portions of it can be automated. Um,
[28:49] to to think about. Not not really part of of of this talk, per se. But now I'm going to jump into Genie, right? And in this case, I'm I'm hitting the the little little Genie icon up here, and it
[29:01] pops up this uh delightful little sidebar, and um and I ask an awesome first question. I thought it was awesome. I said, "Is this case worth investigating?"
[29:14] And just see what Genie says, right? And so it's going to it's going to continue on here and do some thinking. Um, and it says, "Yeah, you know, I I think maybe it's worth
[29:26] investigating because, you know, it says that, you know, it, you know, there's a connection to something that maybe has been been uh associated with command and control."
[29:38] But then it actually went a step further and it it looked at the connections and some of the the volume of that traffic and it said, you know, there was some connections that actually looked like they were on a cadence that would be
[29:50] consistent with command and control. So, you know what? We're not doing anything else today. Uh Genie says to me and says, uh, hey, let's uh let's maybe embark on on this investigation.
[30:02] Um, and and I would say that that one thing that's kind of interesting here, Genie came back and said, "Hey, here's a bunch of next steps." Okay. And
[30:14] valid in my experience to just let Genie cook, right? Like just let it let it take its next steps and the investigation, especially because I've given it instructions through the through that mechanism I mentioned
[30:27] earlier. like it actually is is is pretty good, but I think it would be boring if I just typed yes, yes, yes, yes, yes throughout this whole presentation. So, I prompted it with a few other things. We'll talk about those
[30:39] here. Okay, we got to get we got to get moving. Sorry, I'm I'm a little wordy as you guys can already tell. So, um you know, should we even open this case?
[30:51] Right? And you know, we kind of went over that and Jeanie's like, "Yeah, yeah, we should." Um, this is one thing I like to do is to say, "Hey, um, what are viable explanations for the traffic that generated this and and and how can
[31:05] I disprove those?" Right? This is like a a differential diagnosis like a doctor would do, right? Uh, like I I got a kid in med school and it's been fascinating like like looking at all the training
[31:17] that she's doing, right, around around differential diagnosis. I'm like, man, this is so um so pertinent and and and and and so applicable to to security. But basically, it's saying, yeah, you
[31:29] know, I made a few hypotheses. Um one of which is that that it was a human doing some of this these connections and said, "No, it's it's like every 65.2 seconds, boom, boom, boom, boom, boom." Right?
[31:41] And the and there was some volume that it observed that was very consistent. It's like doesn't really seem like a human. um and and started to eliminate eliminate some of the things that might say oh this this is you know not
[31:53] actually an an alert and then you know I said hey look go look at the target you know let let's talk about the target IP um and so it went and what it really did
[32:05] was looked at the the the the thread intel feed that we had um which was which was great said you know hey it appears on these 90-day windows and you know um but it didn't what it didn't do
[32:17] was reach out to it, right? It didn't like port scan it or do something like that that it ought not to have done. So, that was actually really good. Can't actually even do that without a tool use uh from Genie, but um it kind of had
[32:30] this sensibility of like, okay, I'll tell you as much as I can about it. And so, with that, I was able to say, okay, I think I think we have some C2 beaconing actually happening here. And then um you know I said okay let's think
[32:44] about the source of that right so we talked about the destination now the source and and said hey um you know tell me about the source and it did some cool stuff right it it said okay um and and I
[32:57] specifically said you know give me the process name so you know not just the IP address what's the system behind that um and it said hey uh um I don't actually know how to go look up the the the um
[33:10] the endpoint point data because I don't know the host name. I know this IP address, but I don't know the host name. A lot of a lot of this telemetry actually is is keyed off of host name. So, it did this cool um lookup through
[33:22] DNS logs and said, "Okay, cool. From from the DNS logs from that period of time, I can tell that the host name is Corentus WS, which was great." Um, but
[33:34] then it it it said this it did this thing. It said process activity was empty and then it said you know um it further you know it said hey you know because
[33:47] because you don't have um activity from your endpoint I can't really do much more there and I was like no
[34:00] it out and it might be just in our bronze level table and maybe it's not in our gold level table but you need to go look again and it was like Oh yeah, cool. We do have turn, you know, my mistake. Turns out we do have uh this
[34:13] data and is like hey um we're seeing uh node.exe running open claw executing PowerShell and then executing this this exe file
[34:25] which you know suspiciously looks like some sort of a you know a kind of a lame fake of a of a of a Microsoft uh patch process or something like that. Um,
[34:38] which that was cool. So, we're like, okay, there's this this assistant, right? This OpenClaw assistant launching this PowerShell. Um, and then I said, hey, walk that all the way back. And it and it and it said, hey, you know, we're
[34:50] finding this parent chain that went all the way back back to to root uh to, you know, to the the root cause, I should say. Um, and it's like this run agent.ps1 and, you know, um, spawning a
[35:02] command.exe exe and node and powershell and and and so forth. Um, and I'm I'm going a little fast here because we got to finish up, but it's like, hey, we have this this this prompt injection thing happening and then it was like I
[35:14] started asking more uh like post exploitation. Um, so like you know, was did did it was Elsas targeted? Well, yeah, it was it was targeted, right? And this is um it's not something I actually
[35:28] put into the prompt in into the prompt to create the data. this is something that that it just you know decided to do as it was um executing post exploitation activities. Um,
[35:40] and so, you know, I just want to keep keep on rolling here, but um, essentially saying, hey, we're, you know, we're we're we're slowly like uncovering, you know, we kind of we kind
[35:52] of started in the middle of that attack chain. We worked our way back and now we're working more towards the um the the the post exploitation side. Um and then you know I said hey you know um I
[36:04] think on the previous one you know sorry we were talking about hey was there was there service account activity for for this particular service account which it has to do with our OT infrastructure
[36:18] right and give me the destination and and and and what's normal for that and so it went back and said okay I'm going to look at some some baseline activity and I'm going to see if there's like abnormal um abnormal normal activity and
[36:31] it found it found plenty of that, right? And it said, "Hey, um, you know, there's there's um, you know, there there's this activity. I'm looking at like directionality of the traffic um, and
[36:43] also some some you know, accounts that that log that that we're then turning around and logging into that account, right? So, some interesting things there. Um,
[37:00] yeah. And I would say that from the suspend your disbelief point of view, there was at the end it kind of uh started to find some of the scaffolding that it used to execute some of these things. Um, which was uh which I I left
[37:12] some of that in here which is kind of interesting that it that it that it found uh that it found that. Um, yeah. So ultimately like this entire investigation like this is this is what
[37:25] the agent found built a timeline for me. This is all built by this is all built by Genie. Um this Rachel uh requested local admin on their workstation. They said hey I'm going to I'm going to in
[37:38] install openclaw. This is stuff that came out of the the um the the Slack kind of audit logs or the Slack message logs that we had. Um, and then this uh nerk zip 010 email dropped into the ex
[37:53] exchange, you know, dropped into the exchange replay folder. So that's that's where it's seeing like how how we actually executed some of this stuff behind the scenes that would wouldn't be typical, but but that email went into
[38:05] their inbox and then the the injection fired, C2 beaconing followed, you know, um, and you know, Elsas memory dumped and and so on and so forth. And I would say that like I was super
[38:18] impressed by Genie like finding all of these things. So the things that actually happened over here on the left versus what it found on on the right. Uh we have two full pages of that.
[38:31] Um some things um so I would just say like Genie is really good for helping to accelerate that middle part. Like it don't overclaim anything, right? It's
[38:43] not like this is we're not here. Next year, I'm sure we'll be up here convincing, trying to convince you, right, or showing you, demonstrating like that end to end is much more real or we're much closer to that. But nonetheless, like the middle to middle
[38:56] is amazing, right? I did a multi-hour investigation in a few minutes. Uh, some of it was after the concert last night.
[39:08] but some of the things I see coming up in the future um is is just you know use using this kind of data for um agentic improvement. And so um a couple things. So I have this uh I I I have a um a repo
[39:23] called bad actors which kind of shows like how we I built this data set and and one before that. You can check that out. There's a lot of prompts and a lot of like markdown files that sort of thing. Um, there's also something that's
[39:36] really cool from David Biano. A lot of you might know David, good friend of mine, too. Um, he has aentically built some some completely synthetic data generation stuff. Um, which I said
[39:49] earlier like I haven't used that technique as much because I I sometimes have have had problems with it. But I think there's kind of new um some new life being breathed into that with with the evidence forge project that David
[40:01] has. Um this is also a cool project quickly mention it called botsbench.com. So this is a guy named Leo Myerovich. He runs a company called uh graphistry. So
[40:13] he's taken the old boss of the sock data sets from 10 years ago and built like a fairly like um mainstream benchmark for AI agents, investigative agents. And so you can you can test your agent against
[40:27] you know with different models against Botsbench. Um, one one big note of caution if you're going to try and use this, like I know for a fact that all of the data and all of the the the questions and answers are all in the
[40:40] training data for every major Frontier model. So, it's really difficult to tell if it's investigating or if it's just remembering from its training. So, keep that in mind. But, I thought this was interesting. This is actually the
[40:52] emergence of this actually got me thinking, hey, we should we should maybe create some new some new agents here. Um, yeah, I put a bunch of links in the in the talk. So, if you if you want a convenient way to get all of those, you
[41:04] can go to that um QR code or take a picture of those. I'll leave it up there for another second. Um, and then I think that's
[41:16] that's it. Yeah, complete your surveys. Should be the last survey you have to do for the entire conference for 2026. And I'll just say, yeah, thanks for coming and I really appreciate everybody um making it up here for the last talk of
[41:28] the day.

Learn more about the Databricks Data and AI platform.

The information provided herein is for general informational purposes only and may not reflect the most current product capabilities or configurations.