dig.sysdig.com Open in urlscan Pro
100.24.141.224  Public Scan

Submitted URL: http://email.btobinsights.com/c/180YuDcySRWPyQUBX6uVqqZxaqT
Effective URL: https://dig.sysdig.com/c/pf-sans-cloud-threat-detection-response?x=lNxpdq&utm_source=ant&utm_medium=email&u...
Submission: On July 13 via manual from US — Scanned from DE

Form analysis 0 forms found in the DOM

Text Content

THIS WEBSITE USES COOKIES

Sysdig uses cookies to personalize content and ads, to provide social media
features and to analyze our traffic. We also share information about your use of
our site with our social media, advertising and analytics partners. You can at
any time change or withdraw your consent from the Cookie Declaration on our
website.
[#OOI_PERSONAL_INFORMATION#]
Use necessary cookies only Accept Show details
OK
Use necessary cookies only Allow selection Allow all cookies
Necessary
Preferences
Statistics
Marketing
Show details
Cookie declaration [#IABV2SETTINGS#] About
 Necessary (19)  Preferences (4)  Statistics (35)  Marketing (75)  Unclassified
(9)
Necessary cookies help make a website usable by enabling basic functions like
page navigation and access to secure areas of the website. The website cannot
function properly without these cookies.

NameProviderPurposeExpiryTypeCookieConsent [x3]CookiebotStores the user's cookie
consent state for the current domain1 yearHTTP_gh_sessGithubPreserves users
states across page requests.SessionHTTPlogged_inGithubRegisters whether the user
is logged in. This allows the website owner to make parts of the website
inaccessible, based on the user's log-in status. 1
yearHTTP__cf_bm [x2]go.sysdig.com
TechTargetThis cookie is used to distinguish between humans and bots. This is
beneficial for the website, in order to make valid reports on the use of their
website.1 dayHTTPBIGipServer#go.sysdig.comUsed to distribute traffic to the
website on several servers in order to optimise response
times.SessionHTTPCONSENT [x2]Google
YouTubeUsed to detect if the visitor has accepted the marketing category in the
cookie banner. This cookie is necessary for GDPR-compliance of the website. 2
yearsHTTPrc::aGoogleThis cookie is used to distinguish between humans and bots.
This is beneficial for the website, in order to make valid reports on the use of
their website.PersistentHTMLrc::cGoogleThis cookie is used to distinguish
between humans and bots. SessionHTMLli_gcLinkedInStores the user's cookie
consent state for the current domain2
yearsHTTPX-Salesforce-CHATSalesforceNecessary for the functionality of the
website's chat-box function. SessionHTTPCookieConsentPolicySalesforceStores the
user's cookie consent state for the current domain1
yearHTTPLSKey-c$CookieConsentPolicySalesforceDetermines whether the user has
accepted the cookie consent box. 1 yearHTTP_ce.cchCrazyeggStores the user's
cookie consent state for the current
domainSessionHTTPce_successful_csp_checksysdig.comDetects whether user behaviour
tracking should be active on the website.
PersistentHTMLuserIdtracking.intentsify.ioPreserves users states across page
requests.10 yearsHTTP

Preference cookies enable a website to remember information that changes the way
the website behaves or looks, like your preferred language or the region that
you are in.

NameProviderPurposeExpiryTypeCookieConsentBulkSetting-#CookiebotEnables cookie
consent across multiple
websitesPersistentHTML_lbvisitedPathFactoryPendingPersistentHTML_lbvisitedcountPathFactoryPendingPersistentHTMLvidPathFactoryCollects
data on visitor interaction with the website's video-content - This data is used
to make the website's video-content more relevant towards the visitor. 2
yearsHTTP

Statistic cookies help website owners to understand how visitors interact with
websites by collecting and reporting information anonymously.

NameProviderPurposeExpiryTypec.gifMicrosoftCollects data on the user’s
navigation and behavior on the website. This is used to compile statistical
reports and heatmaps for the website owner.SessionPixelCLIDMicrosoftCollects
data on the user’s navigation and behavior on the website. This is used to
compile statistical reports and heatmaps for the website owner.1
yearHTTPBrowserIdSalesforceRegisters a unique ID that identifies the user's
device for return visits.1 yearHTTPBrowserId_secSalesforceRegisters statistical
data on users' behaviour on the website. Used for internal analytics by the
website operator. 1 yearHTTP_octoGithubPending1 yearHTTPcollectGoogleUsed to
send data to Google Analytics about the visitor's device and behavior. Tracks
the visitor across devices and marketing
channels.SessionPixelAnalyticsSyncHistoryLinkedInUsed in connection with
data-synchronization with third-party analysis service. 29
daysHTTPsysdig.comLA_VISITOR_INFOSalesforcePendingSessionHTMLbrowser_idLinkedInUsed
to recognise the visitor's browser upon reentry on the website.5
yearsHTTP_at.hist.#OracleUsed by the social sharing platform AddThis to store
the user's usage history of the AddThis sharing
widgetPersistentHTML_ce.gtldCrazyeggHolds which URL should be presented to the
visitor when visiting the site. SessionHTTP_ce.ssysdig.comCollects data on the
user’s navigation and behavior on the website. This is used to compile
statistical reports and heatmaps for the website owner.1
yearHTTP_clckMicrosoftCollects data on the user’s navigation and behavior on the
website. This is used to compile statistical reports and heatmaps for the
website owner.1 yearHTTP_clskMicrosoftRegisters statistical data on users'
behaviour on the website. Used for internal analytics by the website operator. 1
dayHTTP_cltkMicrosoftRegisters statistical data on users' behaviour on the
website. Used for internal analytics by the website operator.
SessionHTML_gaGoogleRegisters a unique ID that is used to generate statistical
data on how the visitor uses the website.2 yearsHTTP_ga_#GoogleUsed by Google
Analytics to collect data on the number of times a user has visited the website
as well as dates for the first and most recent visit. 2 yearsHTTP_gatGoogleUsed
by Google Analytics to throttle request rate1 dayHTTP_gidGoogleRegisters a
unique ID that is used to generate statistical data on how the visitor uses the
website.1 dayHTTP_hjAbsoluteSessionInProgressHotjarThis cookie is used to count
how many times a website has been visited by different visitors - this is done
by assigning the visitor an ID, so the visitor does not get registered twice.1
dayHTTP_hjFirstSeenHotjarThis cookie is used to determine if the visitor has
visited the website before, or if it is a new visitor on the website.1
dayHTTP_hjIncludedInPageviewSampleHotjarDetermines if the user's navigation
should be registered in a certain statistical place holder.1
dayHTTP_hjIncludedInSessionSampleHotjarRegisters data on visitors'
website-behaviour. This is used for internal analysis and website optimization.
1 dayHTTP_hjRecordingLastActivityHotjarSets a unique ID for the session. This
allows the website to obtain data on visitor behaviour for statistical
purposes.SessionHTML_hjSession_#HotjarCollects statistics on the visitor's
visits to the website, such as the number of visits, average time spent on the
website and what pages have been read.1 dayHTTP_hjSessionUser_#HotjarCollects
statistics on the visitor's visits to the website, such as the number of visits,
average time spent on the website and what pages have been read.1
yearHTTPce_clocksysdig.comSets a timestamp for when the visitor entered the
website. This is used for analytical purposes on the website.
PersistentHTMLcebssysdig.comTracks the individual sessions on the website,
allowing the website to compile statistical data from multiple visits. This data
can also be used to create leads for marketing
purposes.SessionHTTPcebspsysdig.comThis cookie is used to determine when the
visitor last visited the different subpages on the
website.SessionHTTPcetabidsysdig.comSets a unique ID for the session. This
allows the website to obtain data on visitor behaviour for statistical
purposes.SessionHTMLhjViewportIdHotjarSets a unique ID for the session. This
allows the website to obtain data on visitor behaviour for statistical
purposes.SessionHTMLsnapinsPage_#SalesforcePendingPersistentHTMLsnapinsPageTime_#SalesforcePendingPersistentHTMLsnapinsPcSalesforceDetermines
when the visitor last visited the different subpages on the website, as well as
sets a timestamp for when the session
started.PersistentHTMLsnapinsStartSalesforceDetermines when the visitor last
visited the different subpages on the website, as well as sets a timestamp for
when the session started.PersistentHTML

Marketing cookies are used to track visitors across websites. The intention is
to display ads that are relevant and engaging for the individual user and
thereby more valuable for publishers and third party advertisers.

NameProviderPurposeExpiryTypelocOracleGeolocation, which is used to help
providers determine how users who share information with each other are
geographically located (state level).1 yearHTTPuvcOracleDetects how often the
social sharing service, AddThis, encounters the same user.1
yearHTTPxtcOracleRegisters the user's sharing of content via social media.1
yearHTTPlang [x2]LinkedInRemembers the user's selected language version of a
websiteSessionHTTPrp.gifRedditNecessary for the implementation of the
Reddit.com's share-button
function.SessionPixelactivity/activity.gifTechTargetCollects information on user
behaviour on multiple websites. This information is used in order to optimize
the relevance of advertisement on the website.SessionPixelbitoBeeswaxSets a
unique ID for the visitor, that allows third party advertisers to target the
visitor with relevant advertisement. This pairing service is provided by third
party advertisement hubs, which facilitates real-time bidding for advertisers.1
yearHTTPbitoIsSecureBeeswaxPresents the user with relevant content and
advertisement. The service is provided by third-party advertisement hubs, which
facilitate real-time bidding for advertisers.1
yearHTTPcheckForPermissionBeeswaxDetermines whether the visitor has accepted the
cookie consent box. 1
dayHTTPlog/cnvBeeswaxPendingSessionPixelMUID [x2]MicrosoftUsed widely by
Microsoft as a unique user ID. The cookie enables user tracking by synchronising
the ID across many Microsoft domains.1 yearHTTPSRM_BMicrosoftTracks the user’s
interaction with the website’s search-bar-function. This data can be used to
present the user with relevant products or services. 1
yearHTTPANONCHKMicrosoftRegisters data on visitors from multiple visits and on
multiple websites. This information is used to measure the efficiency of
advertisement on websites. 1 dayHTTPSMMicrosoftRegisters a unique ID that
identifies the user's device during return visits across websites that use the
same ad network. The ID is used to allow targeted
ads.SessionHTTPtuuidDemandBaseCollects visitor data related to the user's visits
to the website, such as the number of visits, average time spent on the website
and what pages have been loaded, with the purpose of displaying targeted ads.2
yearsHTTPtuuid_luDemandBaseContains a unique visitor ID, which allows
Bidswitch.com to track the visitor across multiple websites. This allows
Bidswitch to optimize advertisement relevance and ensure that the visitor does
not see the same ads multiple times. 2 yearsHTTPvalidateCookieDemandBaseUsed in
context with Account-Based-Marketing (ABM). The cookie registers data such as
IP-addresses, time spent on the website and page requests for the visit. This is
used for retargeting of multiple users rooting from the same IP-addresses. ABM
usually facilitates B2B marketing purposes.SessionPixelIDEGoogleUsed by Google
DoubleClick to register and report the website user's actions after viewing or
clicking one of the advertiser's ads with the purpose of measuring the efficacy
of an ad and to present targeted ads to the user.1
yearHTTPpagead/landing [x2]GoogleCollects data on visitor behaviour from
multiple websites, in order to present more relevant advertisement - This also
allows the website to limit the number of times that they are shown the same
advertisement. SessionPixeltest_cookieGoogleUsed to check if the user's browser
supports cookies.1 dayHTTPfrMeta Platforms, Inc.Used by Facebook to deliver a
series of advertisement products such as real time bidding from third party
advertisers.3 monthsHTTPtrMeta Platforms, Inc.Used by Facebook to deliver a
series of advertisement products such as real time bidding from third party
advertisers.SessionPixelads/ga-audiencesGoogleUsed by Google AdWords to
re-engage visitors that are likely to convert to customers based on the
visitor's online behaviour across websites.SessionPixelNIDGoogleRegisters a
unique ID that identifies a returning user's device. The ID is used for targeted
ads.6 monthsHTTPpagead/1p-user-list/#GoogleTracks if the user has shown interest
in specific products or events across multiple websites and detects how the user
navigates between sites. This is used for measurement of advertisement efforts
and facilitates payment of referral-fees between
websites.SessionPixelcsGumgumCollects data on the user across websites - This
data is used to make advertisement more relevant.1
yearHTTP_session_id [x2]jukebox.pathfactory.com
PathFactoryStores visitors' navigation by registering landing pages - This
allows the website to present relevant products and/or measure their
advertisement efficiency on other websites. 2 yearsHTTPbcookieLinkedInUsed by
the social networking service, LinkedIn, for tracking the use of embedded
services.2 yearsHTTPbscookieLinkedInUsed by the social networking service,
LinkedIn, for tracking the use of embedded services.2 yearsHTTPlidcLinkedInUsed
by the social networking service, LinkedIn, for tracking the use of embedded
services.1 dayHTTPUserMatchHistoryLinkedInUsed to track visitors on multiple
websites, in order to present relevant advertisement based on the visitor's
preferences. 29 daysHTTPoktgidOktopostCollects information on user behaviour on
multiple websites. This information is used in order to optimize the relevance
of advertisement on the website.1 yearHTTPoktsidOktopostCollects information on
user behaviour on multiple websites. This information is used in order to
optimize the relevance of advertisement on the
website.SessionHTTP__atuvcOracleUpdates the counter of a website's social
sharing features.1 yearHTTP__atuvsOracleEnsures that the updated counter is
displayed to the user if a page is shared with the social sharing service,
AddThis.1 dayHTTP_at.cwwOracleUsed by the social sharing platform
AddThisPersistentHTML_fbp Meta Platforms, Inc.Used by Facebook to deliver a
series of advertisement products such as real time bidding from third party
advertisers.3 monthsHTTP_gac_UA-#GoogleStores information about ad campaigns
from Google Adwords to show targeted ads to the visitor.3
monthsHTTP_gcl_auCookiebotUsed by Google AdSense for experimenting with
advertisement efficiency across websites using their services. 3
monthsHTTP_gcl_awCookiebotUsed to measure the efficiency of the website’s
advertisement efforts, by collecting data on the conversion rate of the
website’s ads across multiple websites.3 monthsHTTP_hjRecordingEnabledHotjarThis
cookie is used to identify the visitor and optimize ad-relevance by collecting
visitor data from multiple websites – this exchange of visitor data is normally
provided by a third-party data-center or
ad-exchange.SessionHTML_mkto_trkMarketoContains data on visitor behaviour and
website interaction. This is used in context with the email marketing service
Marketo.com, which allows the website to target visitors via email. 2
yearsHTTP_rdt_uuidRedditUsed to track visitors on multiple websites, in order to
present relevant advertisement based on the visitor's preferences. 3
monthsHTTP_uetsidMicrosoftCollects data on visitor behaviour from multiple
websites, in order to present more relevant advertisement - This also allows the
website to limit the number of times that they are shown the same advertisement.
1 dayHTML_uetsid_expMicrosoftContains the expiry-date for the cookie with
corresponding name. PersistentHTML_uetvidMicrosoftUsed to track visitors on
multiple websites, in order to present relevant advertisement based on the
visitor's preferences. 1 yearHTML_uetvid_expMicrosoftContains the expiry-date
for the cookie with corresponding name.
PersistentHTMLat-lojson-cache-#v1.addthisedge.comUsed by the social sharing
platform AddThisPersistentHTMLat-randOracleUsed by the social sharing platform
AddThisPersistentHTMLgclidsysdig.comUsed to send data to Google Analytics about
the visitor's device and behavior. Tracks the visitor across devices and
marketing channels.13 daysHTTPutm_campaignsysdig.comCollects information on user
preferences and/or interaction with web-campaign content - This is used on
CRM-campaign-platform used by website owners for promoting events or products.13
daysHTTPutm_contentsysdig.comUsed to send data to Google Analytics about the
visitor's device and behavior. Tracks the visitor across devices and marketing
channels.13 daysHTTPutm_mediumsysdig.comCollects information on user preferences
and/or interaction with web-campaign content - This is used on
CRM-campaign-platform used by website owners for promoting events or products.13
daysHTTPutm_sourcesysdig.comDetermines how the visitor accessed the website -
This information is used by the website operator in order to determine the
efficiency of their marketing efforts. 13 daysHTTPutm_termsysdig.comDetermines
how the user accessed the website. This information is used by the website
operator in order to measure the efficiency of their marketing. 13
daysHTTPi/adsct [x2]Twitter Inc.The cookie is used by Twitter.com in order to
determine the number of visitors accessing the website through Twitter
advertisement content. SessionPixelmuc_adsTwitter Inc.Collects data on user
behaviour and interaction in order to optimize the website and make
advertisement on the website more relevant. 2 yearsHTTPr/beaconAmobeeUsed to
track the visitor across multiple devices including TV. This is done in order to
re-target the visitor through multiple channels. SessionPixeluidAmobeeCollects
anonymous data related to the user's visits to the website, such as the number
of visits, average time spent on the website and what pages have been loaded,
with the purpose of displaying targeted ads.179
daysHTTPpersonalization_idTwitter Inc.This cookie is set by Twitter - The cookie
allows the visitor to share content from the website onto their Twitter profile.
2 yearsHTTPVISITOR_INFO1_LIVEYouTubeTries to estimate the users' bandwidth on
pages with integrated YouTube videos.179 daysHTTPYSCYouTubeRegisters a unique ID
to keep statistics of what videos from YouTube the user has
seen.SessionHTTPytidb::LAST_RESULT_ENTRY_KEYYouTubeStores the user's video
player preferences using embedded YouTube
videoPersistentHTMLyt-remote-cast-availableYouTubeStores the user's video player
preferences using embedded YouTube
videoSessionHTMLyt-remote-cast-installedYouTubeStores the user's video player
preferences using embedded YouTube
videoSessionHTMLyt-remote-connected-devicesYouTubeStores the user's video player
preferences using embedded YouTube
videoPersistentHTMLyt-remote-device-idYouTubeStores the user's video player
preferences using embedded YouTube
videoPersistentHTMLyt-remote-fast-check-periodYouTubeStores the user's video
player preferences using embedded YouTube
videoSessionHTMLyt-remote-session-appYouTubeStores the user's video player
preferences using embedded YouTube
videoSessionHTMLyt-remote-session-nameYouTubeStores the user's video player
preferences using embedded YouTube videoSessionHTML

Unclassified cookies are cookies that we are in the process of classifying,
together with the providers of individual cookies.

NameProviderPurposeExpiryTypeeidapp.storylane.ioPendingPersistentHTMLfp_idapp.storylane.ioPendingPersistentHTMLsid_rsh8n0a5kxljapp.storylane.ioPendingSessionHTMLsid_ypxokaaa7kknapp.storylane.ioPendingSessionHTMLadgroupidsysdig.comPending13
daysHTTPutm_devicesysdig.comPending13 daysHTTPutm_geosysdig.comPending13
daysHTTPutm_positionsysdig.comPending13 daysHTTPutm_typesysdig.comPending13
daysHTTP

 [#IABV2_LABEL_PURPOSES#]  [#IABV2_LABEL_FEATURES#]  [#IABV2_LABEL_PARTNERS#]
[#IABV2_BODY_PURPOSES#]
[#IABV2_BODY_FEATURES#]
[#IABV2_BODY_PARTNERS#]

This website uses cookies to personalize content and ads, to provide social
media features and to analyze our traffic.

Cookies are small text files that can be used by websites to make a user's
experience more efficient. The law states that we can store cookies on your
device if they are strictly necessary for the operation of this site.

For all other types of cookies we need your permission. This site uses different
types of cookies. Some cookies are placed by third party services that appear on
our pages. Our Cookie Policy.

Learn more about who we are, how you can contact us and how we process personal
data in our Privacy Policy.



Your consent applies to the following domains: dig.sysdig.com, sysdig.com


Cookie declaration last updated on 14.06.22 by Cookiebot
Thumbnails Document Outline Attachments


Previous

Next
Highlight all Match case
Whole words

Presentation Mode Open Print Download Current View

Go to First Page Go to Last Page

Rotate Clockwise Rotate Counterclockwise

Text Selection Tool Hand Tool

Vertical Scrolling Horizontal Scrolling Wrapped Scrolling

No Spreads Odd Spreads Even Spreads

Document Properties…
Toggle Sidebar

Find
Previous

Next
of 10
Presentation Mode Open Print Download Current View

Tools
Zoom Out

Zoom In
Automatic Zoom Actual Size Page Fit Page Width 50% 75% 100% 125% 150% 200% 300%
400%

1A Comprehensive Approach to Cloud Threat Detection and ResponseWhitepaperA
Comprehensive Approach to Cloud Threat Detection and ResponseWritten by Jake
WilliamsJune 2022©2022 SANS™ Institute


2A Comprehensive Approach to Cloud Threat Detection and ResponseIntroductionWhen
it comes to container security and visibility in the cloud, there are two
primary models: agent based and agentless. Many organizations spend an
inordinate amount of time trying to decide which model is superior. In this
paper, we make a strong case that organizations need both agent-based and
agentless monitoring solutions to maximize visibility and control. Once
practitioners recognize that both are necessary for optimal security outcomes,
this logical question emerges: How should these technologies work together? We
seek to answer those questions in this paper, using a case study showing the
benefits of synergizing data from agent-based and agentless monitoring in
finding, focusing, and fixing threats.Use Cases for Cloud Detection and
ResponseBefore discussing specifics, establishing the use cases for any cloud
workload monitoring solution is vital. We can categorize these use cases as
finding, focusing, and fixing. Let’s examine each of these in
detail.FindingVisibility is critical across your cloud and container platforms,
but traditional security tools (those that aren’t built to be cloud-native)
don’t provide adequate context to perform an investigation and security
response. Sure, agentless is the new hotness, but what are you giving up? Do you
need agents or agentless? The reality is that in a cloud environment, you need
both to adequately secure workloads. (We discuss the trade-offs between
agent-based and agentless solutions in the section “Agent or
Agentless.”)FocusingNow that you’ve found the threat, you need to prioritize and
rapidly focus on what matters. How do you quickly identify what matters most? It
will come as no surprise to anyone with SecOps experience that alert fatigue is
a major contributor to analyst burnout. And this isn’t limited to just
false-positive alerts. When analysts receive alerts, they’re expected to take
action, but when those alerts lack necessary investigative context, analysts
find themselves in a frustrating situation with potentially career-altering
implications. Even ignoring analyst happiness and retention (things that
organizations absolutely should not ignore), providing the tools to quickly
focus an analyst matters for the health of the organization.In many incident
response investigations, we learn that analysts had some piece of relevant data
that would have revealed the intrusion sooner—but that wasn’t clear at the time.
The most common root cause? The alert, as displayed to the analyst, lacked the
necessary context to properly understand the intrusion. However, this leads to
an obvious question: With so many new platform-as-a-service (PaaS) offerings,
even on a familiar cloud service provider’s platform, how do analysts
contextualize any alert they’re staring at? What service even generated it?
Without the appropriate context, analysts are left to wonder if the issue is
isolated to a particular workload or if it’s even really exploitable in the
given configuration.Do you need agents or agentless? In a cloud environment, you
need both to adequately secure workloads.









More Information Less Information
Close


Enter the password to open this PDF file.


Cancel OK
File name:

-

File size:

-


Title:

-

Author:

-

Subject:

-

Keywords:

-

Creation Date:

-

Modification Date:

-

Creator:

-


PDF Producer:

-

PDF Version:

-

Page Count:

-

Page Size:

-


Fast Web View:

-

Close
Preparing document for printing…
0%
Cancel

Next 
Next 

GUIDE. Sysdig Guide To SOC 2 Compliance
LinkedIn LinkTwitter LinkFacebook LinkLike ButtonDownload Link
Start Free Trial



SIGN UP FOR A FREE 30 DAY TRIAL!

Getting started with cloud securityvideo
Cloud Infrastructure Entitlements Management (CIEM) with Sysdig Secure |
Sysdigwebpage
GUIDE. Cloud Security 101pdf
GUIDE. Securing Containers & Cloud for Dummiespdf
How to Get Started with Sysdig Secure - Tutorial for Beginnersvideo
Real-Time Threat Detection in the Cloud – Sysdigwebpage
REPORT. 2022 Cloud-Native Security And Usage Reportpdf
GUIDE. Anatomy Of Cloud Attackspdf
GUIDE. 5 Steps to Securing Multi-Cloud Infrastructurepdf
WHITEPAPER. A Comprehensive Approach to Cloud threat Detection and Responsepdf
GUIDE. Sysdig Guide To SOC 2 Compliancepdf
CSPM, CIEM, CWPP, and CNAPP: Guess who in cloud security landscape –
Sysdigwebpage
CASE STUDY. Beekeeper Serves Up Secure Communications, Data, and Applications
Across Cloud Environmentspdf
VIDEO. GCP - Runtime Security Deminarvideo
GUIDE. 5 Steps to Securing AWS Cloud Infrastructurepdf