Ross Wolf @rw_access

fan of the absurd. engineer for @Sublime_Sec. previously at @Elastic @EndgameInc @MITREcorp https://t.co/Jvf9O8HJvM rw-access.dev Colorado Joined June 2018

Tweets

630
Followers

1K
Following

618
Likes

4K

Sublime Security @sublime_sec

5 months ago

Speed matters in threat hunting. We built high-performance historical hunting and detection backtesting at Sublime that scales to millions of messages without slowing analysts down. Read the technical deep dive: sublime.security/blog/how-we-bu…

0 1 6 388 3

View Details

Ross Wolf @rw_access

7 months ago

@sublime_sec TL;DR How to make ~90% similarity search Instead of one hash for a 100% match, 1. Use many min hashes (400-500) 2. Group those into a handful of big hashes (10-20) 3. Find an exact matching big hash to get close 4. Count matching small hashes to calculate similarity

0 0 2 465 0

View Details

Ross Wolf @rw_access

7 months ago

I'm definitely feeling warm and fuzzy hashes this holiday season. Fast similarity is something that stumped me for a very long time, but MinHash turned out to be an elegant solution! Wrote up how to build it from scratch on the @sublime_sec blog

Sublime Security @sublime_sec

7 months ago

Grouping similar emails creates herd immunity and boosts analyst productivity. We built a low-latency similarity system that groups millions of messages in milliseconds. Technical deep dive: sublime.security/blog/how-to-bu…

0 1 3 572 0

1 1 6 572 0

View Details

Sublime Security @sublime_sec

9 months ago

We’re excited to announce that Sublime has raised $150M in a Series C led by @Georgian_io, joined by new investors @Avenir_Growth, @01Advisors, @jonoberheide, and @nicoleperlroth, and existing investors @IndexVentures, @IVP, @slow, and @CitiVentures. This year we launched ASA and ADÉ, our AI agents that autonomously triage threats and auto-adapt coverage, freeing security teams from repetitive work and delivering rapid, tailored defenses. We’ve grown our customer base 4x since the beginning of the year while maintaining zero enterprise customer churn since company inception. This funding accelerates our vision to deliver autonomous email security that adapts to each organization's unique needs, stopping sophisticated attacks while eliminating the manual work and vendor bottlenecks of legacy solutions. Thank you to our customers, partners, and investors for being on this journey with us. 🔗 Read more: sublime.security/blog/sublime-r…

2 7 33 21K 2

View Details

Ross Wolf @rw_access

11 months ago

go get yourself some @MITREattack T1667 coverage

Sublime Security @sublime_sec

11 months ago

Introducing email bomb protection from Sublime: a powerful solution for automatically detecting, remediating, and triaging email bombs. In these attacks, an adversary will send hundreds or thousands of emails at once to flood an inbox and obfuscate the malicious intent. Learn how

1 3 9 11K 2

0 0 3 166 0

View Details

Sublime Security @sublime_sec

11 months ago

1 3 9 11K 2

View Details

Ross Wolf @rw_access

a year ago

this was a very cool problem to solve with @filar! It's such a natural evolution of the platform, which has been group-centric since day 1. Fellow nerds, look out for an engineering post about how "fuzzy" grouping works and the scaling+realtime challenges we had to overcome

Sublime Security @sublime_sec

2 years ago

Mass volume email attack campaigns are often customized to the recipient to increase legitimacy. We recently improved our campaign grouping algorithm to be better at identifying similar messages in a campaign to cut review time, reduce alerts, and boost herd immunity. Read how

5 5 11 3K 0

0 3 16 890 0

View Details

Ross Wolf @rw_access

2 years ago

@jkamdjou Mona Q. Lisa or MQL for short

1 0 2 45 0

View Details

Ross Wolf @rw_access

2 years ago

@sublime_sec if loving angles is wrong, I don't wanna be right

0 1 4 140 0

View Details

Ross Wolf @rw_access

2 years ago

@rseymour youtu.be/Y65FRxE7uMc

0 0 1 97 0

View Details

Ross Wolf @rw_access

2 years ago

@drewbadtweets clearly, this platform gets better by the day

0 0 1 28 0

View Details

Ross Wolf @rw_access

2 years ago

@drewbadtweets i thought it could be turned off

1 0 0 33 0

View Details

Ross Wolf @rw_access

2 years ago

@jonathanbourke @sublime_sec If you need an invite link sublimecommunity.slack.com/join/shared_in…

0 0 0 18 0

View Details

Ross Wolf @rw_access

2 years ago

@jonathanbourke @sublime_sec Happy to help you debug! Do you mind hopping in our community slack so we can take a look? Twitter replies are just so painful for the back and forth, and I find it way more productive

2 0 0 28 0

View Details

Ross Wolf @rw_access

2 years ago

@Andrew___Morris down with the sickness or bust. i'll wait

0 0 3 82 0

View Details

Ross Wolf @rw_access

2 years ago

@M_haggis @sublime_sec 🔥 Thanks Haag!

0 0 3 171 0

View Details

Justin Ibarra @br0k3ns0und

2 years ago

if a rule is too complex to understand, the alert is even worse

1 1 4 733 1

View Details

Ross Wolf @rw_access

2 years ago

@br0k3ns0und you should write the zen down! our v1 was github.com/elastic/detect… but could use a refresh!

1 0 1 163 1

View Details

Ross Wolf @rw_access

3 years ago

@GabrielLandau @andythevariable I think you need to use the triforce with the master link

0 0 0 140 0

View Details

Ross Wolf @rw_access

3 years ago

@GabrielLandau @Andrew___Morris obviously not as generalizable but could get more bang for the buck

0 0 2 77 0

View Details

Ross Wolf @rw_access

3 years ago

@GabrielLandau Could also cheaply hash the first 1K with an 8 byte hash and the full contents as a SHA256 hash. One fast, one slow. Since many binaries are aligned by the KB or half-KB (as @Andrew___Morris can attest), there's not as much entropy in the file size as you'd think.