Webinar Description
Key Takeaways
- A practical four-point checklist for evaluating whether Linux security detections warrant investigation
- Applicable to existing Linux security tooling regardless of vendor
- Presented by Craig Rowland, Founder and CEO of Sandfly Security
- Includes live demonstration and open Q&A session
About the Webinar
This free 45-minute webinar addresses a common challenge in Linux security operations: distinguishing genuine threats from noise. While many Linux security tools can identify anomalies, security teams often struggle to determine which detections deserve immediate attention and which can be deprioritised.
Craig Rowland, Founder and CEO of Sandfly Security, will present a four-point checklist designed to help practitioners assess the validity and severity of Linux detections before committing resources to investigation. The framework is tool-agnostic, meaning attendees can apply it to whatever security tooling they currently operate in their Linux environments.
The Detection Validation Problem
Linux systems underpin much of modern infrastructure, from cloud workloads to on-premises servers. Security teams monitoring these environments frequently encounter alerts that require triage decisions. Without a systematic approach to validation, teams risk either chasing false positives or overlooking genuine intrusions buried among benign detections.
The session aims to provide a repeatable methodology for making these judgement calls more consistently and efficiently.
Session Format
The webinar combines presentation with a live demonstration of the detection validation process. An open Q&A segment allows attendees to ask questions directly. The session will be broadcast live on YouTube on Tuesday 27 October at 11am PT, 2pm ET, and 6pm GMT. A recording will be made available to registrants who cannot attend the live broadcast.
Who Should Attend
This webinar is suited to security analysts, incident responders, and system administrators responsible for Linux endpoint security. It will be particularly relevant for teams that manage heterogeneous tooling environments and need vendor-neutral approaches to detection triage.