Eren Guven
BLUE TEAM SECURITY ENGINEER
INSIDER ONE
EREN GUVEN is a Blue Team Security Engineer at Insider One, 3+ years in defense and blue team, where he builds and maintains detections across cloud, endpoint, and network environments. His work centers on AWS security, detection-as-code with Splunk, threat hunting, and AI-powered SOC automation — using LLMs to triage and auto-dispose security alerts at scale.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
Who Tests the Detection Tests? Mutation Testing Sigma Rules with SigmaMutant
Detection teams increasingly test Sigma rules with labelled fixtures, but passing baseline tests only proves that the current rule matches expected events. It does
not show whether the fixture suite would detect a subtle regression or whether the rule remains robust across bounded telemetry representations.
In this live demonstration, we introduce SigmaMutant, an open-source, offline tool that tests both sides of a Sigma detection contract. First, it creates small,
deterministic mutations of a parsed rule, such as removing a condition branch or changing a modifier, and measures which mutants are killed or survive against the
same fixtures. Surviving mutants reveal weak assertions or possibly equivalent logic. Second, its event-gap mode keeps the rule fixed, derives conservative in-
memory variations from positive fixtures, and reports match losses as reviewable gap candidates rather than claiming real-world bypasses.
We will run weak and strengthened PowerShell examples, inspect deterministic diffs and HTML, JSON, and JUnit evidence, improve the fixtures and rule, and
demonstrate a CI quality gate. We will also explain the fail-closed Sigma subset, safety boundaries, reproducible 15-domain evaluation, and applicability scan over
a pinned public SigmaHQ corpus.
Attendees can reproduce the complete workflow locally without a SIEM, cloud account, payload execution, or network access.
- 16:20
- Tue
- 01 Dec
Stage:
Arsenal 2
Sessions Type:
Keynote