Exploring the Python 'psutil' Module Under Windows w/ Joff Thyer

/// 🔗 Register for webcasts from BHIS and our other company tribes here -

🔗🛝 Webcast Slides -

Joff Thyer, will explore various "psutil" features in a Windows operating context in order to produce detailed Windows process information.

Many of the most prevalent SOC metrics are measurements of volume rather than success or performance. During this webcast you'll learn what makes a metric a performance metric and how you can apply it to your SOC.

You'll understand the benefits and potential consequences of not measuring key data points, as well as how you can track them using semi-automated or fully-automated means.

By the time the webcast is over you'll have a starting point of concrete examples of crucial SOC metrics that you should be tracking and how much effort it would take to start doing so today. You'll also learn how to track these data points in multiple platforms and how you can make those numbers work for you as driving forces for change and improvement.

0:00 Introduction
1:12 Python “psutil” module
3:15 Scope of coverage
3:58 Why are we talking about this?
5:49 Chrome/chromium processes
11:04 Why does this matter?
13:53 Psutil process_iter()
17:39 Memory methods
19:38 What is really happening on Windows?
22:50 Back to goals and preferences
25:41 Python3 language elements we are using
31:39 Command line arguments
33:05 Core of the script
37:05 Printing additional info
39:14 Main part of the script
39:52 DEMO
46:23 Q&A

[jsksingh]

I'd love to see a series made up of episodes like this using python libs in day to day IR/Sec functions. SOC analysts are becoming too dependent on Vendor Products/GUIs.