How Dropbox Security builds tools for threat detection and incident response

This post details the development of Alertbox, a system that automates alert response runbooks by executing code in response to security alerts. It also describes the creation of a 'datasources' library to abstract away the complexities of querying disparate data stores and encapsulating logic for common security investigations. Finally, it introduces Covenant, an investigation tool built on Jupyter notebooks that leverages the same data abstractions as Alertbox for threat hunting, and Forerunner, which acts as an orchestrator between Alertbox and Covenant to generate and embed investigation notebooks for alerts.