Broad·1:00 PM – 1:50 PM
Friday, December 11, 2026
MasterBlaster: Instant Blast Radius Through Precompute
Aaron Long
Detection engineering & threat hunting
About this talk
An EDR alert names a host. An identity alert names a UPN. Neither tells you what that system does for the business, who uses it, or what an attacker could reach from it. Static criticality ratings and CMDB tiers go stale the day they are written, and timelining only shows what your telemetry saw. This talk demos MasterBlaster, a technology-agnostic API layer between your SIEM and BloodHound that precomputes business context, observed and potential access into durable facts, so when an alert fires, one API call tells you how much it matters.