// Comparison

Data Engineering for Cybersecurity vs Practical Binary Analysis: Which Should You Read?

Two cybersecurity books on Tooling, compared honestly: who each is for, what each does best, and which to read first.

Advanced

4/52025

Build Secure Data Pipelines with Free and Open-Source Tools

James Bonifield

A decade-plus threat analyst teaches how to collect, normalize, enrich, and secure the telemetry (logs, events, metrics) that security teams depend on, using open-source tools like Filebeat, Logstash, Redis, Kafka, and Elasticsearch.

Advanced

5/52018

Practical Binary Analysis

Build Your Own Linux Tools for Binary Instrumentation, Analysis, and Disassembly

Dennis Andriesse

Dennis Andriesse on the binary toolchain you can actually script: ELF internals, dynamic taint analysis, symbolic execution and instrumentation with concrete code-along examples.

Read this if

Detection engineers and SOC analysts who are tired of telemetry that doesn't organize itself and want to build the pipeline rather than just consume whatever the SIEM vendor provides. Covers collecting from Windows (Sysmon, PowerShell events), Linux (files, syslog), and network/security appliances, then transforming, securing, and automating with Ansible.

Reverse engineers ready to stop being IDA clickers and start being programmers who happen to RE. Andriesse covers DBI (Pin), taint analysis (Triton), and symbolic execution (angr) at exactly the level a practitioner needs to weaponize them.

Skip this if

Readers looking for detection logic or threat hunting technique itself; this is the plumbing underneath those activities; not the analysis built on top of it. Also assumes comfort with Linux systems administration and basic scripting.

RE beginners who haven't yet finished Practical Reverse Engineering, or readers without C and Python comfort. The book assumes you can already disassemble; the value is in the automation layer.

Key takeaways

Treats telemetry as an engineering problem with its own lifecycle (collect, normalize, enrich, secure) rather than something a SIEM magically handles.
Built entirely on free, open-source tooling (Filebeat, Logstash, Redis, Kafka, Elasticsearch), so the pipeline design is reproducible without a vendor contract.
Automating deployment with Ansible is treated as part of the job, not an afterthought — the pipeline has to be maintainable, not just functional once.

Modern RE is automated RE; the book is the bridge between hand-driven analysis and the toolchain that scales to large binaries.
Symbolic execution is finally accessible to working RE engineers thanks to angr, and Andriesse's framing is what makes it click for most practitioners.
Custom DBI passes solve a category of problems that no GUI tool can; the book teaches you when to reach for them and how to write them.

How they compare

We rate Practical Binary Analysis higher (5/5 against 4/5 for Data Engineering for Cybersecurity). For most readers, that means Practical Binary Analysis is the primary pick and Data Engineering for Cybersecurity is a useful follow-up.

Both books target advanced-level readers, so the choice is about topic, not difficulty.

Data Engineering for Cybersecurity and Practical Binary Analysis both cover Tooling, so reading them in sequence reinforces the same material from different angles.

Keep reading

Data Engineering for Cybersecurity

→ Alternatives to Data Engineering for Cybersecurity → What to read after Data Engineering for Cybersecurity