- Within the security operations center
you have to process a lot of different alerts, right.
And doing that manually, is close
to impossible with the amount of data
and the amount of traffic that most organizations, you know
have to handle on a daily basis, right?
You have to also search through suspicious indicators
of compromise, like emails, log messages, domains, URLs
IP addresses, et cetera, and then extract observables
for enrichment to then determine
whether these observables can be indeed breach
or a specific attack, right?
What you're seeing in the screen
is basically Cisco threat response
and we're actually using it through secure X.
It has the ability to do an investigation, right?
And now in the investigate panel, in the top,
I do see that there's one incident
from my host being investigated, right?
And there are eight related things, right?
And those things can be indicators
of compromise, like suspicious, you know, URLs
also other IP addresses that are communicating
to that specific host as well as a specific file, right?
So each of them, you can, of course deep dive
and investigate, click on it, you know, and go
to the investigation and also different observables.
But specifically in this one, it is obvious
that this device is actually communicating for
potentially actual trading traffic
from the organization, right? So you see here,
you know that filtration being selected twice.
And in that case, you know, it can be
that probably the attacker has compromised the device
and is now trying to evade some
of the secure technology that you have in place
and potentially actual trade data by also moving lateral
basically doing lateral movement
by compromising all the devices in the network
Now in short, what it is, and this is
just an example, right?
But what is really important for you to understand
is that not every single event, of course
is a security incident, right?
And then one security incident can have one or, you know
dozens of different events, right?
You have to actually look in the context
of what's actually happening,
and these utilities like Cisco threat response
also StealthWatch, and many others, you know
allow you to actually do that type of correlation.
Now, in this screen, if I actually deep dive
into the actual IEP address that we're investigating, right?
So the 108.62.141.250
it actually has several sightings, right?
So basically different observables that we have
seen different events and from many different types
of security devices, like Gigamon threat insight,
it's a third party application that is
being integrated through secure X in here.
You see Cisco's StealthWatch and four endpoints.
And you also see a next generation
firewall event services right?
From like firewall fire power, threat defense
and many others.
And you see that the actual confidence
is high for each of those different events.
Now they are all related, you know, in this case
it's actually potentially a malicious IP address.
Again, trying to communicate from an
internal host to transfer a file.
And specifically in the StealthWatch enterprise,
you actually see that, you know
that was actually the case, right?
It was actually trying to exfiltrate
some file using FTP, right? File transfer proco
or at least, you know, some connection, you know, out there.
So this is the type of correlation and the type
of activities that you need to increase your confidence
or the fidelity of, you know, your observables
and events to determine whether it's actually
a security incident or potential breach
in this case and so on.