Open Source Incident Management - BSides DC 2017 Presentation
•
3 likes•993 views
This talk was presented at BSides DC 2017. It dives deep into Cyphon.io for triage of security incidents and events. I also talk about threat intel management, threat hunting and upcoming features in Cyphon.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Open Source Incident Management - BSides DC 2017 Presentation
Similar to Open Source Incident Management - BSides DC 2017 Presentation (20)
Recently uploaded
Recently uploaded (20)
Open Source Incident Management - BSides DC 2017 Presentation
- 1. Open Source Incident Management Chris Ensey COO Dunbar Cybersecurity Cyphon Project Lead
- 2. What is Incident Management? Pre-processed • Logs • System Events • Audit trail • Netflow • Threat Intel / Indicators Post-processed • Security Alarms • Query Results (Alerts) • Outages • Daily Reports • Policy Violations First - we need to define what classifies an “incident”
- 3. A sea of alerts from hundreds of products Alerts are actionable incidents, but frequently false positives How are actionable issues managed today? • Email • SIEM • Ticketing System Average security manager is receiving 5000+ security alerts a day Cisco 2017
- 4. What are the options? SIEM tools - Volume based pricing - Expensive add on modules Orchestration - Still unproven - Interoperability is still evolving - Requires constant maintenance Enterprise ITSM - Not designed for security teams - Few correlation capabilities Threat Hunting tools - Great for proactive inspection - Can require advanced skillsets We needed a platform for our SOC that: • Enabled team collaboration • Tracked accountability • Enforced a consistent IM process • Created a knowledge base • Performed light orchestration • Automated prioritization and analysis • Connected to all varieties of source data
- 6. Open Source Incident Management • Designed for SOC analysts to rapidly triage security events • Correlation and Search • Monitoring of event flow • Priority Rules engine • Open framework • Project Maintained by Dunbar Cybersecurity • Community driven!
- 8. Incident Management Alert Management • Setting Incident Levels • State • Assignment • Throttling • Tag View • Outcomes • Team Collaboration • Actions
- 9. Incident Management Pivoting - Context Lookups
- 10. Incident Management Search • Basic Alerts • Collections • Historical Search of Analysis • Raw logs for correlation
- 11. Incident Management Search • Basic Alerts • Collections • Historical Search of Analysis • Raw logs for correlation
- 12. Incident Management Search • Basic Alerts • Collections • Historical Search of Analysis • Raw logs for correlation
- 13. Incident Management Search • Basic Alerts • Collections • Historical Search of Analysis • Raw logs for correlation
- 14. Orchestration APIs • JIRA / Ticketing • VirusTotal • JoeSandbox • Blacklist Check Workflow engines • MuleESB • WALKOFF • Phantom
- 15. Administration
- 16. SECURITYOPERATIONS Mitigation Response Assessment Detection Collection Patch Managem ent Configurati on Change Rule & Policy Update Service Desk Triage & Escalation Process Initiation IR / DR / BCP Quarantine Vuln Scanning Security Analytics SIEM Forensic Tools Endpoint Detect & Response IDS/IPS DLP / WAF Raw LogsPCAP Threat Intel Feeds Incident Management Flows
- 17. Other Use Cases • Threat Intel Management • Social Media Monitoring • DevOps • Physical Security
- 18. Threat Intelligence Source Types • Block Lists • TTPs / IOCs • Industry Feeds • Infragaurd / DHS / etc • Info / News / Social Media • APIs Cyphon for Threat Intel • Flat Files • Email attachments • Social Streams • APIs • STIX / TAXII (In progress) • REST (In progress)
- 19. Intelligence - Source Management & Monitoring - Investigation Archive - Collective Intelligence Sourcing - Industry Report Management - Knowledge Base Development Hunting - Search & Correlation - Hypothesis Tracking - Collaboration with Teams - Documented Hunt Outcomes Response - Escalation Actions - Packet, Memory, and File Analysis - Remediate Action tracking - After Action Reporting Threat Hunting
- 21. Latest Release 1.5.2 DataTaggers Automatically tag alerts based on the content of the data that generated the alert. You can even configure them to automatically create new tags based on the content of particular fields. With autotagging, analysts can quickly understand the nature of an alert by looking at the tags associated with it. Articles Articles are reference documents for particular subjects, such as port numbers or Snort signatures. They can provide information to help analysts quickly diagnose and remediate alerts. Upcoming features – System wide search, front end article & link support, additional Actions, REST and TAXII support
- 22. Want to learn more? https://github.com/dunbarcyber/cyphon https://gitter.im/cyphonproject http://cyphon.readthedocs.io https://www.cyphon.io