Network Insight: How To Assess Findings - Tier 1 SOC Triage - Mark Gilbert ,Threat Researcher, Core Security
Speed to respond is critical in fighting cyber threats and cyberattacks. Learning how to quickly assess findings leads to faster response and containment. As users get familiar with the Network Insight, formerly Failsafe, user console and how to read results, quick decisions can be made as to next steps to response. In this session, we will cover how to quickly assess findings in the GUI directly or when pivoting from a SIEM or ITSM in response to a case – including top dashboard widgets for quickly drilling down on pre-filtered lists of assets. This session will cover asset filtering methods to highlight what things are important to each organization. Most importantly you will learn how to drill down on individual assets, what to look for and which sections can quickly decide on next steps.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Network Insight: How To Assess Findings - Tier 1 SOC Triage - Mark Gilbert ,Threat Researcher, Core Security
Similar to Network Insight: How To Assess Findings - Tier 1 SOC Triage - Mark Gilbert ,Threat Researcher, Core Security (20)
More from Core Security
More from Core Security (20)
Recently uploaded
Recently uploaded (20)
Network Insight: How To Assess Findings - Tier 1 SOC Triage - Mark Gilbert ,Threat Researcher, Core Security
- 1. CONNECT 2017 How To Assess Findings Network Insight Track
- 2. AGENDA • Asset tab • What’s what • Column Review • Reviewing Filtering • Decorators • Verdict Score vs. Risk Score • Asset Categories • Asset details • Findings • Event Timeline • PCAPS • A few things about files • Threat Operator review • SIEM event basics • Asset events vs. Evidence events
- 3. L E A R N M O R E Mark Gilbert Threat Research, Core Security Mark’s bio goes here. Lorim Ipsum. Mark knows threats, he’s a data scientist, coder turned threat researcher and his knowledge about threats and operators TTP’s are extensive. Prior to Core Security he did ____ at ____. He has personally put bad guys in prison through research and testimony. Fear him.
- 4. Rapid Tier1 Triage STEP ONE-‐ Identify Asset STEP TWO-‐ Review Asset Verdict & Risk STEP THREE-‐ Review Profiler hits and events timeline STEP FOUR-‐ Make decision to escalate Example of Basic Triage Steps
- 5. Cont i nuo us Moni t ori ng Behavioral, Content, and Threat Intelligence based analysis of network activity to profile suspicious and malicious activity. T hre a t D i s c ov e ry Block C&C activity or trigger device specific actions through integrations with leading NGFWs, Proxy Solutions, SIEMs, etc. R a pi d R e s pons e Agentless visibility of activity from all devices and device types indifferent of OS on your network Prioritized notifications of Infections based on forensic evidence over time rather than noisy alerts along with risk attributes and threat context Ca s e Ma na g e m e nt Live DemoNetwork Insight
- 6. Q & A
- 7. THANK YOU