The document discusses automating incident response by integrating a SIEM with EnCase Cybersecurity. Automated response allows multiple alerts to be analyzed simultaneously, reduces costs, preserves critical data, and identifies the full extent of security breaches faster than manual response. The integration uses web APIs and WSDL to allow communication and calls between the SIEM and EnCase. The document provides examples of using web APIs and configuring the SIEM and EnCase to automate incident response workflows.

1. EnCase Cybersecurity: Automating Incident May 22, 2012
Response
Automating Incident Response
Ambreesh Bhagtani
Manager UI Development
Automating Incident Response
Topics
1.What is incident Response – Use Cases?
2.Comparing Manual v/s automated incident response
3.Understanding Web APIs
4.Overview of Arcsight
5.Data visibility
6.Q & A
Page 2
Ambreesh Bhagtani, Guidance Software, Inc. 1

2. EnCase Cybersecurity: Automating Incident May 22, 2012
Response
What is incident Response?
Ability to respond to events and alerts in a timely fashion
Incidents :
•Malicious Attack.
•Unauthorized Port Activity.
•Unauthorized URL access.
•Unauthorized USB account access.
Page 3
Incident Response : Manual
Page 4
Ambreesh Bhagtani, Guidance Software, Inc. 2

3. EnCase Cybersecurity: Automating Incident May 22, 2012
Response
Drawbacks of Manual Response
•The entire process can take from weeks to months
•Single machine analyzed at a time
•Critical data may be lost
•Full extent of the breach is unknown
•High Costs
Page 5
Incident Response : Automated
Page 6
Ambreesh Bhagtani, Guidance Software, Inc. 3

4. EnCase Cybersecurity: Automating Incident May 22, 2012
Response
Benefits of Automating Incident Response
•Analyze multiple alerts at the same time
•Reduce Costs
•Multiple Machines Analyzed
•Faster Response
•Critical Data preserved
•Full extent of the breach identified
Page 7
Incident Response Flow / Architecture.
SIEM /IDS/IPS /DLP etc
EnCase Cybersecurity
Integration Code
Page 8
Ambreesh Bhagtani, Guidance Software, Inc. 4

5. EnCase Cybersecurity: Automating Incident May 22, 2012
Response
Web API’s
Computers need a language to communicate!
Applications Programming Interfaces – API’s
Page 9
SOAP Request – Get Guidance Stock Price
Host: www.stockprice.com
Content-Type: application/soap+xml; charset=utf-8
< ?xml version="1.0"?>
< soap:Enveloope>
<m:GetStockPrice>
<m:StockName>GUID</m:StockName>
</m:GetStockPrice>
</soap:Body>
< /soap:Envelope>
Page 10
Ambreesh Bhagtani, Guidance Software, Inc. 5

6. EnCase Cybersecurity: Automating Incident May 22, 2012
Response
SOAP Response- Stock Price Response
HTTP/1.1 200 OK
Content-Type: application/soap+xml; charset=utf-8
Content-Length: nnn
< ?xml version="1.0"?>
<m:GetStockPriceResponse>
<m:Price>800.00</m:Price>
</m:GetStockPriceResponse>
< /soap:Envelope>
Page 11
WSDL – What is it ?
<m:GetStockPrice>
<m:StockName>IBM</m:StockName>
</m:GetStockPrice>
Web Service Definition Language
Page 12
Ambreesh Bhagtani, Guidance Software, Inc. 6

7. EnCase Cybersecurity: Automating Incident May 22, 2012
Response
WSDL – Operation
<operation name="GetLastTradePrice">
<soap:operation >
<input> <soap:body use="literal"/> </input>
<output> <soap:body use="literal"/> </output>
</operation>
Page 13
Exercise 1 – Call a Web API
Objective – Get All Cases
Assumption – Pre-created case
Page 14
Ambreesh Bhagtani, Guidance Software, Inc. 7

8. EnCase Cybersecurity: Automating Incident May 22, 2012
Response
Exercise 2 – Use SIEM to call Integration Code
Page 15
Master Title
Page 16
Ambreesh Bhagtani, Guidance Software, Inc. 8

9. EnCase Cybersecurity: Automating Incident May 22, 2012
Response
Arcsight Integration UI
Page 17
Master Title
Event Configuration
Page 18
Ambreesh Bhagtani, Guidance Software, Inc. 9

10. EnCase Cybersecurity: Automating Incident May 22, 2012
Response
How it Works:
Retrieving Results
Master Title
Request…
1./case “case 1”
2./source “safe – source”
3./ip “192.168.85.151”
4./event $event[eventId] -> variable to capture the eventId
associated with the alert.
5./module snapshot
6./log true
7./demo
Page 20
Ambreesh Bhagtani, Guidance Software, Inc. 10

11. EnCase Cybersecurity: Automating Incident May 22, 2012
Response
Master Title
Configure Response
Page 21
Master Title
Status of the Scan
Page 22
Ambreesh Bhagtani, Guidance Software, Inc. 11

12. EnCase Cybersecurity: Automating Incident May 22, 2012
Response
Master Title
Set up the Response
Page 23
Master Title
Jobs are created..the examiner picks up the job.
Page 24
Ambreesh Bhagtani, Guidance Software, Inc. 12

13. EnCase Cybersecurity: Automating Incident May 22, 2012
Response
Forensic Analysis
Forensics Report
Page 25
Ambreesh Bhagtani, Guidance Software, Inc. 13

14. EnCase Cybersecurity: Automating Incident May 22, 2012
Response
Type of Scan
• SPA
• Profiling
• Entropy
• Find identical files
• Personal Information Identification
• Find SSNs, credit card number…
• Internet Artifacts
• Find URLs
Ambreesh Bhagtani, Guidance Software, Inc. 14