MA
Uploaded byMITRE ATT&CK
PDF, PPTX383 views

The ATT&CK Philharmonic

The document discusses the integration of the ATT&CK framework in enhancing cybersecurity data management, likening security data sources to an orchestra that needs a conductor for effective collaboration. It emphasizes the importance of automation in utilizing ATT&CK matrices to streamline incident response and reduce complexity, ultimately saving time during incidents. Additionally, it introduces tools like the ATT&CK workbench for managing and customizing ATT&CK data and highlights potential future developments in threat detection and management.

Embed presentation

Download as PDF, PPTX
The ATT&CK Philharmonic
Disclaimer: All opinions expressed are those solely of the authors and do not represent the official views or opinions of Google Cloud & Siemplify.
Ivan Ninichuck Freelancer , Tech Writer, ATT&CK and Elastic things. Siemplify and Science Fiction. Andy Shepherd SOC, MSSP, PreSales, GCIH, used SOAR to get married, and other stuff ATT&CK Task Force Presenters
The ATT&CK Task Force Andrea Jendriskova Arnaud Loos Tal Reznikov Raja Ali Special thanks to all colleagues who also contributed ideas through various fun conversations!
What do you imagine when you think of all your security data sources?
How security feels without ATT&CK!
● ATT&CK brings guidance, clarity and direction. The Framework is the sheet music that orchestra plays. ● TTPs, mitigations, groups, software and data components provide order to the chaos of information.
● Like an orchestra security data sources represent dozens of different groups ● Even if they all play the same song, does not mean they do it together ● An Orchestra still needs a Conductor
Users, Analysts and Management SOAR NSM EDR/XDR Email SIEM Authentication Cloud CTI Mobile IOT
How can the use of ATT&CK be automated?
Data Components: Pieces of the Rosetta Stone Rosetta Stone from Egypt Rice University ATT&CK Matrices Security Events Data Components Detections ● Relationships in the ATT&CK Matrices can be used to automate investigation ● Data components make it possible to point automated queries directly at the data needed by analysts ● Time is the ultimate calculation of utility. By expanding known relationships in ATT&CK we can decrease the complexity of automation. During an incident complexity costs time more than any other factor.
ATT&CK Workbench: A Ready Made Workshop ● CTID Project: https://github.com/center-for-threat-informed-defense/attack-workbench- frontend ● Provides ability to manage, customize and share ATT&CK Stix Collections ● Perfect location to store additional data linked to our new Rosetta Stone ● Automation through built in REST API
How can we discover new ATT&CK relationships?
SOAR and ATT&CK: What is SOAR Ingest Playbook Case View
SOAR and ATT&CK: Alert enrichment Simple case level enrichment Woop?
SOAR and ATT&CK: Case Grouping
SOAR and ATT&CK: Map case to ATT&CK Auto grouped mapping to Mitre Woop!
SOAR and ATT&CK: Case Grouping ATT&CK Where is this Tenant strong?
SOAR and ATT&CK: Case Grouping ATT&CK
SOAR and ATT&CK: Case Grouping ATT&CK Exploring concept
SOAR and ATT&CK: Future? Exploring concept
ATT&CK Sightings: Relationships to Build ● Multi-chained technique sightings ● Begin predicting what techniques are missing during cases ● Evaluate risk to observed technique chains ● Reduce the complexity for analysts to find where key data and management to make key decisions
Alert -> Cases -> Sightings -> Action : Straw Poll With Sightings results, should SOAR….? ● Give a % against each technique ● Recap mitigations ● Give simple example search syntax to get started hunting ● Tell you what logs to look for (but then why wasn’t that alert found)

More Related Content

PDF
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
PDF
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
PDF
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
PDF
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
PDF
State of the ATT&CK
byMITRE ATT&CK
 
PDF
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
PDF
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
PDF
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
State of the ATT&CK
byMITRE ATT&CK
 
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 

What's hot

PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
PDF
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
PDF
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
PPTX
Leveraging MITRE ATT&CK - Speaking the Common Language
byErik Van Buggenhout
 
PDF
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
PPTX
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
PDF
When Insiders ATT&CK!
byMITRE ATT&CK
 
PDF
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
PDF
Navigating the Attention Economy – Using MITRE ATT&CK to Communicate to Stake...
byMITRE ATT&CK
 
PDF
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
PDF
Automation: The Wonderful Wizard of CTI (or is it?)
byMITRE ATT&CK
 
PDF
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
PDF
Evaluating and Enhancing Security Maturity through MITRE ATT&CK Mapping
byMITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
PDF
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
PDF
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
PPTX
Adversary Emulation using CALDERA
byErik Van Buggenhout
 
PDF
Sharpening your Threat-Hunting Program with ATTACK Framework
byMITRE - ATT&CKcon
 
PDF
Threat-Based Adversary Emulation with MITRE ATT&CK
byKatie Nickels
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
Leveraging MITRE ATT&CK - Speaking the Common Language
byErik Van Buggenhout
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
When Insiders ATT&CK!
byMITRE ATT&CK
 
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
Navigating the Attention Economy – Using MITRE ATT&CK to Communicate to Stake...
byMITRE ATT&CK
 
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
Automation: The Wonderful Wizard of CTI (or is it?)
byMITRE ATT&CK
 
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
Evaluating and Enhancing Security Maturity through MITRE ATT&CK Mapping
byMITRE ATT&CK
 
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
Adversary Emulation using CALDERA
byErik Van Buggenhout
 
Sharpening your Threat-Hunting Program with ATTACK Framework
byMITRE - ATT&CKcon
 
Threat-Based Adversary Emulation with MITRE ATT&CK
byKatie Nickels
 

Similar to The ATT&CK Philharmonic

PDF
Mitre getting-started-with-attack-october-2019
byThang Nguyen
 
PDF
MITRE ATT&CKcon Power Hour - November
byMITRE - ATT&CKcon
 
PDF
EU ATT&CK community ATT&CK-onomics
byGert-Jan Bruggink
 
PDF
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2018: ATT&CK: All the Things, Neelsen Cyrus and David Thompso...
byMITRE - ATT&CKcon
 
PDF
What's a MITRE with your Security?
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...
byMITRE - ATT&CKcon
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
PDF
MITRE ATTACKcon Power Hour - January
byMITRE - ATT&CKcon
 
PPTX
BSidesLV -The SOC Counter ATT&CK
byMathieu Saulnier
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
PPTX
ATT&CKing Threat Management
byAndy Piazza
 
PDF
CISA usage of ATT&CK in Cybersecurity Advisories
byMITRE ATT&CK
 
PDF
MITRE ATT&CKcon 2.0: attckr - A Toolkit for Analysis and Visualization of ATT...
byMITRE - ATT&CKcon
 
PPTX
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
byHarry McLaren
 
PDF
Best practices fore MITRE EMERSON EDUARDO RODRIGUES
byEMERSON EDUARDO RODRIGUES
 
PDF
Mitre ATT&CK by Mattias Almeflo Nixu
byNixu Corporation
 
PDF
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
byMITRE - ATT&CKcon
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
PDF
State of ATT&CK
byAdam Pennington
 
Mitre getting-started-with-attack-october-2019
byThang Nguyen
 
MITRE ATT&CKcon Power Hour - November
byMITRE - ATT&CKcon
 
EU ATT&CK community ATT&CK-onomics
byGert-Jan Bruggink
 
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: ATT&CK: All the Things, Neelsen Cyrus and David Thompso...
byMITRE - ATT&CKcon
 
What's a MITRE with your Security?
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...
byMITRE - ATT&CKcon
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
MITRE ATTACKcon Power Hour - January
byMITRE - ATT&CKcon
 
BSidesLV -The SOC Counter ATT&CK
byMathieu Saulnier
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
ATT&CKing Threat Management
byAndy Piazza
 
CISA usage of ATT&CK in Cybersecurity Advisories
byMITRE ATT&CK
 
MITRE ATT&CKcon 2.0: attckr - A Toolkit for Analysis and Visualization of ATT...
byMITRE - ATT&CKcon
 
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
byHarry McLaren
 
Best practices fore MITRE EMERSON EDUARDO RODRIGUES
byEMERSON EDUARDO RODRIGUES
 
Mitre ATT&CK by Mattias Almeflo Nixu
byNixu Corporation
 
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
byMITRE - ATT&CKcon
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
State of ATT&CK
byAdam Pennington
 

More from MITRE ATT&CK

PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
PDF
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
PDF
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
PDF
ATT&CK From Basic Principles - Tareq AlKhatib
byMITRE ATT&CK
 
PDF
Lifecycle-Aware Power Side-Channel Malware Detection - Alexander Cathis
byMITRE ATT&CK
 
PDF
From ATT&CK to CL&IM: Cyber Insurance Data Modeling using MITRE ATT&CK and be...
byMITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
ATT&CK From Basic Principles - Tareq AlKhatib
byMITRE ATT&CK
 
Lifecycle-Aware Power Side-Channel Malware Detection - Alexander Cathis
byMITRE ATT&CK
 
From ATT&CK to CL&IM: Cyber Insurance Data Modeling using MITRE ATT&CK and be...
byMITRE ATT&CK
 

Recently uploaded

PDF
The year in review - MarvelClient in 2025
bypanagenda
 
PDF
Eredità digitale sugli smartphone: cosa resta di noi nei dispositivi mobili
bySpeck&Tech
 
PPTX
THIS IS CYBER SECURITY NOTES USED IN CLASS ON VARIOUS TOPICS USED IN CYBERSEC...
byMelissaGblinwon
 
PDF
Energy Storage Landscape Clean Energy Ministerial
bySurajitBanerjee38
 
PPTX
AI in Cybersecurity: Digital Defense by Yasir Naveed Riaz
byYasir Naveed Riaz
 
PDF
Decoding the DNA: The Digital Networks Act, the Open Internet, and IP interco...
byCSUC - Consorci de Serveis Universitaris de Catalunya
 
PDF
Day 5 - Red Team + Blue Team in the Cloud - 2nd Sight Lab Cloud Security Class
by2nd Sight Lab
 
PPTX
Cloud-and-AI-Platform-FY26-Partner-Playbook.pptx
byiuiuiuiu1
 
PPTX
DYNAMICALLY.pptx good for the teachers or students to do seminars and for tea...
bympoorvika031
 
DOCX
iRobot Post‑Mortem and Alternative Paths - Discussion Document for Boards and...
byDave Litwiller
 
PDF
The major tech developments for 2026 by Pluralsight, a research and training ...
byChris Skinner
 
PDF
Making Sense of Raster: From Bit Depth to Better Workflows
bySafe Software
 
PDF
Security Forum Sessions from Houston 2025 Event
byMark Simos
 
PDF
TrustArc Webinar - Looking Ahead: The 2026 Privacy Landscape
byTrustArc
 
PDF
Data Virtualization in Action: Scaling APIs and Apps with FME
bySafe Software
 
PDF
Internet_of_Things_IoT_for_Next_Generation_Smart_Systems_Utilizing.pdf
byRoshanSyed12
 
PDF
Unlocking the Power of Salesforce Architecture: Frameworks for Effective Solu...
byvarsha30tiwari
 
PPTX
Unit-4-ARTIFICIAL NEURAL NETWORKS.pptx ANN ppt Artificial neural network
byssuserd4481a
 
PDF
Usage Control for Process Discovery through a Trusted Execution Environment
byValerioGoretti
 
PPTX
Cybercrime in the Digital Age: Risks, Impact & Protection
byYasir Naveed Riaz
 
The year in review - MarvelClient in 2025
bypanagenda
 
Eredità digitale sugli smartphone: cosa resta di noi nei dispositivi mobili
bySpeck&Tech
 
THIS IS CYBER SECURITY NOTES USED IN CLASS ON VARIOUS TOPICS USED IN CYBERSEC...
byMelissaGblinwon
 
Energy Storage Landscape Clean Energy Ministerial
bySurajitBanerjee38
 
AI in Cybersecurity: Digital Defense by Yasir Naveed Riaz
byYasir Naveed Riaz
 
Decoding the DNA: The Digital Networks Act, the Open Internet, and IP interco...
byCSUC - Consorci de Serveis Universitaris de Catalunya
 
Day 5 - Red Team + Blue Team in the Cloud - 2nd Sight Lab Cloud Security Class
by2nd Sight Lab
 
Cloud-and-AI-Platform-FY26-Partner-Playbook.pptx
byiuiuiuiu1
 
DYNAMICALLY.pptx good for the teachers or students to do seminars and for tea...
bympoorvika031
 
iRobot Post‑Mortem and Alternative Paths - Discussion Document for Boards and...
byDave Litwiller
 
The major tech developments for 2026 by Pluralsight, a research and training ...
byChris Skinner
 
Making Sense of Raster: From Bit Depth to Better Workflows
bySafe Software
 
Security Forum Sessions from Houston 2025 Event
byMark Simos
 
TrustArc Webinar - Looking Ahead: The 2026 Privacy Landscape
byTrustArc
 
Data Virtualization in Action: Scaling APIs and Apps with FME
bySafe Software
 
Internet_of_Things_IoT_for_Next_Generation_Smart_Systems_Utilizing.pdf
byRoshanSyed12
 
Unlocking the Power of Salesforce Architecture: Frameworks for Effective Solu...
byvarsha30tiwari
 
Unit-4-ARTIFICIAL NEURAL NETWORKS.pptx ANN ppt Artificial neural network
byssuserd4481a
 
Usage Control for Process Discovery through a Trusted Execution Environment
byValerioGoretti
 
Cybercrime in the Digital Age: Risks, Impact & Protection
byYasir Naveed Riaz
 

The ATT&CK Philharmonic

  • 1.
  • 2.
    Disclaimer: All opinionsexpressed are those solely of the authors and do not represent the official views or opinions of Google Cloud & Siemplify.
  • 3.
    Ivan Ninichuck Freelancer ,Tech Writer, ATT&CK and Elastic things. Siemplify and Science Fiction. Andy Shepherd SOC, MSSP, PreSales, GCIH, used SOAR to get married, and other stuff ATT&CK Task Force Presenters
  • 4.
    The ATT&CK TaskForce Andrea Jendriskova Arnaud Loos Tal Reznikov Raja Ali Special thanks to all colleagues who also contributed ideas through various fun conversations!
  • 5.
    What do youimagine when you think of all your security data sources?
  • 7.
    How security feelswithout ATT&CK!
  • 8.
    ● ATT&CK bringsguidance, clarity and direction. The Framework is the sheet music that orchestra plays. ● TTPs, mitigations, groups, software and data components provide order to the chaos of information.
  • 9.
    ● Like anorchestra security data sources represent dozens of different groups ● Even if they all play the same song, does not mean they do it together ● An Orchestra still needs a Conductor
  • 10.
    Users, Analysts andManagement SOAR NSM EDR/XDR Email SIEM Authentication Cloud CTI Mobile IOT
  • 11.
    How can theuse of ATT&CK be automated?
  • 12.
    Data Components: Piecesof the Rosetta Stone Rosetta Stone from Egypt Rice University ATT&CK Matrices Security Events Data Components Detections ● Relationships in the ATT&CK Matrices can be used to automate investigation ● Data components make it possible to point automated queries directly at the data needed by analysts ● Time is the ultimate calculation of utility. By expanding known relationships in ATT&CK we can decrease the complexity of automation. During an incident complexity costs time more than any other factor.
  • 13.
    ATT&CK Workbench: AReady Made Workshop ● CTID Project: https://github.com/center-for-threat-informed-defense/attack-workbench- frontend ● Provides ability to manage, customize and share ATT&CK Stix Collections ● Perfect location to store additional data linked to our new Rosetta Stone ● Automation through built in REST API
  • 14.
    How can wediscover new ATT&CK relationships?
  • 15.
    SOAR and ATT&CK:What is SOAR Ingest Playbook Case View
  • 16.
    SOAR and ATT&CK:Alert enrichment Simple case level enrichment Woop?
  • 17.
    SOAR and ATT&CK:Case Grouping
  • 18.
    SOAR and ATT&CK:Map case to ATT&CK Auto grouped mapping to Mitre Woop!
  • 19.
    SOAR and ATT&CK:Case Grouping ATT&CK Where is this Tenant strong?
  • 20.
    SOAR and ATT&CK:Case Grouping ATT&CK
  • 21.
    SOAR and ATT&CK:Case Grouping ATT&CK Exploring concept
  • 22.
    SOAR and ATT&CK:Future? Exploring concept
  • 23.
    ATT&CK Sightings: Relationshipsto Build ● Multi-chained technique sightings ● Begin predicting what techniques are missing during cases ● Evaluate risk to observed technique chains ● Reduce the complexity for analysts to find where key data and management to make key decisions
  • 24.
    Alert -> Cases-> Sightings -> Action : Straw Poll With Sightings results, should SOAR….? ● Give a % against each technique ● Recap mitigations ● Give simple example search syntax to get started hunting ● Tell you what logs to look for (but then why wasn’t that alert found)