Patterns of Collaboration in Enterprise SOC’s

Patterns of Collaboration in Enterprise SOC’s

Overview

As we continue building out our SOC Content Platform working with our enterprise design partners, we have had many conversations with analysts in SOC’s.  In this process, we have had many learnings on the key personas, their tasks and their challenges in addressing the mission of detecting and responding to cyber attacks within the enterprise. Most importantly, we have been impressed with how they collaborate together in addressing those challenges towards achieving the detection outcomes of threat relevance(are we looking for the right threats?) and high detection efficacy(are we meeting the high TP, low FP and low FN requirements?). 

Persona's

1.     Threat Analyst/Threat Operations/Adversary Research 

a.     Tasks. They research adversaries, their tactics, techniques and procedures, and track their evolution. They analyze research reports, and follow various threat intel sources, and stay on top of threat activity observed in the enterprise. In some orgs, Cyber Threat Intel (CTI) teams use Threat Intel platforms for this purpose. 

b.     Deliverable. They create use cases(“hypothesis”) for adversary detection for the threat detection content team. The use cases clearly specify the behaviors that the detection team must detect. Behaviors are more useful to look for than IOC’s which have a short shelf time. They may also specify as a detection target that are not just procedures but also an entire attack that is a sequence of threat procedures. 

2.     Detection Analytics/Threat Hunting 

a.     Tasks: They develop the detection content for detecting the behaviors specified by the Threat intel/adversary research team. They recreate the threat procedures as indicated in the use cases, collect the required events that log the threat behaviors including endpoint, network and cloud logs. 

b.     Deliverable. They craft the correlation search to detect the specific behavior. This is a complex process – the key is to maximize true positive detections (and reducing false positives) while minimizing false negatives. This is where statistical searches, correlations, and ML techniques are deployed for the detection. The detection analyst also offers guidance to the IR/Triage Analyst on what to do after an alert is generated from the detection. 

3.     IR/Triage Analyst

a.     Tasks: This persona consumes the detection content generated by the Detection engineering team, deploys the detection content, and reviews the alerts being generated. 

b.     Challenges. They usually notice many false positives in the early iterations of the detection logic. This may require changes in the detection logic, require additional baselines to safe list known good activity, and also require additional use of safelists and blocklists to refine the search. 

Collaboration Patterns

We observed the following patterns of collaborations between these personals to meet the mission outcomes of threat relevance and high efficacy.  Where collaboration is fluid and friction-less, continuous improvement is enabled where analysts spent more time in search development and refinement and less tine in chasing alert false positives. 

1.Use Case Refinement During Detection Development. During this process, the Detection Analyst works closely with Threat Analysts to refine the use cases and bring to attention the available log sources that can be used in crafting the detection. They inform the Threat Analyst team of the tradeoffs between detection scope, accuracy and the risk of false positives. The MITRE ATT&CK (https://attack.mitre.org/) framework is an important part of the collaborations workflow

2. Analyst Feedback for Efficacy Improvement. The IR/Triage Analyst can offer feedback to the Detection Analyst to improve the search. As the IR Analyst get new drafts of the detection content, she can compare the results with the previous searches, and offer feedback on accuracy improvements. This can be challenging as the people triaging alerts may not be the author of the detection logic. Developing high efficacy analytics remains an art,  and takes quite a few iterations working with the IR Analyst and Threat Analyst in getting this right. 

3. That Intel from Adversary Observables During Alert Review. The IR Analyst can inform the threat intel about true positive alerts observed, and what indications (e.g. behavioral, signatures)  they offer about adversary tradecraft. 

In future blogs, we will offer specific examples of collaboration that has led to better outcomes.  We hope you found this useful, and stay tuned for more. 

Enterprise SOC collaboration is a MUST!

Enterprises tend to work in silos. That's because security groups are guarded about their data and their methods, for good reason. However, in order to significantly improve our detection (and hence mitigation) game, we need to know more about attacks & breaches. Collaborating with peers in the industry will help understand trending attacks, obtain detection & mitigation plans that actually work, get access to best practices and exchange actual code to implement in their SIEMs (or other run-time environments). Such collaboration has to be secure, selective and result in exchange of implementable instructions, preferably code.

The best collaboration that has happened thus far in security operations has been the ISAC - however, participants will agree that it has degenerated to simply becoming a mailing list of noisy IOCs sent to 1000's of recipients with no clear instructions on how to detect & mitigate. This is not materially useful.

The level of enterprise SOC collaboration must evolve significantly to contain implementation-ready instructions and code, with enriching analytics to provide context and guidance, and must be easy to use with targeted sharing amongst trusted groups. The most common questions we get from CISOs who are willing to share detection logic are:

1. What are we sharing?
2. With whom are we sharing?
3. How are we sharing?

The platform that provides simple, usable and elegant answers (and actually implements it!) will win.

Being a SOC Content Platform

From the perspective of a SOC manager, a primary challenge always is developing and implementing the right content (= logic in the form of rules or more advanced code) that the organization needs. An average enterprise doesn't always have the luxury of threat researchers, content authors/developers and analysts to triage/investigate/remediate. Therefore, having quick access to the best content that is suited for your enterprise needs is key to a SOC's success. Such content must also be of the highest efficacy such that downstream actions such as automation/orchestration can be performed more predictably and with simpler playbooks.

Imagine if your SOC had access to a streaming content service from which an analyst can pull desired content, vis-a-vis threat priority frameworks such as MITRE ATT&CK, as well as receives recommendations for content that you must implement based on current industry trends, peer activity, available data sources and other influencing attributes of the cyber-security world. And imagine if this content is readily deployable, in SIEM format of choice, in your SIEM with minimal to no coding or scripting necessary. Wouldn't that fundamentally shift the SOC into higher gear and enable better detection and hence better rates of automation downstream? Not to mention the problem of not having to deal with "skills shortage", and dramatic reduction in costs.

This is how SOC tools, especially SIEMs, must evolve. They cannot continue to remain data collectors and run-time engines for simple rules with heavy dependence and onus on humans. That world is coming, and it will be cloud-powered.