- So our next speakers in our afternoon session
are Ivan Ninichuck and Andy Shepherd from Siemplify.
So this proposal intrigued us with its musical metaphor,
and the idea of turning numerous data sources
into an orchestra.
Ivan's been our dedicated question asker,
and lightning talk speaker at ATT&CK in the past.
So great to see you here for a Main Track Talk.
So please give it up for Ivan and Andy.
(audience applauds)
- Okay. So first I do have to give a disclaimer.
All opinions and ideals are solely our own
and our particular small little team.
They don't exactly, they're not official views
or any timelines or anything for either
Siemplify or Google Cloud.
Andy, I'll let you introduce yourself.
- Yep. Hi guys, Andy Shepherd. Been in software
for a few years, which is why we're doing the talk today.
But like many of you, been in IT cyber for much longer.
There's not much more to say, really.
- Ivan Ninichuck, totally forgot to put my social media
out there, but I made it easy for everyone.
It's just my name everywhere.
So, just google my name you'll find it.
Freelancer, Tech Writer got hired by Siemplify
doing SOAR now.
So good times!
Now, one thing, no one works in a vacuum.
We basically came at Siemplify and we wanted to find out
what were the great ways of applying automation
to MITRE ATT&CK, how to get this done and so
what I did once I met this wonderful gentleman was
we put together a small team and I just wanna make sure that
they're all recognized in their contributions.
Okay. I started out almost at least a year ago or so.
And the first place that we started our discussion
was how do you see your data sets?
And I wanna share how I see the data sets
and how we see them.
We see them as an orchestra, all playing those
very well known symphonies
imagine something from Mozart or Beethoven playing
or Sikorski depending on what your favorites are,
but this is how security feels
when you don't have ATT&CK, right?
We all got that down.
ATT&CK brings the clarity, the order
and everything that the music does,
it gives us our notes and our language that we're speaking.
We'll get to that a little more.
But the problem is that when you have an orchestra,
even if you're all trying to play the same notes,
you're not necessarily gonna play 'em all at the same time.
If you get an orchestra, without a conductor,
then guess what happens?
Everyone plays a different part, at a different tempo
and a different key, and it's just noise.
And that's what we see data sets when they're not
being correlated properly when they're not
using ATT&CK to guide the investigations, things like that.
We see it as just noise happening.
And so SOAR really stands in the industry
in an interesting spot.
Obviously, it's been one of the kind of buzzwords,
maybe in the past, you heard," Hey, SOAR this SOAR that."
And we really wanted to address that and just put
the position of where it stands in our mind
with all the other tools that we work with and
how we see it really.
And so I actually did take a diagram of an orchestra
and then put all the tools out there,
'cause this is seriously how I see things,
when I've been listening to music and I literally see
the pianos are my fishing data, right?
Giving me my initial access.
The violins are my network and endpoint
and they're playing a certain tune
and now, I can see how the two
are interjecting each other and playing.
So now the question is, we got this idea of the orchestra.
We got this idea that ATT&CK a good thing
and provides this ability to orchestrate
but how do we automate this thing?
How do we actually make it usable on a day to day?
And this is where I have been ecstatic more
than ever by any ATT&CK thing
which was the data sources and data components.
- Yes.
- And what I began to realize was we really did
create literally the Rosetta Stone of security languages.
And I know I've heard this several times
in other presentations, this idea that it's a language
and we've been creating it and now we can use it.
Well, one thing is that I was investigating
the Rosetta Stone, for this presentation.
And one of the interesting things
about it was how it brought out biases
in the way that different scholars
approached ancient civilizations and how that brought out
different uses of the Rosetta Stone
and different conclusions.
I really began to see this correlation between
what we do with the ATT&CK, and how this works.
Now, how do I automate this thing?
Well, the cool thing is that because
I have these data components and because they're
in this language that's tied to these techniques
and the detections have these same techniques in them.
Now, I can start automating,
where am I going to take this investigation next?
Where do you need when you have a data component,
say about a Registry Key being created,
where else do I need to start looking?
Maybe I need to start following Olaf's suggestions
and start looking at user creation.
Maybe I need to start looking
say if an active directory data component comes up,
look at similar logs.
And these are the kind of things
that now we can start doing,
because I wanna present an ideal.
And the ideal is that time, is your utility in Secops.
And it has different cost based on when you're using it.
If you're using it, say during Detection Engineering Periods
or Threat Hunting Periods, time costs less
you have more time to do your job.
If you're that stock analyst on the day to day
and the incidents happening now, your time costs more.
It takes more resources it's burning people out more.
So we need to make sure that we're getting the results
when time costs less but during the periods,
when time costs more.
Now some of the tools that we started using to do this
and I really wanna give a shout out to CTID
I've been amazed at how much I've seen this grow over
the last couple years from when Richard came up
and announced it to where it is today,
just the amount of projects.
So, one thing we did was we needed a place
where we could start putting this information
and where we could start tweaking the framework.
And I hope you've all taken a look and if you haven't,
you can do so after this,
at the ATT&CK Workbench, because basically,
it allows you to work in naturally with the sticks objects
and be able to customize things, create your own relations.
It has an area for notes where you expand, it's very useful
and it has a REST API that comes with it.
So they literally did all the hard work for us.
(Ivan laughs)
And so we were able to use that REST API
to automate a lot of this interaction
and to automate the, keeping the collection sorted.
So now I'm gonna turn it over to Andy.
- Thank you very much.
Which one's the non laser?
Oh, top one.
- Yes. - Okay.
Okay. So just 30 second overview of SOAR.
I know it's a kind of new technology
that everyone's come across it yet.
Just one slide.
The point of SOAR and the kind of area I work in
is I can empathize quite well
'cause come from a stock background is we ingest alerts
whether that's through Seam Technology directly
whether it's via case management
whether phone, call, email, that kind of thing
we bring it in and we basically normalize it.
We pass it through a playbook.
The playbook can be anything, it can do anything.
It will talk to the rest of your kit
and it will do asset lookups, threat lookups,
historical data lookups, et cetera.
And then finally, on the right hand side,
we present you a case view.
So the idea is instead of logging in and seeing
a Log Line and this is what I'm gonna do
for the next 40 seconds of copy paste Tab on Tab.
Here is a colorful populated executive report
for an analyst to say, right?
I understand the case.
I understand all the relations,
all the context, let's go straight to the decision making.
So with a even quicker than an elevator pitch on
what SOAR is, how do we start using MITRE?
So really, I suppose for me,
my five or six minutes of fame today here on the stage
is to say, thanks to MITRE team.
I love ATT&CK.
I love what it does,
but also a bit of a thank you to all vendors
that actually put the ATT&CK codes in
because that's what I want to look at today
is how are we consuming alerts
and turning that into something useful, really?
So the first thing we do, quite standard really,
is a simple case Level Enrichment.
So on the left, our alert had the MITRE code in
and on the right let's give the analyst
a nice, pretty version of the mitigations,
the explanation, here's a Hard link
so you can start pivoting and searching.
So for me, this is quite simple.
I come through this a whoop Question Mark, it's kind of cool
but I think where it gets a little bit more exciting is
where we look at the way
that different technologies do Case Grouping.
And for us, that's basically many ways if we do it
but one of those ways is looking at the entities.
So in this case, on the left,
we actually have the Explorer View of a particular case.
And in this case, without going too much into the details,
we had three alerts on the right.
The first one is an Out of Hours Log On
for one of the users.
So logging in at a suspicious time.
The second one was actually a Network Protocol Violation.
So someone's trying to use IRC or someone is using IRC.
The third one was a Malware Alert.
So something, but like an AV, it could be a DLP.
It could be IPS, it could be a phone call.
It could be absolutely anything.
But as those alerts come to a SOAR platform
what we can start to look at those and say, well,
actually they've all got a bit in common.
Maybe this is a story, a case.
So, and on the round side,
we can see that each one of those alerts
has an ATT&CK ID, which is fantastic.
But even if we have to add that by hand, it still works.
If we then go and do enrichments and add it later on,
it still works.
But like I said, in the ideal world,
I'd like to see every alert with an ATT&CK ID
and that really helps with what we do next.
So the first thing we basically put in at the POC level
a while ago was mapping that to the Framework,
because if we are now automatically grouping all the alerts
and when analyst comes in grabs coffee
it's like, "Good morning," sits down
they open the first case straight away.
They can see that, that kind of dynamic alignment to
the Framework.
So straight off, what have we detected?
If the detections come to us,
then actually that's not that bad because we spotted it.
So we'll rate that as an Amber.
If in this case, we don't have the detection,
that's gonna be a red.
And if it's after the latest detection
then it may not have happened.
So we'll leave that as an undetected.
So this was the first thing we put in.
So the first thing you do, you open a case," Ah, okay.
I can understand where we are, where we are blind
maybe where I want to go practically hunting next."
What we then started to do was take that a bit stronger
by actually starting to put,
where do you think your environment is strong?
Where do you think your mitigations are?
Obviously no, mitigation is always a 100%,
we have to play it safe.
So in this case, we could configure an environment to say,
this is where we think we're mitigated.
And then the next thing was to take the last image
that the kind of very high level
and start actually making look a little bit more like a tax,
so people are a bit more familiar with it,
filling out the columns
probably needs a little bit more CSS,
needs to be a little bit shinier, but there, you can see
that in this particular case, we had all the different IDs.
And so we're mapping that in.
So again, as the analyst comes in,
I can see not only where we've found the visibility,
but where we've had the visibility
and we think we've got mitigations in play.
So that was one of the next things we did.
Now at this point, I started to think,
wouldn't it be really good if we could start to
not predict where those spots are
where we've not had the visibility, but maybe there's a
a machine learning way to look at
the most likely place to start searching.
And I had started having a chat with Ivan.
He said, "Have you not heard of MITRE Sightings?"
I was like, "No, I have not."
So we started looking into that
and it is absolutely a perfect fit.
So what we're doing there, and this is, as Ivan said,
"This is not a roadmap."
This is just a concept we're kind of playing with now.
So big shout out to MITRE
for all the new things we're doing.
But here's a way to basically say right here
are all the different campaigns.
Here's all the sightings of ATT&CK IDs together.
So here we can see we've got two campaigns listed
and then comparing what we have found against that.
So in this case, just using the sample data we found on
I think is the GitHub page.
We can see that the ABC 9, 8, 7 had one out of two hits
and we can start to see that.
And then maybe the DT 1, 2, 3, 4 had none outta three hits.
So as that data set gets bigger,
as we're dynamically pulling that in, we can start to
as you hover over them, coloring all the red spots
of maybe where you want to go hunting.
So I think that'd be a great one.
Obviously as the data set gets bigger
we can start to make more value out of that.
And then really to close that off and again,
this is just something we're playing with
is the, basically the Feedback Loop.
So we consume the data, we apply it to all the cases
as they come in, as they're grouped,
as we present it to the analyst.
But then when we go to close the case,
we are gonna assume that
that is the maximum visibility you've got.
So maybe there's a level of sanitization.
Maybe we can push it back
and then maybe that feeds back into the circle.
So hopefully one day in the future
we could be here showing you that working in action
if we can get that into the Devs
and get the company in with that.
So that's something we're playing with, but yeah
just like to show you where we're going with it
and how I think it can be really useful.
Thank you very much.
(audience clapping)
- I gotta say this was one of our favorite submissions
just 'cause the creativity
and how much went into the theme of this.
So thank you so much.
I think we have time for one question,
and I'm really, I had it on the tip of my tongue,
the entire talk and you addressed it towards the end
- Yeah.
- but one of the things we've seen is really important
with exactly, as you said with enrichments
and kind of exactly what you were highlighting
the problem of keeping all the instruments in the orchestra
in tune and aligned how, you know,
like closing that feedback loop,
what any advice there in terms of
other particular questions, is it side sidling
your analyst to see how they respond to things,
or how does one really make sure that
we were pushing something and this is kind of
the visualization and we expect that
we really are tuning that over time.
- I'll take that.
I really think it comes down to
what's been brought up before which is you wanna start
thinking about things, risk based to your environment.
One thing I'm really big about
is looking at what you're detecting,
what you might not be detecting,
compared to say what vulnerabilities you might have
in your environment,
making sure you have your asset of inventories
and then being able to make those risk
or suggestions when you're trying to triage
and when you're trying to do those things.
So that's my biggest, is know your environment,
know what tools you have and then find the gaps
where you may not have the coverage
but make sure that you're looking
at that vulnerability, that asset inventory.
Because if in the end,
if you're not making decisions based on your risk,
then you're not making decisions for your own company
or whoever you're servicing,
you're just making random decisions
and that's a bad thing.
(all laughs)
- Yeah. Random can go very wrong.
Thank you.