Hunting Adversaries with Investigation Playbooks & OpenCNA

Name: Hunting Adversaries with Investigation Playbooks & OpenCNA
Uploaded: 2017-09-17
Duration: 29 min 48 s
Description: BSides Augusta 2017 Ismael Valenzuela (@aboutsecurity) Hunting Adversaries with Investigation Playbooks & OpenCNA As SOCs mature and start to formalize their operations, they typically focus on preparedness, escalation process and incident response plans. However, even with these plans in place, S

BSides Augusta · 201729:48313 viewsPublished 2017-09Watch on YouTube ↗

Speakers

Ismael Valenzuela

Tags

StyleTalk

About this talk

BSides Augusta 2017 Ismael Valenzuela (@aboutsecurity) Hunting Adversaries with Investigation Playbooks & OpenCNA As SOCs mature and start to formalize their operations, they typically focus on preparedness, escalation process and incident response plans. However, even with these plans in place, SOCs report that 25% of the alerts are not triaged and that investigations take too long. Why so? In many cases, this can be attributed to the lack of a standardized investigation process and community wide tools that can be applied consistently & repeatedly over time, preventing less experienced analysts and incident responders from doing their job effectively.

Show transcript [en]

[Applause]

[Music]

[Music] yes [Music]

[Music]

[Music] parts right

all right

[Music]

right this is me at 4:00 p.m. when I get a hundred feet

[Music]

first of all

[Music]

this is of course to be able to kind of maintain level three friends and I have them all the time so we're not one of these [ __ ] that between this right you see something is like a normal business this is a loser

[Music]

[Music] that change the whole game right but you need context and you need to have some way of trying to take that bias away from you so we're going to do a little experiment here really quickly we're going to watch video you may have watched this video before right I don't know may we'll see and your goal watching this video it's to count the number of passes from the white shirts all right so pay attention

all right so how many how many passes from the players in the white shirt anyone knows let's say anyone counted less than actually the correct number of passes it's 16 right so this is how well let's watch it again right and now you're going to see the gorilla and now you're going to see the curtains change in color and you're going to see the black player leaving leave in the room right

so notice that starts with the curtains in in red

the other senator gordly Carson's right and that was only two players on the black shirt so that happens when you're in

[Music]

my property rights conference this is how my family offices

[Music]

this

[Music]

Brenda confirm peonies

he's changed that's possession most useful news NSA this question is answered by this

[Music]

and it's giving soon our developer right so you goal so this ends here you can now program used to check the quality of your code so essentially to say we have made repeated questions across my my investigation police you can use these so this is a manager support so you may be saying in a question Chinese season you know of course we would say host so you want to be consistent across the board you can define the state's useful names

[Music]

questions right - we have duties yeah practice but practical time analysis

Hunting Adversaries with Investigation Playbooks & OpenCNA

Related talks