Thomas Los’ Post

Transcript

Hi, my name is Tom Los and I'm a Principal Systems Architect here at Strike Ready. As the volume of security incidents increases, so too do the number of indicators that need to be extracted, analyzed, and enriched across a wide variety of sources. This is often a very painful and time-consuming process that involves plenty of consoles, reputation services, sandboxes, and multiple browser tabs. Today, I'm going to show you how to simplify your life by doing this in Strike Ready. Let's get started. I'm going to start off in an EDR investigation that has landed inside of my queue. I need to get to work on this and there's quite a bit of artifacts and information that I have to dig through. So I'm going to highlight all of the artifacts that are a part of this case. There are domains, IP, fours, SHAZ and a URL. So what what I can see is the platform has already gone out and confirmed the hashes as malicious and now I see that there's a URL and a domain that are both the same that I need to go out and do some further digging on. It's telling me that this URL could be suspicious and So what I want to do is I want to take a look at the details and the reason of why this is suspicious. I can drop over to that indicator in question, scroll through all of the 23 pre licensed, pre curated and enabled analysis engines that are inside of strike ready and see that 2 engines have come back with this as being either malicious or clean. And So what that means is I need to do some further digging as to what this indicator actually is. It may be a spear phishing URL. And so I can go back and I'm going to want to go ahead and drop into the SAN browser. This is the pre licensed and already included SAN browser that lives inside of strike writing. It's going to open up a fully functioning VM that I can go ahead and begin to interact with this page and see what I'm actually working with here. I can take screenshots, attach this to my case, and have this as evidence. And I can do this all in one place inside of the case view. And So what I'm going to want to do is I'm going to want to take this indicator and drop this onto my technology stack and deploy this as a block rule. I can navigate over to the Actions tab and go to deploy. Pick my domain, which is the artifact in question. Pick the zone that I want to go ahead and deploy this technology on, and I'm going to want this on all of my whole text stack that I have both on Sentinel, on Defender and 365. I'm going to hit next. And I'm going to your fishing block. And the same thing in our description. I'm going to hit proceed, which is then now going to have our platform go out to that text stack and deploy that as a mitigating block rule. And now I'm going to want to go and validate. Did that actually go out and block just to make sure that it did exactly what I asked it to do. I can go back to details, click on our Deployments tab, which is going to have the platform go out and tell you exactly where you have deployed this indicator. And so I can see that I had asked this to be deployed. It's been deployed, and now it's inside of my control stack. And I could do all of this from inside of the same window, not having to pivot anywhere. I'd love to walk you through this and more, so please feel free to book a demo by using the link on our homepage. Thank you very much.