What Happens After an Alert is Triggered?

Once an alert is triggered, a set of actions begins in theory. This chapter will discuss the different sets of actions, how to create playbooks, and to ultimately triage alerts, and examples of poorly created detections and their consequences. These are practical examples that can immediately be applied to your environments if they aren’t already. This chapter shows off a variety of strategies for actions that can be taken and for creating playbooks.

This chapter will look at the following topics:

• What’s next? Example playbooks and how to create them
• Templates for playbooks and best practices

Technical requirements

For this specific chapter, there are no installations or specific technologies that are required.

What’s next? Example playbooks and how to create them

As alerts come into the security operations center (SOC), you need to find a way to streamline triage and have it done in a repeatable format. By doing so, you’ll be able to scale your team because any member can follow a pre-determined set of steps to triage. That set of steps is what is known as a playbook. There are many different formats for playbooks, such as flowcharts and bulleted/numbered lists, and we can use tools to create playbooks with a native language or Python. We'll look at a few different options in this section.

Before we can even create a playbook, we must ensure we have repeatable detection types. This might mean that you have to break down a detection to be more specific rather than general or need to establish at least a few steps of what could be normal. It helps to have a senior analyst work with a junior analyst to determine the triage steps. The senior analyst will have insights on...

Templates for playbooks and best practices

As mentioned, there are a few different ways to create playbooks in a list, flowchart, and automated fashion. The first rough template I’ll show is for ransomware. The first format is for ransomware that was found using an endpoint detection and response (EDR) tool in a list format:

1. An alert is triggered via an EDR tool (Carbon Black, Crowdstrike, Sentinel One, and so on).
2. Does the tool that triggered the alert have the ability to quarantine? If so, quarantine the system. If not, access a tool that does and quarantine the system. Coordinate with the IT team to possibly block the system via your master data management (MDM) tool, Jamf.
3. Open an incident response ticket with the preliminary information on the incident response (IR) board and establish a timeline.
4. Work with the IT team to determine whether any other Toast systems have been affected.
5. Set up a C2 comms channel in Slack or Teams, inviting your security...

Summary

Automating alert triage is a logical step in advancing your SOC environment and allows you to cover more alerts and actions. It will also lead to a faster time to detection, which will help you achieve better metrics and can make a major difference in identifying and responding to an incident. You can use the flowcharts, templates, and examples from this chapter and find others to quickly expand your SOC’s capabilities and make it more scalable.

From this chapter, you should have picked up skills on creating and implementing playbooks and will be able to immediately implement these skills in your environment to help make it more efficient.

In the next chapter, we’ll cover implementing different controls to cover for the MITRE ATT&CK framework in both your SOC environment as well as for functions of other teams, such as the network operation center (NOC), and mappings to compliance frameworks.