Validating Any Mappings and Detections

The most important step you can take to help yourself with creating mappings and good detections is by setting up a review process. This can be completed manually, or you can create an automated feedback loop to track the efficiency ratings of your mappings and make improvements when necessary. Whether this is necessary will be dependent on the fields that are captured when an alert is closed, such as Value Added, Closed State, and so on.

This chapter will cover the following topics:

• Discussing the importance of reviews
• Saving time and automating reviews with examples
• Turning alert triage feedback into something actionable

Technical requirements

For this specific chapter, no installations or specific technologies are required.

Discussing the importance of reviews

What is the purpose of implementing controls and detections without validating that they work in the first place and fill a need for your organization? In theory, you would only implement detections that fill needs such as mitigating risks from your risk registry and helping close visibility gaps, but sometimes it might just be about getting a quick win through tuning or trying to find the easiest detection to implement. Therefore, as mentioned in previous chapters, having a review system and feedback loop for systems is essential to ensure efficiency for both detections and your team as a whole.

To establish efficiency, you need to start with proper roles and responsibilities, which sounds simple but is a task that I still struggle with, due to ever-moving targets and tasks within the security field. You can start with a team charter, creating a vision for the team and a mission statement that helps identify the scope of the overall team. From...

Saving time and automating reviews with examples

As mentioned, every security team should be looking to automate as much as possible to get more done efficiently and effectively, and reviews are no different. One way I recommend teams automate the review and feedback portion of alerts is by utilizing a two-way API with our case management tool, Jira. This starts with alerts that are triggered to automatically create tickets, which would look like this in Jira:

Figure 10.1 – A Jira ticket from a Splunk integration

On the preceding ticket, you can see the Closed State field—a ticket would be closed if it were False Positive, Benign Unexpected, Benign Expected, Suspicious, Malicious, or Other. Then, you see the Alert Status field, which can be either Open, In Progress, or Closed. The next field is Value Added, which would be a value inserted when the ticket is closed of either No, High, or Low, and we’ll go into this in more detail in...

Turning alert triage feedback into something actionable

There is no point in collecting feedback unless you plan to drive action from it or are using it to gauge a response for a current action that has already been implemented. I recommend using Value Added, Closed State, and other fields such as Labels to both provide insight and try to drive/prioritize actions. One way to do that is to create dashboards within Jira, such as in the following example:

Figure 10.4 – Jira dashboard

As you can see from this screenshot, we have a very basic dashboard that has been created for a Jira project. This shows all activity on the board in the upper-right section, a pie chart based on Value Added for alerts in the upper-left section, and all current tickets in the bottom-left corner. To create a dashboard, you would start by creating a filter, like so:

Figure 10.5 – Jira filter

You would first click the Filter tab up top...

Summary

Feedback on all aspects of projects is important, and feedback on the value and ratings of alerts is no different. If we aren’t capturing that information, then we’ll never be able to properly understand our risks when it comes to detection, and could have a false sense of security. Just as with responses, we want to continue down the path of automating as much as possible in an effort to get a core understanding of our successful detections and of ones that might need a little bit of help. Understanding that will allow us to have a more operational team and help assist you in becoming more scalable. From this chapter, you should be able to critically look at your triage process and identify additional actions, such as steps that can be automated to assist with your triage process, and you should be able to add other fields to capture data during triage that can be used to drive actions.

In the next chapter, we’ll discuss how to narrow down which alerts...