You're reading from Aligning Security Operations with the MITRE ATT&CK Framework

Product type Book

Published in May 2023

Publisher Packt

ISBN-13 9781804614266

Pages 192 pages

Edition 1st Edition

Languages

Concepts

Cybersecurity

Author (1):

Rebecca Blair

Table of Contents (18) Chapters

Preface

1. Part 1 – The Basics: SOC and ATT&CK, Two Worlds in a Delicate Balance

2. Chapter 1: SOC Basics – Structure, Personnel, Coverage, and Tools

3. Chapter 2: Analyzing Your Environment for Potential Pitfalls

4. Chapter 3: Reviewing Different Threat Models

5. Chapter 4: What Is the ATT&CK Framework?

6. Part 2 – Detection Improvements and Alignment with ATT&CK

7. Chapter 5: A Deep Dive into the ATT&CK Framework

8. Chapter 6: Strategies to Map to ATT&CK

9. Chapter 7: Common Mistakes with Implementation

10. Chapter 8: Return on Investment Detections

11. Part 3 – Continuous Improvement and Innovation

12. Chapter 9: What Happens After an Alert is Triggered?

13. Chapter 10: Validating Any Mappings and Detections

14. Chapter 11: Implementing ATT&CK in All Parts of Your SOC

15. Chapter 12: What’s Next? Areas for Innovation in Your SOC

16. Index

Why subscribe?

17. Other Books You May Enjoy

Saving time and automating reviews with examples

As mentioned, every security team should be looking to automate as much as possible to get more done efficiently and effectively, and reviews are no different. One way I recommend teams automate the review and feedback portion of alerts is by utilizing a two-way API with our case management tool, Jira. This starts with alerts that are triggered to automatically create tickets, which would look like this in Jira:

Figure 10.1 – A Jira ticket from a Splunk integration

On the preceding ticket, you can see the Closed State field—a ticket would be closed if it were False Positive, Benign Unexpected, Benign Expected, Suspicious, Malicious, or Other. Then, you see the Alert Status field, which can be either Open, In Progress, or Closed. The next field is Value Added, which would be a value inserted when the ticket is closed of either No, High, or Low, and we’ll go into this in more detail in...