You're reading from Aligning Security Operations with the MITRE ATT&CK Framework

Product type Book

Published in May 2023

Publisher Packt

ISBN-13 9781804614266

Pages 192 pages

Edition 1st Edition

Languages

Concepts

Cybersecurity

Author (1):

Rebecca Blair

Table of Contents (18) Chapters

Preface

1. Part 1 – The Basics: SOC and ATT&CK, Two Worlds in a Delicate Balance

2. Chapter 1: SOC Basics – Structure, Personnel, Coverage, and Tools

3. Chapter 2: Analyzing Your Environment for Potential Pitfalls

4. Chapter 3: Reviewing Different Threat Models

5. Chapter 4: What Is the ATT&CK Framework?

6. Part 2 – Detection Improvements and Alignment with ATT&CK

7. Chapter 5: A Deep Dive into the ATT&CK Framework

8. Chapter 6: Strategies to Map to ATT&CK

9. Chapter 7: Common Mistakes with Implementation

10. Chapter 8: Return on Investment Detections

11. Part 3 – Continuous Improvement and Innovation

12. Chapter 9: What Happens After an Alert is Triggered?

13. Chapter 10: Validating Any Mappings and Detections

14. Chapter 11: Implementing ATT&CK in All Parts of Your SOC

15. Chapter 12: What’s Next? Areas for Innovation in Your SOC

16. Index

Why subscribe?

17. Other Books You May Enjoy

Red and blue make purple – how to run purple team exercises

Purple teaming, as mentioned in Chapter 1, can be an important exercise in the SOC to test detections. On the other hand, it helps prove the negative or, in general, where risks can be identified. In this section, we’re going to work through some possibilities for using purple team exercises and talk through some common open source tools that can be critically helpful in running successful purple teams.

The first step to setting up a purple team is identifying the purpose and scope. In some cases, the purpose could be to evaluate a new tool such as a SIEM tool or an EDR platform; in other cases, it could be to test the response to a potential incident, train new team members, or prove where your gaps are. This should be planned out in advance of any engagement with a red team engineer, or whoever will be conducting the red team portion of the engagement. The next step would be to determine what tools will...