Operationalizing the MITRE Att&ck framework for Security Operations, Threat Hunting and DFIR
with commercial and non-commercial products and tools from IBM, Recorded Future, Carbon Black, A10 Networks, Google Rekall, Volatility and more . . .
Cyber attackers are constantly becoming more and more subtle while Security Operations (SOC, CERT and CSIRT) continues to scratch on the surface. It doesn’t matter whether that’s a large enterprise, bank or government institution. The evidence is fairly strong that most organizations are pretty bad at security operations . Why are there so many global high-profile breaches? Why can organizations today not adequately detect and respond to breaches while they have spent millions in their Cyber Security defense? You don’t have to be a genius to figure out that there must be vital gaps in the defense ecosystem of organizations. But how to identify these gaps and what course of actions are required?
How to classify, categorize and organize attack scenarios holistically?
5-Day Training Class
with commercial and non-commercial products and tools from IBM, Recorded Future, Carbon Black, A10 Networks, Google Rekall, Volatility and more . . .
This class is about Incident Response in a post-compromised environment.
In this class we will show you the major reasons why Security Operations is currently doing bad and what is required within Security Operations in order to produce high value results that can be consumed by a Threat Hunting and Forensic team. We will also focus on how to streamline security analysis, starting off with the initial triage within Security Operations to Threat Hunting to Forensics in case of an advanced targeted attack by quickly forming up a defense team that is able to collaborate directly from within IBM Resilient as the central hub for Incident Response.
The goal is to rapidly identify and respond to advanced adversaries that have gained a foothold in a compromised environment (post-compromise). The initial triage will be conducted by the Security Operations team (L1) which will hand-off valuable results to the Threat Hunting team (L2) which will in turn produce results that will be consumed by the DFIR team (L3) for a deep dive forensic analysis focusing on a few affected systems out of hundreds or thousands of systems... Read more
Target audience:
Cyber security practitioners or Consultants of Security Operations, Threat Hunting and DFIR teams.
Training class dates:
2nd-6th of September 2019
11th-15th November 2019
13th-17th January 2020
Latest Blog feeds
Resilient Playbook and automated actions for Threat Hunting and DFIR
Some initial triage task instructions are listed under the Stage 1 Analysis phase of the incident which are processed by the Security Operations team. Once completed, the incident is handed off to the Threat Hunting team for scoping the attack and developing further intelligence. As you can see, all the TTP task instructions regarding APT28 have been loaded into the Stage 2 Analysis phase of this playbook...
Continue ReadingThreat Hunting – a relatively new discipline in Cyber defense
The idea behind Threat Hunting is to shift from a reactive IR model to a proactive approach. In Security Operations, a detection team hands off an alert to an Incident Response team which validates the incident and responds to it in case it’s a true incident. The goal with Threat Hunting is to proactively engage a team and hunt for known adversaries including their applied TTPs in an organization’s networked computing environment...
Continue Reading