- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
So there you are, at your desk, daydreaming (about not being at your desk perhaps), when it hits your inbox.
An email, from an internal employee, asking you to do something that is clearly Phishy.
Since you’re a finely tuned Security Professional, you immediately recognize this for what it is. Looking around at your colleagues, a few are right there with you, while a few others are reading the email with a slight head tilt, and catch on a few moments later.
This employee, henceforth known as 'Mike', has had their account compromised, and being that Mike is rather unimportant, the attacker is casting a wider net in hopes of landing a bigger prize.
Mike’s email is asking for his co-workers to click a link, login, and update their contact information as it’s bonus season! To make it worse everyone trusts Mike, he’s adorable, so we might have a problem here.
Let’s read as this scenario plays out shall we?
You: “We need to contain this! Can we start with blocking that url?”
Team: “Absolutely!”
You: “How do we do that?”
Team: “No idea! Let’s call Bob the Firewall Guy!”
Bob the Firewall Guy: “Of course I can block it, but I’ll need a change request.”
Insert 2 hours of paperwork, an ad hoc implementation, test, and backout plans, and pleading with the Aileen the Change Manager to approve the Emergency Change.
Bob the Firewall Guy: “Ok we’re done, it’s blocked!”
Everyone cheers! Sally tests it, and…
Sally: “Uh Bob the Firewall Guy? It’s not being blocked?.”
Bob the Firewall Guy: “Whoops, ok I think I know what I did wrong, never fear, I got this!”
Aileen the Change Manager: “You’ll need a new change for that!”
Everyone glares.
You: “While Bob the Firewall Guy works his magic, can we get these emails out of people's inboxes as well?”
Team: “Absolutely!”
You: “How do we do that?”
Team: “No idea!”
You:
8 hours later, you and the team lock this one down, after:
Did we make this all up, or are we reliving past traumas? We’ll let you argue that like the ending to the movie Inception.
If the situation above resonates with you, we’re sorry, but the real point of this is to show where Cortex XSOAR can help you to tame the chaos!
Imagine the same scenario, but as a finely tuned Security Professional you have used Cortex XSOAR to respond to the same Incident by:
Blocking the IOCs by running a playbook that adds the Domain and URL to XSOARs indicator database. The playbook then uses the Generic Indicator Export Service integration to add them to external dynamic lists that your Next-Gen Firewall uses for blocking.
And this time it works flawlessly because you and Bob the Firewall Guy built and tested it ahead of time for just this kind of situation! You even made Aileen the Change Manager happy by having the playbook create a Standard Change in ServiceNow as part of its run!
Searching for and deleting the emails sent by the Attacker from Mike’s account, by once again kicking off a playbook and removing them before most employees even noticed they were there.
Resetting the passwords for Mike and Joe (the only other employee that clicked the link in the time it took you to do the above two actions) and emailing their Managers their new passwords.
And more importantly, perhaps this event never even happened, because you setup Cortex XSOAR to ingest the alert that you missed in the first place! The playbook evaluated the alert, determined the IOCs to be malicious, and already took corrective action ahead of time!
We hope you enjoyed our story!
Whether you’re just starting your Security Automation journey or are a finely tuned Security Professional who is well down the path; know that
Cortex XSOAR offers a myriad of use cases to help you tame the chaos!
Cortex XSOAR is most effective when used to:
If you’ve read this far, we’ll leave you with a potential picture of what this could look like in your organization, in the event you have a Mike who rains chaos down on your daydreams!
Imagine playbooks for responding to our most important alerts, or for quickly implementing our most common workflows, leaving no question as to what to do when you need to do it!
You can find more information about the above picture in our Case Management with XSOAR Webinar.
For more information on working with XSOAR, check out our XSOAR Engineer Training series as well!
Fin.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Subject | Likes |
---|---|
3 Likes | |
3 Likes | |
3 Likes | |
2 Likes | |
2 Likes |
User | Likes Count |
---|---|
10 | |
4 | |
3 | |
2 | |
2 |