About jennaqualls

    Authored By: Samuel Lee @SamuelLee    We’ve just launched Cloud NGFW for Azure to strengthen security for applications running on Azure while streamlining network security operations. This fully managed, Azure-native, next-generation firewall service is built to better protect cloud-native and migrated applications with the industry’s only AI and ML-powered next-generation firewall technology.    The Rise in Cloud Adoption and Its Drivers   Here’s the context: Over the past few years, cloud adoption has been steadily on the rise, revolutionizing and reinventing the way organizations drive their businesses. To stay ahead of the competition, organizations are looking for agility and scalability in product development and processes. What’s more, cloud adoption frees up valuable resources to focus on rapid application innovation that delivers business value.    To realize the potential of cloud-driven productivity, cost savings, and competitiveness, organizations leverage hybrid and multi-cloud strategies to automate infrastructure management and deployments. Getting to these benefits is one thing. Safeguarding it is another.    Three Key Challenges of Securing Cloud Deployments   Minimizing risk is critical as data centers become virtualized and applications are developed in the cloud — or migrated to the cloud. According to the 2021 Thales Data Threat Report, almost half (45%) of US companies suffered a data breach in the past year, and those worrisome numbers continue to grow.    Those findings confirm what our customers tell us — that they struggle to adequately secure their Azure deployments against advanced cyber threats in a way that seamlessly fits into how their cloud security and network security teams work. They need their security solutions in Azure to provide these three essential capabilities:    Prevents advanced cyber threats: Threats are constantly morphing. Basic Layer 4 security and IPS signatures are not enough to secure workloads anywhere, including in Azure. Organizations need best-in-class security to stop new threats and reduce the risk of breaches. Fits into how customers work in Azure: Organizations don’t want to deal with complexity or incur operational overhead to secure their deployments. They want network security to be as easy to deploy and automate as any other native Azure service. Works with how customers manage network security: Organizations have existing tools and processes for managing network security across multiple environments. Why change them? They want to leverage these same tools to centrally manage network security policy and logs in Azure.   Why Palo Alto Networks Created a Managed Firewall Service for Azure   Inspired by honest conversations with our customers, Palo Alto Networks has set out to create a new category of firewall that simplifies the deployment and management of the firewall — all while providing best-in-class security. Cloud NGFW for Azure meets those needs by:    Providing the ability to prevent advanced cyber threats For the 11th straight year, Palo Alto Networks was named a Leader in the Gartner® Magic Quadrant™ for Network Firewalls. This network security leadership is built on cutting-edge technology, including the industry’s only machine learning (ML) powered NGFW, capable of stopping known, unknown, and zero-day cyber threats. It enables customers to reduce the risk of an attack by controlling network traffic based on applications identified with our patented App-ID technology.    It doesn’t stop there. Through integration with Advanced Threat Prevention, customers are able to block more unknown command-and-control (C2) traffic and more zero-day exploits in real-time than traditional IPS solutions. Add Advanced URL Filtering detection capabilities powered by Inline Deep Learning, and Cloud NGFW for Azure can prevent known and unknown malicious URLs long before other vendors.    With DNS Security, we offer the most comprehensive threat coverage against DNS-layer threats. Finally, WildFire tackles the rise in sophisticated malware and stops more evasive malware than ever before. And to provide even more flexibility, Cloud NGFW for Azure detects and stops threats in all traffic, including encrypted traffic, via integration with Azure Key Vault.   Figure 1: Best-In-Class Security features Fitting into how customers currently work on Azure Thanks to extensive collaboration with Microsoft Azure, we’ve integrated our industry-leading NGFW capabilities onto the Azure  portal as a native service. Think about that. As an Azure service, you can easily use your Azure identity to create and manage firewalls directly from the Azure portal, without logging into another UI. On top of being offered as a service, Cloud NGFW is integrated with Virtual WAN Hub to provide robust, secure, and scalable connectivity between your hub and branches. This greatly simplifies security deployments for Virtual WAN, thanks in large part to our built-in auto-scaling feature.      To further leverage Azure native services, you can configure Cloud NGFW for Azure to securely access keys in Azure Key Vault to decrypt traffic and inspect it for hidden threats. Finally, to empower the automation of security management of Azure workloads, Cloud NGFW for Azure will soon be integrated with native Azure APIs, CLI, SDK, and Terraform Provider.     Dovetails into how customers manage network security With Panorama integration, securing your cloud migration journey will be greatly simplified. You can create and edit security rules in accordance with your organization’s security policy, across firewall deployments, from one central location: Panorama. You can also leverage the existing institutional knowledge of your security team codified as a configuration in Panorama. This allows you to maintain your current NGFW workflows and integrations, and simplify your operations by streamlining configuration and automating tasks. Finally, with Panorama integration, you will gain actionable insights into your network traffic and security threats, as well as centralized logging and visibility.   Cloud NGFW Use Cases   Broadly speaking, you can use Cloud NGFW to protect your Azure deployments from three network-based threat vectors:   The first network-based threat vector in the cloud comes from outbound connections to the Internet. As applications need to download software updates from the internet and connect to API services such as Google, most organizations' firewalls are configured to allow these outbound connections. However, these connections can also be used to download malware, establish connections to command and control servers and exfiltrate your critical data. If these outbound connections are secured using Cloud NGFW, these malicious connections can be automatically blocked to prevent exploitation by ransomware, stop command-and-control applications, and prevent data exfiltration.   The second threat vector comes from allowing traffic from the Internet to connect to applications such as a web server. Cybercriminals can use these network connections to exploit unknown or unpatched vulnerabilities in application software.    While organizations aim to patch all the vulnerabilities before the applications go into production, there are several reasons why vulnerabilities continue to exist in your environment. Unknown vulnerabilities such as Log4J existed for seven years before it was discovered and announced as a common vulnerability and exposure (CVE). There might be hundreds of such vulnerabilities out there that are being exploited by attackers, which organizations are unaware of and hence are unable to patch them against.    Even in the best-case scenario, where a patch exists, delays in patching still occur. It takes enterprises weeks or even months to patch these vulnerabilities. During these gap periods, organizations are exposed while trying to patch these vulnerabilities. If your organization's inbound connections are secured using Cloud NGFW, it can block attackers from exploiting these vulnerabilities while you work on patching. It buys you time and acts as a compensating control. Additionally, Cloud NGFW traffic logs provide deep visibility and context of network traffic (such as country, URL category, App-ID, application functions, filename, and file type) to your SIEM, CSPM, and CWP tools. This added visibility further helps identify, isolate, and remediate compromised or unpatched workloads.    Lastly, the third threat vector is lateral connections between workloads in your environment. For example, multiple applications may need to connect to a database server. To follow the true philosophy of Zero Trust, organizations need to protect all connections within their environment, including those between internal workloads and applications. Otherwise, organizations run the risk of hackers using a breach of one application to spread laterally to other applications.   Cloud NGFW in Action   Setup and deployment is a simple process, as shown below and demonstrated in this video walkthrough.     Explore the Benefits of Cloud NGFW for Azure with Your Free Trial   To get started with a 30-day free trial, visit the Azure Marketplace. To get more technical details, please take a look at the documentation and FAQ pages. Cloud NGFW for Azure is currently available in five regions across the world: East US, East US 2, Central US, Australia East, and West Europe. Rapid expansion to additional regions is planned.   ... View more

I would love more information on what Cloud NGFW for Azure is. ... View more

Welcome to our Member Testimonial video series, where we invite members to share why LIVEcommunity is their trusted resource for building skills, sharing ideas, troubleshooting issues, and finding solutions!   @TomYoung has been a member of LIVEcommunity since 2017 and part of the community's Cyber Elite program — which recognizes our most committed, helpful, and knowledgeable members — since it launched in 2020. He is an involved, responsive,  and thoughtful member, and we’re grateful to have him as a part of LIVEcommunity. To date, he has made 625 posts, given 317 kudos and created 132 accepted solutions!   Achieving Cyber Elite status on the LIVEcommunity means a lot to Tom, as it recognizes his expertise and commitment to providing the best solutions to his team. Tom Young is the Principal Network Architect at Flair Data Systems, a Palo Alto Networks reseller with over 100 years of experience in the industry. He has been with Flare Data Systems for 20 years and has expertise in various areas of networking technologies, including routers, switches, firewalls, security, wireless, and data center.   In his interview, Tom says that the LIVEcommunity is a valuable resource for him as he gets to hear from other experts, customers, and even Palo Alto Networks engineers on how they solve problems and their best practices. He also sees LIVEcommunity as a great “sounding board” to express his ideas and get feedback from others.   Tom states that he also appreciates the LIVEcommunity and its diversity. He says that the platform provides out-of-the-box thinking as users come from different backgrounds and have different experiences, helping him uncover new ideas and solutions to problems that he might not have thought of otherwise.   "It’s a great forum for sharing knowledge but also just interacting with other network engineers and security engineers who have the same problems,” shared Tom in his interview.    Learn how @TomYoung leverages LIVEcommunity to answer questions, solve problems, and be more productive at work in this Member Testimonial video:     The LIVEcommunity team would like to extend a special thank you to Patrick Spencer, of TIRO Communications, for his help on the production of this series.   Subscribe to LIVEcommunity’s Member Testimonial area to get notified when we post a new video! ... View more

  The last 24 months have shown that work is no longer just a place we go, but an activity we perform. 80% of organizations have adopted a hybrid cloud strategy, with apps used everywhere. In fact, they use an average of 110 SaaS apps within their environments.   Simultaneously, users are now everywhere. 76% of employees want to work hybrid, even after the pandemic. All of this brings new cybersecurity challenges, which means organizations can no longer rely on ZTNA 1.0.   Watch the unveiling of ZTNA 2.0 with Palo Alto Networks Prisma Access and learn directly from industry experts as they share evolving market challenges, strategic best practices and the latest innovations from Prisma Access.   Tune into the launch event on-demand and hear from the group of leading industry experts that joined in:    Nikesh Arora, Chief Executive Officer and Chairman at Palo Alto Networks Lee Klarich, Chief Product Officer at Palo Alto Networks Kumar Ramachandran, Senior Vice President of Product at Palo Alto Networks David Holmes, Senior Analyst at Forrester Kenneth Ogami, Senior Vice President and Chief Information Officer U.S. at Westfield LLC   Watch On-Demand now for Prisma SASE: AI-Powered Innovation Takes Center Stage ... View more

Welcome to our Member Testimonial video series, where we invite members to share why LIVEcommunity is their trusted resource for building skills, sharing ideas, troubleshooting issues, and finding solutions!   @BPry has been a member of LIVEcommunity since 2016 and part of community’s Cyber Elite program — which recognizes our most committed, helpful, and knowledgeable members — since it launched in 2020. He is an involved, responsive, and thoughtful member, and we’re grateful to have him as a part of LIVEcommunity: To date, he has made 5608 posts, given 1864 kudos and created 849 accepted solutions!   Achieving Cyber Elite status on the LIVEcommunity means a lot to Brandon, as it recognizes his expertise and commitment to providing the best solutions to his team. Brandon Pry is a Senior Network Security Engineer and talks about his role and how the LIVEcommunity has been a valuable resource. He is able to find solutions to issues that have already been solved by others. Brandon has been using Palo Alto Networks products for the past eight years and finds the LIVEcommunity to be valuable for learning about new features and ensuring that his security practices are in line with best practices.   "The people that I follow in the LIVEcommunity are generally the folks that keep pointing me to features that I haven't implemented yet or they have already implemented features in ways that I haven't thought of yet.,” shared Pry in his interview.    Learn how @BPry  leverages LIVEcommunity to answer questions, solve problems, and be more productive at work in this Member Testimonial video:   The LIVEcommunity team would like to extend a special thank you to Patrick Spencer of TIRO Communications for his help on the production of this series.   Subscribe to LIVEcommunity’s Member Testimonial area to get notified when we post a new video! ... View more

                                                This blog was written by Jane Goh   3CXDesktopApp Supply Chain Attack Rapid Response   A supply chain attack involving a software-based phone application called 3CXDesktopApp hit at the end of March. The 3CXDesktopApp attack, first reported by CrowdStrike on March 29, 2023, was quickly investigated by Unit 42 the next day. Unit 42 discovered the 3CXDesktopApp installer hosted on the developer’s website installed the application with two malicious libraries. The malicious libraries ultimately run shellcode to load a backdoor on the system that allows actors to install additional malware on the victim machine. Please refer to this Unit 42 Threat Brief for more details on the threat and the latest Palo Alto Network protections summaries.   This Playbook of the Week blog will focus on automated response actions you can leverage using XSOAR. XSOAR can help you orchestrate response for incidents related to this attack across your EDR, XDR, SIEMs, and threat intelligence sources.  The 3CXDesktopApp Supply Chain Attack playbook can be triggered manually or as a scheduled job.    What it Does   This playbook automates the process of data enrichment by collecting, extracting, tagging, and linking indicators from various sources such as Unit 42, Huntress and CrowdStrike, and linking them to incidents. It also downloads Sigma and Yara signature rules.   Playbook sample: extract, tag, and link indicators   Next, the playbook performs automated threat hunting queries looking for detected execution of the 3CX applications, detected network connections to known C2 domains and/or compromised 3CX app activity, across multiple sources including: Cortex XDR Splunk QRadar Elasticsearch PAN-OS Cortex Data Lake ElasticSearch Azure Log Analytics Playbook sample: Generic and XDR threat hunting   Playbook sample: SIEM Threat Hunting Lastly, you can set the playbook to perform remediation tasks such as blocking indicators automatically, or have the analyst continue to perform further analysis before closing the investigation.   Playbook sample: Remediation tasks   Learn More   Note: We have provided some highlights of the tasks available via this playbook. It does call other sub-playbooks not mentioned in this blog so to get the full scope of the playbook automation workflow, please refer to our Cortex Marketplace content pack documentation. You might also be interested in our series of Rapid Breach response playbooks.   Don’t have Cortex XSOAR? Download our free Community Edition today to test out this playbook and hundreds more automations for common use cases you deal with daily in your security operations or SOC.   ... View more

    April Spark User Summit - Stay One Step Ahead of Adversaries with PAN-OS 11.0 Nova Cyber threats continue to increase in volume and complexity, with threat actors developing new ways to avoid detection — including highly evasive malware. To help organizations outpace these evolving threats, Palo Alto Networks announces PAN-OS® 11.0 Nova, the latest version of its Industry-leading PAN-OS software, unleashing 50+ product updates and innovations. Nova is a leap forward in network security. It stops 26% more zero-day malware than traditional sandboxes, detects 60% more injection attacks, simplifies security architecture, and helps organizations adopt cybersecurity best practices. The bottom line is that Nova helps keep organizations one step ahead of attackers. Join Palo Alto Networks experts to learn how you can stay one step ahead of zero-day threats with Nova.   Learn About - Hear about the new innovations in PAN-OS 11.0 Nova that offer security against Zero Day threats with new Advanced WildFire and enhancements in Advanced Threat Prevention, simplified and consistent security with Web Proxy and NG-CASB and strong cyber posture with enhancements in AIOps. - You'll also get a peek into our five newest fourth-generation ML-Powered NGFWs that offer over 5X performance enhancement. - Get a demo on these innovations from our experts.    Event Details Register Now Wed, Apr 19, 9:30 AM (PDT) ... View more

  We wanted to take a moment to thank YOU, our community members for all the support, content and sharing that happened this past month.   We are back to recognize one of our most active contributors with a monthly LIVEcommunity Member Spotlight!    For the February 2023 Member Spotlight, we’d like to applaud one of our community members, @Raido_Rattameister, for their participation and engagement in the LIVEcommunity.     Since joining the community in February 2015, they have written 984 posts, received 338 likes, and authored 140 solutions (and counting)!   Thank you for your contribution and participation in the community @Raido_Rattameister!   We are excited to see you grow as a contributor. We couldn’t do it without our amazing community.    Do you know a LIVEcommunity member you think should be recognized for their contributions to the community? Drop us a comment below!   Thanks for reading and stay tuned for next month’s Member Spotlight.   ... View more

  Global organizations entered 2023 facing a year of economic uncertainty. For security and networking teams, this meant fewer available resources to keep operations running in a new world of hybrid work, while also combatting the most complex cyber threats ever seen.    This era of doing more with less means it’s critical for organizations to simplify operational complexity, reduce costs, and gain the latest advancements in cloud-delivered security and networking. Prisma SASE is purpose-built to help customers meet these modern challenges. By converging cloud-delivered security and networking into a unified platform, organizations can even improve their return on investment (ROI) and total cost of ownership (TCO).   But don’t just take our word for it. Join us at Prisma SASE: AI-Powered Innovation Takes Center Stage for our exciting virtual event where we’ll unveil the latest AI-powered innovations in Prisma SASE, ZTNA 2.0, Cloud SWG, and SD-WAN that will help your organization stay secure and agile. We’ve also convened an impressive group of leading industry experts to join the conversation:    Nikesh Arora, chief executive officer and chairman at Palo Alto Networks Lee Klarich, chief product officer at Palo Alto Networks Kumar Ramachandran, senior vice president of product at Palo Alto Networks David Holmes, senior analyst at Forrester Kenneth Ogami, senior vice president and chief information officer U.S. at Westfield LLC   Block your calendars for this virtual event. We can’t wait to show you how AI-powered SASE can meet your organization’s challenges today and goals for the future. See you there!   Register now for Prisma SASE: AI-Powered Innovation Takes Center Stage   ... View more

    A major challenge in cybersecurity today is our inability to leverage massive scales of data for our defense. As compute and data storage have improved exponentially over the last decade, it is essential to deliver real-time security that can match pervasive, AI-powered cyber attacks.   Thales and Cortex Extended Security Intelligence and Automation Management (XSIAM) are excited to share that the newly expanded Thales SafeNet Trusted Access pack is now available within Cortex Marketplace. This pack now provides Cortex XSIAM customers with a single manner to leverage the Thales access management and authentication solution. Designed to respond to risks in real-time and streamline the account-based tasks your SOC must perform every day, this pack also includes the collection of Thales log data into XSIAM.   Top Partners are first to integrate with Cortex XSIAM   Cortex XSIAM and SafeNet Trusted Access by Thales have partnered to help security teams centrally manage and secure access to business applications. This integration helps to prevent data breaches, by recognizing threats and detecting new adversary tactics with self-learning cloud-delivered AI. Palo Alto Networks Cortex XSIAM and SafeNet Trusted Access help in modernizing enterprise SOCs taking off the load from the security teams.   Let’s take a look at why this is so important for your SOC: Lessen SOC team burden: Automate workflow tasks to increase response efficiency and improve productivity Simplify the ability to collect, analyze and act upon the data and alerts generated by Safe Net Trusted Access Provides visibility and incident insights: Continuously discovers vulnerabilities through native attack surface management   Together, SafeNet Trusted Access and Cortex XSIAM enable you to: Process alerts from SafeNet Trusted Access indicating security risks to end user accounts Apply security remediation actions through security orchestration playbooks. Retrieve access, authentication, and audit logs and store them   Learn More Check out the pack on Cortex marketplace Learn more about Cortex XSIAM ... View more

  Provide analysts with visibility and better understanding of threats as they emerge    Security teams often have a variety of security tools at their disposal. Given that resources can often be limited, they need these tools to integrate better together and enable automation. In order to close the security loop, Okta and Cortex Extended Security Intelligence and Automation Management (XSIAM) integrate to turn widespread event and identity data into an intelligent data foundation to fuel XSIAM machine intelligence to radically improve security outcomes and transform security operations.   Top Partners are the first to integrate with Cortex XSIAM   Cortex XSIAM and Okta's cloud-based identity management service have partnered to help security teams enable automated actions to enforce identity as a security control point. Cortex XSIAM and Okta enable enterprises to provide better integration and automation of their security tools, especially for identity-centric visibility and response, helping take off the load from the security teams.   Okta's cloud-based identity gives security teams visibility into each user’s groups and roles, what apps and data they can access, and other contextual risk information that can streamline the investigation process for rapid response.   Cortex XSIAM collects events log for authentication and audit provided by Okta admin API to help security teams collaborate and manage cases across the incident lifecycle. A built-in playbook is available where customers can sync a list of IP addresses to the Okta Network Zone with the given ID.   Let’s take a look at why this is so important for your SOC:   Lessen SOC team burden: Now, security teams can better respond to suspicious account activity, like a log-in from a new device or location, by automatically restricting access to sensitive applications or prompting for step-up authentication.   Accelerate response: Cortex XSIAM leverages the data foundation to detect new adversary tactics that are updated continuously with Palo Alto Networks’ threat intelligence gathered globally across tens of thousands of customers and natively automates key steps of incident investigations.   Simplify remediation: If, after further investigation, the user does appear to be compromised, security teams can take additional remediation actions by suspending the compromised account and conducting a password reset.   Together, Cortex XSIAM and Okta enable security teams to: Use identity and user context to enrich, understand and analyze security alerts as they arise Prioritize alerts and orchestrate informed security responses in order of importance Contain and remediate threats quickly and decisively, through a range of automated identity-centric actions Enhance visibility and response by enabling identity as a key control point   Learn More! Check out the pack on the Cortex marketplace Learn more about XSIAM ... View more

  By: Ben Melamed   As the use of multi-cloud environments continues to rise, adversaries have increased their focus on targeting cloud infrastructure. Cloud environments are seen as an attractive target for attackers, who seek to gain access to sensitive data and resources that are not properly secured by organizations.   The dynamic and complex nature of cloud infrastructure makes it challenging to secure, resulting in a lack of visibility and control needed to promptly detect and respond to security incidents. Cloud-based attacks are becoming more sophisticated and well-funded, using advanced tactics such as cloud cryptojacking, malware campaigns, and cloud misconfigurations. These attacks can be hard to detect and prevent, particularly for organizations that are not well-prepared.   In this article, we will take a closer look at cryptojacking attacks and how you can quickly and effectively respond to help minimize their impact and prevent them from spreading with Cortex XSOAR.   What is Cryptomining?   Cryptomining is the process of using specialized computer software and hardware to verify and record transactions on a blockchain network to earn cryptocurrency.   Think of a blockchain as a digital ledger, where all transactions are recorded in a public and decentralized way. Cryptomining is like being a bookkeeper for this digital ledger. Miners use their computer resources to solve the complex mathematical problems that are required to add new blocks of transactions to the blockchain. When miners successfully add a new block to the blockchain, they are rewarded with a certain amount of cryptocurrency, typically Bitcoin, as a reward for their work.   In simple terms, cryptomining is like digging for digital gold using your computer, and the reward is the cryptocurrency you earn.   Malicious Mining: Cryptomining vs Cryptojacking   Cloud cryptojacking is a type of cyberattack in which attackers use the resources of a cloud computing platform to mine for cryptocurrency without the knowledge or consent of the cloud platform's owner. So while cryptojacking is a process of cryptomining, the main difference is that it relies on the unauthorized use of someone else's resources to mine for cryptocurrency.   An example of a cloud cryptojacking attack would be an attacker gaining access to a cloud platform's API credentials and using them to spin up many virtual machines dedicated to mining cryptocurrency.   Stop Crytpojacking Attacks with Cortex XSOAR   Cortex XSOAR can quickly respond to cryptojacking attacks by automating the incident response process. In the enrichment and investigation phase, XSOAR can gather information about the attack by integrating with cloud platforms like AWS, GCP, and Azure to gather information about the resources that are being used for mining, the IP addresses that are accessing them, and the user accounts that are associated with the API credentials.   Regarding response options, XSOAR can be configured to automatically terminate instances, revoke API keys, and take other actions to stop the attack and contain the damage. Additionally, AI/ML can be used to improve incident response time by detecting signs of an attack and taking action before the attack becomes widespread.   Cryptojacking Response Playbook   The cloud cryptojacking response playbook (part of the Cortex XDR content pack) provides an automated flow for collecting, analyzing, and responding to malicious cryptomining activity. The playbook is triggered by a Cortex XDR alert that detects unusual allocation of cloud computing resources.     Image 1: Detecting adversary techniques with cloud data   Based on the alert data, XSOAR initiates the automated flow that executes the following:   Enrichment XSOAR enriches all data related to the following: Identity and Access Management (IAM) Enrichment Collects information about the identity used in the attack Resource Enrichment Collects information about the resource type, region, and project Network Enrichment Collects information about the attacker IP address, geo-location, and ASN Then, the collected data is set into a dedicated layout.   Verdict Decision   The verdict is based on a predefined logic which correlates XDR alerts and XSOAR enrichment, based on the following decision tree:   Figure 2: Decision tree for verdict decision   Verdict Resolution   If the verdict is benign or indecisive, a manual task will require the analyst’s intervention. The cloud response playbook will be executed if the verdict is malicious.   Remediation   This playbook provides an automated or semi-manual response action integrating with AWS, GCP, and Azure.     Figure 3: Cloud response playbook triggered   The response actions available are divided into the core building blocks of the cloud:   Compute Resources Terminate/Shut down/Power off an instance IAM Delete/Disable a user Privileges Delete/Revoke/Disable credentials Indicators Block indicators   The Layout   The layout we’ve created for this alert is divided into two main tabs: Incident Info Security Posture The Incident Info tab is mainly focused on presenting high/low-level information of both the incident and alert.   Figure 4: Incident information   The Security Posture tab's goal is to provide detailed information and visualization of the following questions: Who are the involved users? How many instances were created and what is their type? From how many regions was the attack executed? Furthermore, we provide extended information on the attacker's characteristics and a section dedicated to all of the suspicious or malicious indicators found.   Figure 4: Security posture   Conclusion   Cryptojacking attacks have become a serious threat to organizations of all sizes, as attackers seek to exploit the power of cloud computing environments to mine for cryptocurrency. The ability to quickly and effectively respond to these attacks is crucial to minimize their impact and prevent them from spreading.   Organizations should also stay vigilant and aware of the latest trends and techniques in cryptojacking attacks and be prepared to adapt their incident response plans accordingly. Incident response automation and implementing security best practices are crucial in protecting organizations from the growing threat of cryptojacking attacks in the cloud. For more information on the Cryptojacking Response playbook and other XSOAR packs and playbooks, visit our Cortex XSOAR Developer Docs reference page.   Don’t have Cortex XSOAR? Download our free Community Edition today to test out this playbook and hundreds more automations for common use cases you deal with daily in your security operations or SOC.   Cortex XSOAR  ... View more

  We wanted to take a moment to thank YOU, our community members for all the support, content and sharing that happened this past month.   We are back to recognize one of our most active contributors with a monthly LIVEcommunity Member Spotlight!    For the January 2023 Member Spotlight, we’d like to applaud one of our community members, @neelrohit, for their participation and engagement in the LIVEcommunity.     Since joining the community in May 2020, they have written 156 posts, received 37 likes, and authored 41 solutions (and counting)!   Thank you for your contribution and participation in the community @neelrohit!   We are excited to see you grow as a contributor. We couldn’t do it without our amazing community.    Do you know a LIVEcommunity member you think should be recognized for their contributions to the community? Drop us a comment below!   Thanks for reading and stay tuned for next month’s Member Spotlight. ... View more