The Investigation model organizes content, with the purpose of delivering an accurate path to information security incident response. This is a hierarchical model, four levels deep.
The objective of each category is to catalog existing and upcoming content with an Incident Response service-based approach. This is done to maintain mission critical revenue, protect customer data and branding, as well as to drive information security programs forward in response maturity.
This content strategy focuses on highlighting key pieces of information within an Enterprise network and log capturing environment and strives to make this data readily available for consumption and dissemination. This model aims to aid in the discovery of the preliminary and often responsive data mining tasks related to information security services.
The Threat category accounts for content that may directly lead to security incident investigations when observed on a high value corporate asset or target.
If the source host in question is identified as being compromised, we can apply this activity to an attack phase describing pivoting within an environment.
The distinction in specific malware situates this content in the family-type malware subtag.
The intent of attack phase content is to assist incident response practitioners with the escalation, remediation or classification of observed indicators of compromise activity. This content makes use of organized threat intelligence and provides a template for incident response operations tasked at monitoring and detecting indicators in a given dataset. The attack phases are a procedural set of stages that can be carried out in a variety of ways and over a long period. An example of attack phase content would be a rule that leverages any of the stages listed below.
- Reconnaissance: attacker attempts to gain information about the target before the attack begins.
- Delivery: the attacker sends the malicious code to the victim.
- Exploitation: the actual execution of the exploit (only relevant when the attacker uses an exploit).
- Installation: the installation of malware onto the affected computer.
- Command & Control (aka "C2"): the attacker creates a command and control channel in order to continue to operate internal assets remotely.
While some known malicious behavior can be attributed to actors that have high-end intelligence, suspicious behavior can be classified independently of threat portal intelligence. Taking this approach eliminates the downside of associating a certain behavior to one actor only and better permits NetWitness to detect new threats or TTP not already defined.
Breaking malware into certain family types helps content engineers to easily update any parsers or application rules that may reference a new malware variant. Response priorities can differ amongst organizations in relation to the diversity of malware types.
- Remote Access Trojans: Remote Access Trojans are an obvious indication that your network is actively compromised. ASOC Analytical Services recommends high response priorities be set when a remote access Trojan signature is generated
- Crimeware: Crimeware is currently a huge part of the Internet. Thus, it deserves a place in a response program’s standard operational intake and remediation efforts. Heightened awareness on this malware type would be logical within organizations saturated with confidential identity and financial-based information.
- Web Shells: Web shells are an obvious indication there is active compromise. Content related to web shells should be highlighted and escalated with a sense of urgency.
- Key Loggers: Key loggers can be packaged up in exploit kits or delivered via spyware. Key logger content can take the form of intrusion detection signature identification numbers, or antivirus filename matches based off Virus Total analysis. Examples are aimed at identifying key loggers that do not solely utilize packet capture.
The Identity category accounts for content used in the identification or mapping of users and entities.
Identity content data is heavily utilized in response operations for validation of a particular IP address and associated end user. It classifies specific evidentiary logs to assist in incident response, and provides a means to create a baseline for NetWitness.
This rule is used to highlight any accounts created in a collection. The data represented in the t escalation can be intelligence that is utilized during the corporate auditing process.
This rule is used to highlight any successful account authentications in a collection. The data represented in this content can also be utilized during the auditing process.
Detects multiple account lockouts reported for a single or multiple users within a given time window.
Authentication is the act of giving a user access to secure systems based on user credentials that imply authenticity. For example, the act of logging onto a system. The ways in which someone may be authenticated fall into three tags, based on what are known as the factors of authentication: something the user knows, something the user has, and something the user is.
The process of enforcing policy as in available activities, resources, services or overall user access. For example, elevated privilege, password modifications, distribution lists, and lockout activity.
The above rule tags all accounts disabled in a windows collection.
The accounting tag contains content that measures resources utilized by a given user. This can include any of the following:
- the amount of data a user has transferred during a session
- remote access session information
- file share activity
- the overall audit of a user footprint
The above content summarizes activity on a network based on a list of source IP addresses. The report includes bandwidth utilization, risk alerts, threats, top destinations, OS types, browsers and clients
The goal of behavior analytics is to determine base lines in user behavior. Base lines are necessary for determining abnormality within overall network utilization. Behavior Analytical content helps to promote data science and user- and entity-based analytics. Within NetWitness, a variety of content has already been utilized in ESA proof of concepts, which visualized host and user relationships based on MAC address, IPv4, hostname and username data from specific windows, DHCP and VPN logs.
- Entity Monitoring: An example of content in this subgroup could be the monitoring of the various types of administrator accounts on a corporate network. Many organizations have exclusive user names for these elevated accounts, or bind them to an associated group within active directory. Collecting, cataloging and embedding this enterprise intelligence within the content model is essential in maintaining a security program.
- User Mapping: Between employees adding their own devices to a network, and having multiple users on a machine, asset management can quickly become a difficult task for analysts. Any data that represents entity correlation can be stored and cataloged in this subgroup. The underlying function of this content is to associate and identify end users while they access the network.
The Assurance category contains content that:
- determines the corporate security posture (governance)
- adheres to internal and external audits (compliance)
- manages overall risk within the enterprise (risk)
The governance, risk, and compliance aspects of security are paramount in enabling customers to alleviate and fulfill industry requirements.
The above rule detects web browsing agents not issued during standard corporate deployments, adding to the summary of overall risk exposure.
The above rule detects the use of common proxy services, by using a list of domains matched against alias host.
The above rule highlights any modifications to infrastructure in support of Compliance reporting which may assist during audit.
Governance content spawns an action for the associated escalation contact. Incident Management is the determined mindset of this category. Content that enables an act of remediation, or the education an end user is in this subgroup. An example of this could be corporate misuse of an asset, which can be carved from an organization's acceptable use or information security policies.
This subgroup identifies behavior that violates an agreement, either employee or corporate.
- Active Violations: Misuse of corporate resources. For example, attempting to access a specific category that is blocked. Or, HR violations based on a data loss prevention escalation. Violations often warrant an action by the security analyst or response team escalations to a risk-based organization.
Enforcement: Enforcement is designated for content used in the identification of expected nefarious or delinquent behavior outside of known policies. This subgroup identifies the behavior that an incident response team should consider in remediation of a given violation. This could be in the form of user education of investigation escalation.
For example, the release of an enterprise confidential e-mail to someone outside of the Corporation based on Human Resources or a legal team's request.
Risk is defined as intelligence one may discover about the Enterprise, which may be useful within the incident response life-cycle. This can be escalation contact information, server specifics, or business intelligence.
The above content reports on suspected shadow IT usage within the organization.
- Vulnerability Management: Content such as vulnerable pieces of software, or updates on patches.
- Organizational Hazard: This subgroup consists of content that can be attributed to potentially enabling a compromise. For example, this could be passwords stored in a plain text file on the desktop of a shared administrator server. Further examples might include users using the same logon/FOB; this is an operational security failure. Additional content that would contribute to organizational hazard are instances of shadow IT.
- Enterprise Intelligence: Content that assesses your network and business processes. The more you know about the business itself, the better suited you are to defend it. This content could be related to high value assets or targets, or simply security infrastructure.
The Compliance tag contains Information that may be subject to audit, or content that may contribute to readily accessing answers to important questions. Content here promotes information transparency about the security program. More importantly, the compliance section can be considered as information which supports Incident Response. Content examples can include confirming whether systems adhere to corporate compliance via installed security controls.
This content is used to report on any activity related to the handling of sensitive data or restricted hosts.
Corporate: content related to determining a fully IT-compliant entity or user, and required in a successful security program. This is also a task that analysts take in response to disreputable activity. In any instance of escalation, one of the first items to determine is if the security controls in place have failed.
This type of content can be used to drive security programs forward, more intelligently occupy IT-security budgets, and enable more rapid incident response.
- Audit: content that concerns reporting based on industry standards related to fiduciary auditing compliance (at both the state and federal level).
The Operations tag accounts for content used to aid in systematic analysis of enterprise data. This could be in the form of daily reports, dashboard visuals or the management lifecycle of customer-specific data. Most importantly, it is the content which constitutes the initial inspection of log and session collections. This is important content to deliver to an analyst because it is a prerequisite for understanding situational context.
Above rule alerts when a session containing payloads have only ACK flag set.
The above rule detects web servers running NGINX, which is often used for malicious purposes.
The above rule looks for more than 4 attachments in a single session.
Comprehensive cyber situation awareness involves three key areas: computing and network components, threat information, and mission dependencies. It has added a new dimension of required awareness to traditional business operations. With this awareness, negative situations can be recognized and managed as they occur. Examples of this type of content can be daily reports and charts for visualizing certain aspects of a collection.
The event analysis tag is used to classify a majority of the deep packet inspection content available within Live. Alone, a piece of content here might not lead to an active investigation. However, in combination with additional indicators of compromise the collections may require immediate review. Non-standard and service-based analysis content resides in this tag.
This tag contains the following:
- Application Analysis: content used to identify applications.
- Protocol Analysis: content used to identify anomalous sessions and deviations from standards
- File Analysis: content focused on the ability of NetWitness to inspect files and escalate based on irregular behavior.
- Outbound Communication with the Internet,
- Inbound Web Application Communication,
- Intra- and Inter-DMZ communications,
- DMZ to Inside Communications,
- Inside to Inside Communications,
- B2B or Partner Communications,
- Inbound SMTP Communications,
- Inbound Other Applications,
- Cleartext side of Inbound VPN Connections
- Filters: content labeled as noise, and therefore not stored in the index of an active collection.
- Log Analysis: content used for log analysis such RSA Log Devices and RSA Log Collectors.