Investigate: Context Lookup Panel

Document created by RSA Information Design and Development on Sep 18, 2017Last modified by RSA Information Design and Development on Sep 11, 2018
Version 15Show Document
  • View in full screen mode
 

After an administrator configures the Context Hub service, you can view the contextual information for the meta values in the Navigate view, Events view, and Event Analysis view (Version 11.2). The Context Hub service is pre-configured with a default meta type and meta key mapping. For information about the mapping of the context hub meta value with investigation meta key, see "Manage Meta Type and Meta Key Mapping" in the Context Hub Configuration Guide.

The Context Lookup panel is displayed on the right side of the Navigate view and Events view. Meta values that have been added to a Context Hub list are highlighted in gray in the Navigate view or Events view results. In the Event Analysis view, they are marked by an underscore. When you right-click a highlighted value and select Context Lookup in the resulting context menu, the lookup results are displayed in the Context Lookup panel for configured sources for the selected meta value. You can select a source in the Context Lookup panel icon bar to view the contextual information.

There are some differences between the appearance and contents of the Context Lookup panel when open in the Navigate view or Events view and when open in the Event Analysis view.

Workflow

the high-level Investigate workflow with Perform Internal Lookups highlighted

What do you want to do?

                                                     
User RoleI want to ...Show me how
Threat Hunter

browse event metadata

Begin an Investigation in the Navigate or Events View

Threat Hunter

browse raw events

Begin an Investigation in the Navigate or Events View

Threat Hunter

analyze raw events and metadata

Begin an Investigation in the Event Analysis View

Threat Hunterinvestigate endpoints (Version 11.1)Investigate Hosts

Threat Hunter

find suspicious endpoint files (Version 11.1)

Investigate Files

Threat Hunterscan files and events for malwareConducting Malware Analysis

Incident Responder

triage an incident in Investigate

NetWitness Respond User Guide

Threat Hunterlook up additional context for a meta valueLook Up Additional Context in the Navigate and Events Views and Look Up Additional Context in the Event Analysis View

*You can perform this task in the current view.

Related Topics

Quick Look (in the Navigate and Events Views)

The following figure is an example of the Context Lookup panel as it appears in the Navigate view and Events view. Controls and features are described in the table.

Navigate view with the Context Lookup panel open

                               
FeatureDescription
Source Options Bar Displays the icons for the available sources: Endpoint, Incidents, Alerts, and Lists.
Source Name Displays the source name based on the selected icon:
  • Endpoint
  • Incidents
  • Alerts
  • Lists
  • Live Connect
Sort

Provides a drop-down of sort options for the listed context information. Possible sort options are Severity - High to Low, Severity Low to High, Date - Oldest to Newest. and Date - Newest to Oldest. The sorting options vary by source type.

Refresh icon Refreshes the lookup results.
<n items> (First <n> Results)The footer provides a count of results currently displayed and the total number of results. For example, 5 Alerts (First 50 Results).

Incidents

Incidents are displayed based on time first (Newest to Oldest) and then priority status. The following information is displayed for incident lookups:

  • Incident Name and ID
  • Priority status of the incidents
  • Risk Score value of the incidents
  • Date when the incident was created
  • Status of the incident
  • Assignee for the incident
  • Last Updated: Indicates when contextual data was last fetched from data source and updated to cache.
  • Time window: This is based on the value that is set for the "Query Last (Days)" field in the Configure Respond window. For details, see the "Configure Respond as a Data Source" topic in the Context Hub Configuration Guide.
  • Sort: This drop-down field provides options to change the sorting of result based on time or priority.

Alerts

Alerts are displayed based on the Severity. ;The following information is displayed for alert lookups:

  • Alert Name
  • Severity value of the alerts
  • Date when the alert was created
  • Incident ID: This is the ID of the incident that the alert is associated with (If any).
  • Sources: Event source name
  • Number of events associated with the alert.
  • Last Updated: Indicates when contextual data was last fetched from data source and updated to cache.
  • Time window: This is based on the value that is set for the "Query Last (Days)" field in the Configure Respond window. For details, see the "Configure Respond as a Data Source" topic in the Context Hub Configuration Guide
  • Sort: This drop-down field provides option to change the sorting of result based on time or priority.

Lists

The following information is displayed for list lookups.

  • List Name
  • Owner who created the list
  • Created Date
  • Last Updated Date
  • Description of the list

Endpoint

The following information is displayed for Endpoint lookups.

  • Machine name and IP address of the machine.
    By clicking on the IP or Endpoint machine name, you will be navigated to Endpoint UI to perform further investigation.
  • Last Updated: Indicates when contextual data was last fetched from data source and updated to cache.
  • Machine Score: A machine IIOC score is aggregated based on the module scores.
  • Number of modules: Number of active files for the selected machine.
  • Last Updated: Indicates when the scan results were last updated in Endpoint database.
  • Last Login User
  • Machine MAC Address
  • Operating System Version
  • Admin Notes (if any)
  • Admin Status (if any)
  • Top Suspicious Modules (Modules that have an IIOC score > 500). This is based on the value set for "Minimum IIOC Score" field in the Configure Endpoint window. The default value for "Minimum IIOC Score" is 500.
  • Machine IIOC Levels

Quick Look in the Event Analysis View (Version 11.2 and Later)

The following figure is an example of the Context Lookup panel as it appears in the Event Analysis view.

the Context Lookup panel in the Event Analysis view

    

The contextual information or query results displayed in the Context Lookup panel depends on the selected entity and the associated data sources. The Context Lookup panel has separate tabs for each of the data sources. The tabs are: List data source, Archer, Active Directory, Endpoint, Incidents, Alerts, and Live Connect. The following figure displays the Context Lookup panel for a selected entity in the Incident Details view with the Incidents tab in view.

The following table describes the data available on each tab and the supported entities.

                                                
TabDescriptionSupported Entities


(Lists)

Displays all of the list data associated with the selected entity or meta value. The result is sorted by the last updated list.

All entities


(Archer)
Displays asset information along with criticality ratings using the Archer data source.IP, Host, and Mac


(Active Directory)

Displays all user information for the selected user.

User


(NetWitness Endpoint)



Displays the NetWitness Endpoint data source information for the selected entity or meta value, which includes the Machines, Modules, and IIOC levels. Modules are by highest IOC score to lowest IIOC score and IIOC levels are sorted by highest IOC levels to lowest IOC levels.IP, MAC address, and Host

(Incidents)
Displays the list of incidents associated with the selected entity or meta value. The result is sorted by newest incidents to oldest incidents.

All entities


(Alerts)
Displays the list of alerts associated with the selected entity or meta value. The result is sorted by newest alerts to oldest alerts.All entities

(Live Connect)
Displays information related to Live Connect.

IP, Domain, and Filehash

Lists Tab

The Context Lookup panel for Lists shows one or more lists associated with the selected entity or meta value. The following figure is an example of the Context Panel for Lists, and the table describes the fields.

                                           

FieldDescription
NameThe name of the list (defined while creating the list).
DescriptionThe description of the list (defined while creating the list).
AuthorThe owner who created the list.
CreatedThe date when the list was created.
UpdatedThe date when the list was last updated or modifed.
CountThe number of lists in which the selected entity or meta value is available.
Time WindowThe time window based on the value set for the "Query Last" field in the Configure Responses dialog. By default, all Lists data is fetched.

Last Updated

The time when Context Hub fetched and stored the lookup data in cache.

Archer Tab

The Context Lookup panel for Archer displays asset information along with criticality ratings using the Archer data source for IP, Host, and Mac entities. The following figure is an example of the Context Lookup panel for Archer, and the table describes each field.


                                                               
FieldDescription
Criticality RatingThe device operational criticality based on the applications it supports. The criticality ratings can be set as Not Rated, Low, Medium-Low, Medium, Medium-High, or High.
Risk RatingThe calculated risk rating for the device based on the most recent assessment and the average risk rating of facilities using the device. The risk rating can be set as Severe, High, Medium, Low, or Minimal.
Device NameThe unique name of the device.
Host NameThe host name of the device.
IP AddressThe primary internal IP address of the device.
Device IDThe automatically populated value that uniquely identifies the record across all applications within the system.
TypeThe device type, for example, server, laptop, desktop, and others.
FacilitiesLinks to records in the Facilities application that are related to this device.
Business UnitLinks to records in the Business Unit application that are related to this device. For more than three business unit values, you can hover over the field to view the values.
Device OwnerThe person who is responsible for the device and receives read and update rights of the record.

Count

The number of assets available.

Time Window

The time window based on the value that is set for the "Query Last" field in the Configure Responses dialog. By default, all data for Archer is fetched.
Last Updated The time when Context Hub fetched and stored the lookup data in cache.

Note: In the localized versions, only these twelve fields are displayed: Criticality Rating, Risk Rating, Device Owner, Business Unit, Host Name, MAC Address, Facilities, IP Address, Type, Device ID, Device Name, and Business Processes.

  

Active Directory Tab

The following figure is an example of a Context Lookup panel for Active Directory.

 

The Context Lookup panel for Active Directory displays all the related information, incidents, and alerts for a user. You can perform a look up using the following formats:

  • userPrincipalName
  • Domain\UserName
  • sAMAccountName

If the user exists in multi-domain or multi-forest, all the related context information is displayed for the specific user.

The following information is displayed for Active Directory.

                                                                               
FieldDescription

Display Name

The name of the user.

Employee ID

The employee ID of the user.

Phone

The phone number of the user.

Email

The email ID of the user.

AD User ID

The unique identification of the user within an organization.

Job Title

The designation of the user.

Manager

The name of the user's manager.

Groups

The list of groups of which the user is a member.

Company

The name of the user's company.

Department

The department name to which the user belongs within the organization.

Location

The location of the user.

Last Logon

The time when the user logged into the system, only if the Global Catalogue is defined.

Last Logon TimeStampThe time when the user logged into the system.
Distinguished NameThe unique name assigned to the user.
Count

The number of users.

Time Window

The time window based on the value that is set for the "Query Last" field in the Configure Data Source Settings dialog. By default, all data for Active Directory is fetched.

Last Updated

The time when Context Hub fetched and stored the lookup data in cache.

  

NetWitness Endpoint Tab

The following figure is an example of the Context Lookup panel for NetWitness Endpoint.

 

The following information displayed for IIOCs.

                                           
FieldDescription
# Of ModulesThe number modules that are looked up.
Admin StatusThe admin status (if any).
Last UpdatedThe time when the data was last refreshed.
Last LoginThe time when the user last logged in.
MAC AddressThe Machine MAC Address.
Operating SystemThe Version of the Operating System used by the NetWitness Endpoint machine.
Machine StatusThe state of the module being viewed: Online, Offline, Active, or Inactive.
IP AddressThe IP address of the specific module.

The following information is displayed for modules.

                               
FieldDescription
IIOC ScoreA machine IIOC score is an aggregated score based on the module scores. This is based on the value set for Minimum IIOC Score field in the Context Hub Data Source Settings dialog. The default value for Minimum IIOC Score is 500. See "Configure Context Hub Data Source Settings" in the Context Hub Configuration Guide.
Module NameThe name of the module that is being looked up.
Analystic ScoreThe number of active files for the selected machine.
Machine Count The number of machines on which that particular IOC got triggered.
SignatureIndicator of whether the file is signed or unsigned, valid or invalid, and signatory information. For example, Google, Apple, and so on.

The following information is displayed for machines.

                                   
FieldDescription

IOC Levels

The IOC levels.

DescriptionThe description for he IOC level if available.
Last executed The time when the action was executed.

Count

The number of hosts that are being looked up.

Time WindowThe time window based on the value set for the Query Last field in the Configure Data Source Settings dialog. By default, all data for NetWitness Endpoint is fetched.
Last UpdatedThe time when scan results were last updated in NetWitness Endpoint database.

Alerts Tab

The following figure is an example of Context Panel for Alerts that is displayed based on time first (Newest to Oldest) and then severity.

 

The following information is displayed in the Context Lookup panel for Alerts.

                                               
FieldDescription
CreatedThe date and time when the alert was created.
SeverityThe severity value of the alerts.
Name The name of the alert. You can click the name to view the details of a specific alert.
SourceThe alert source name from which the alert is triggered.
#EventsThe number of events associated with the alert.
Incident IDThe ID of the incident (if any) with which the alert is associated. You can click the ID to view the details of a specific alert.

Count

The number of alerts. By default only the first 100 alerts are displayed. For more information on how to configure the settings, see "Configure Context Hub Data Source Settings" in the Context Hub Configuration Guide.

Time Window

The time window based on the value set for the Query Last field in the Configure Data Source Settings dialog. By default, the alert data for last 7 days is fetched.

Last UpdatedThe time when contextual data was last fetched from data source.

Incidents Tab

The following figure is an example of the Context Panel for Incidents, which is based on time first (Newest to Oldest) and then priority status.

 

The following information is displayed in the Context Lookup panel for Incidents.

                                                       
FieldDescription
CreatedThe date when the incident was created.
PriorityThe priority status of the incidents.
Risk ScoreThe risk score of the incidents.
IDThe Incident ID of the incident. You can click on the ID to display further details about the incident.
NameThe incident name.
StatusThe status of the incident
AssigneeThe current owner of the incident.
AlertsThe number of alerts associated with the incident.

Count

The number of incidents. By default only the first 100 incidents are displayed. For more information on how configure the settings, see "Configure Context Hub Data Source Settings" in the Context Hub Configuration Guide.

Time Window

The time window based on the value set for the Query Last field in the Configure Data Source Settings dialog. By default, the alert data for last 7 days is fetched.

Last UpdatedThe time when contextual data was last fetched from data source.

Live Connect Tab

The following figure is an example of a Context Panel for Live Connect, and the table describes the information displayed.

                                                       

FieldDescription
Review Status

The review status of the selected Live Connect entity (IP, file, or domain) based on the analyst activity. This gives the visibility of the analyst activity within an organization.

Status
Below are the types of status:

  • New: Lookup results for an IP address are viewed for the first time within the organization.
  • Viewed: Any analyst within the organization has already viewed the lookup results for an IP address.
  • Marked as Safe: Any analyst within the organization has already viewed the lookup results and marked the IP address as safe.
  • Marked as Risky: Any analyst within the organization has already viewed the lookup results and marked the IP address as risky.
Risk Assessment

The risk assessment for the selected Live Connect entity (IP, file, or domain) based on the Live Connect analysis and analyst feedback. The Risk Assessment categories are:

  • Safe: The Live Connect entity is considered to be safe.
  • Unknown: Live Connect does not have enough information about this entity to calculate the risk.
  • High Risk: Marked as high risk based on the analysis and risk reasons provided by the community. Entities marked as high risk require immediate attention.
  • Suspicious: Marked as suspicious based on the analysis and risk reasons provided by the community. The analysis indicates potentially threatening activity that requires action.
  • Unsafe: Marked as unsafe based on the analysis and risk reasons provided by the community.
The entity is rated as High Risk, Suspicious, or Unsafe and displays the associated risk reasons accordingly.
Risk Assessment Feedback

 

Risk Assessment Feedback allows the analyst to submit threat intelligence feedback about an entity to the Live Connect server.

  • Analyst Skill Level
    Below are the Analyst skill level options:
    • Tier 1 - Analysts at this level define procedures for remediation, and decide if an incident should be escalated to other areas in a Security Operation center (SOC). This is the default value.
    • Tier 2 - Analysts who investigate incidents and capture intelligence from an investigation to feed back into the various workflows in a SOC.
    • Tier 3 - Analysts who share the investigation results to the SOC organization. They generally manage incidents and have a wide breadth and depth of skills and tools necessary for incident response.

    Note: While creating a new user for NetWitness Platform (Analyst), an administrator should be able to identify the user as Tier 1, Tier 2, or Tier 3 Analyst.

  • Risk Confirmation - The risk confirmation for the selected Live Connect entity (IP, file, or domain). The Risk confirmation categories are:
    • Safe: The Live Connect entity is considered to be safe.

    • Unknown: The analyst does not have enough information to provide a risk confirmation

    • High Risk: Marked as high risk based on the analysis and risk reasons provided by the community. Entities marked as high risk require immediate attention.
    • Suspicious: Marked as suspicious based on the analysis and risk reasons provided by the community. The analysis indicates potentially threatening activity that requires action.
    • Unsafe: Marked as unsafe based on the analysis and risk reasons provided by the community.
  • Confidence Level - The confidence level of an analyst in providing feedback for the Live Connect entity. The confidence level categories are: High, Medium, and Low.
  • Risk Indicator Tags - Allows you to select a tag category based on the analysis.
Community Activity

Community activities such as:

  • Date first seen in the community.
  • Time since the IP/File/Domain was seen for the first time (Current time - First seen time).

Trending Community Activity:

If the IP address is known within the RSA community, a graphical representation of the community activity trend is displayed for the following:

  • Users (in %) who have viewed the IP address in the Live Connect community over time.
  • Users (in %) who submitted feedback for the IP address.
  • Users (in %) who marked the IP address as unsafe over time.

Risk Indicators

 

Risk indicators are highlighted based on the tags that are assigned by the community to the entities (IPs, Files, or Domains).

The tags are categorized as follows: Reconnaissance, Delivery, Command and Control, Lateral Movement, Privilege Escalation, and Packaging and Exfiltration.

These tags are samples and vary based on the inputs received from the community on the Live Connect server. The analyst can choose the appropriate risk indicator tags while providing the review feedback. A highlighted tag indicates that the selected entity is associated with that particular category and tag. Clicking a highlighted tag displays the description of the tag.

Identity

Provides the following identity information for the selected entity or meta value:

For IP address: Autonomous System Number (ASN), Prefix, Country Code and Country Name, Registrant (Organization), and Date.

For File Hash: File Name, File Size, MD5, SH1, SH256, Compile Time, and Mime Type.

For Domain: Domain Name and Associated IP Address.

Certificate Information

Provides the following certificate information for the selected file hash: Certificate Issuer, Validity of the Certificate, Signature Algorithm, and Certificate Serial Number.

WHO IS Information

 

The WHO IS information provides the ownership details for a given domain.

The following information about the domain owner is displayed: Created Date, Updated Date, Expired Date, Type (Registration Type), Name, Organization, Address with Postal code, Country, Phone, Fax, and Email.

Related Files

Related Files are displayed for entity types IP and Domain. A list of known associated files is displayed along with the following information: Live Connect Risk Rating (Safe, Risky, or Unknown), File Name, MD5, Compile Time and Date, API Function, Import Hash, and Mime Type.

Related Domains

Related Domains are displayed for entity types IP and Files. A list of known associated domains is displayed along with the following information: Live Connect Risk Rating (Safe, Risky, or Unknown), Domain Name, Country Name, Registered Date, Expired Date, and Registrant Email address.

Related IPs

 

Related IPs are displayed for entity types Domain and Files. A list of known associated IPs is displayed along with the following information: Live Connect Risk Rating (Safe, Risky, or Unknown), IP Address, Domain Name, Country Code and Country Name, Country Name, Registered Date, Expired Date, and Registrant Email address.

    

 

You are here
Table of Contents > Investigate Reference Materials > Context Lookup Panel

Attachments

    Outcomes