Speaker 1: Welcome to the deep dive. Today, we're plunging into the
Speaker 1: world of security orchestration, Automation and Response or so ARE,
Speaker 1: specifically for security analysts.
Speaker 2: Yeah s, so ARE.
Speaker 1: It's a big topic, it is, and we've got a
Speaker 1: great resource to guide us, the book Packed Publishing, put
Speaker 1: out just last year July twenty twenty three. So our
Speaker 1: mission today is really to unpack what so ARE is
Speaker 1: all about. You know, why is it so vital now
Speaker 1: in today's cybersecurity world.
Speaker 2: And maybe most importantly, how it kind of acts like
Speaker 2: a best friend for sec.
Speaker 1: Analysts exactly, those analysts on the front lines trying to
Speaker 1: deal with this constant flood of threats.
Speaker 2: Absolutely, and for you the listener, we know you're probably
Speaker 2: juggling a lot, maybe preparing for a discussion, trying to
Speaker 2: get a handle on new.
Speaker 1: Tech, or maybe just curious.
Speaker 2: Right, we're just playing curious. The challenge is staying informed
Speaker 2: without getting you know, completely swamped.
Speaker 1: So our goal is to pull out the key insights
Speaker 1: from this book for you, give you the essentials, but
Speaker 1: hopefully without drowning you in technical jargon.
Speaker 2: We'll try our best.
Speaker 1: Okay, So, why is this such a hot topic right now?
Speaker 1: The book makes it pretty clear, doesn't it.
Speaker 2: It really does traditional security measures they're struggling, especially against
Speaker 2: the sophisticated attacks we see today. Yeah.
Speaker 1: The book even uses some interesting historical parallels like the
Speaker 1: Trojan horse.
Speaker 2: Right, that classic deception bypassing strong.
Speaker 1: Walls and the fall of constantinople legendary defenses. But well,
Speaker 1: attackers adapt, methods evolve.
Speaker 2: It really drives home that point. Attackers don't stand still.
Speaker 2: And the book links this to other modern pressures too,
Speaker 2: like what, well, there's this increased public awareness about data privacy.
Speaker 1: For one, people care more, and the huge risks financial
Speaker 1: reputational from attacks. We've all seen the headlines Colonial pipeline
Speaker 1: Marriott exactly.
Speaker 2: Those are big wake up calls. Plus the whole idea
Speaker 2: of a network perimeter, it's getting really blurry.
Speaker 1: Oh yeah, remote work people using their own devices byod.
Speaker 2: It all makes those traditional digital walls you know, less effective.
Speaker 2: The old playbook isn't enough.
Speaker 1: And that's precisely where SR comes in, right as the solution,
Speaker 1: that's the idea.
Speaker 2: It's designed to tackle these challenges head on. SEC teams
Speaker 2: are often buried in alerts.
Speaker 1: Uh huh.
Speaker 2: Alert fatigue is real, it is and there's often a
Speaker 2: shortage of skilled analysts too, so SR promises to help
Speaker 2: by automating.
Speaker 1: Responses, reducing that alert fatigue, spreamlining investigations, and ultimately just
Speaker 1: speeding up how quickly incidents get resolved.
Speaker 2: That's the core promise.
Speaker 1: Yeah, okay, let's unpack the core elements of SR then,
Speaker 1: based on the book, what's fundamental?
Speaker 2: Right? So the foundation, according to the source, has a
Speaker 2: few key pillars. First up, incident management.
Speaker 1: Okay, what does that involve.
Speaker 2: It's the basics of handling security events in a structured way.
Speaker 2: Think incident queues, a central place to see everything.
Speaker 1: So things don't slip through the cracks exactly.
Speaker 2: Avoids analysts working in silos missing stuff, especially when alerts
Speaker 2: are flying in. Then you need clear ownership who's dealing.
Speaker 1: With this right?
Speaker 2: Accountability define severity levels helps prioritize status tracking, where are
Speaker 2: we with this, the ability to add comments, tags for organization,
Speaker 2: collaboration features basically shared understanding, and the book mentions investigation
Speaker 2: spaces too, places to actually dig.
Speaker 1: In and crucially capturing lessons learned afterwards.
Speaker 2: Oh absolutely, yeah, that's vital for continuous improvement. You have
Speaker 2: to learn from what happened.
Speaker 1: And the book also talks about aligning this with frameworks
Speaker 1: like NIST and SANDS.
Speaker 2: Yes, exactly, NIS the National Institute of Standards and Technology
Speaker 2: and the SANDS Institute. They provide established cybersecurity frameworks best practices.
Speaker 1: Why is that important?
Speaker 2: Well, Using frameworks like these gives you a structured approach.
Speaker 2: They cover the whole life cycle.
Speaker 1: Preparation getting ready before anything happens, right.
Speaker 2: Then detection and analysis or identification as SANS calls it,
Speaker 2: figuring out what's going on, then stopping it, Containment, then eradication,
Speaker 2: stopping the spread, getting rid of the threat, then recovery
Speaker 2: getting back to normal, and finally post incident activity. Lessons
Speaker 2: learned that feedback loop is critical for getting better and
Speaker 2: refining your defenses. Following these helps everyone speak the same language,
Speaker 2: uses proven methods, and often helps with compliance too.
Speaker 1: Okay, so that's the structured handling. What about the investigation
Speaker 1: itself with an SR.
Speaker 2: That's the next piece The book stresses analysts need a
Speaker 2: dedicated space to investigate effectively. You need a good overview
Speaker 2: of the incident.
Speaker 1: All the key details in one place.
Speaker 2: Yeah, tracking things like IP addresses, host names, user accounts
Speaker 2: involved and it needs to be usable, easy to navigate
Speaker 2: so analysts can respond fast.
Speaker 1: Speed is critical, I guess.
Speaker 2: Definitely, and the book points out how much time can
Speaker 2: be wasted just clicking around trying to find data. So
Speaker 2: a good sor investigation tool helps prioritize based on severity
Speaker 2: other factors, and importantly, it helps with enrichment.
Speaker 1: Enrichment, what's that.
Speaker 2: Pulling an extra context like getting data from thread intelligence
Speaker 2: feeds or seeing if the affected system has known vulnerable
Speaker 2: abilities from your TVM threat and Vulnerability Management system.
Speaker 1: Ah? Okay, So it adds context automatically.
Speaker 2: Ideally yes, Having that enriched info right there helps analysts
Speaker 2: make quicker, smarter decisions early on.
Speaker 1: Got it? Now, let's talk automation. This feels like the
Speaker 1: heart of SOO.
Speaker 2: It really is a core component. The book digs into
Speaker 2: the why, mostly freeing up analysts from repetitive tasks.
Speaker 1: What kind of tasks are we talking about? Things that
Speaker 1: are done over and.
Speaker 2: Over exactly the low hanging fruit, as the source calls it,
Speaker 2: Things like looking up the geolocation of an IP address okay,
Speaker 2: or checking the reputation of a URL is it known
Speaker 2: to be malicious?
Speaker 1: Right? Stuff analysts do constantly.
Speaker 2: Constantly automating those simple checks means the info is just there,
Speaker 2: saves triage time let's analysts focus on harder problems.
Speaker 1: But the book also warns about automating everything right.
Speaker 2: Absolutely, it's a really important point. You can't just automate blindly.
Speaker 2: Why not, Well, the book says you need a clear policy.
Speaker 2: Some critical assets or systems might be a human to
Speaker 2: sign off before an automated action is taken. You don't
Speaker 2: want automation accidentally taking down a key business system makes sense,
Speaker 2: And things like threat hunting that proactive searching for hidden
Speaker 2: threats that needs human intuition, human expertise. You can't fully
Speaker 2: automate that creative, investigative work.
Speaker 1: So automation is a tool, not a replacement.
Speaker 2: Precisely it augments the analyst. The book also mentions getting
Speaker 2: analyst input into the automation workflows and crucially reviewing and
Speaker 2: maintaining those rules. Regularly threats change, so your automation needs to.
Speaker 1: Adapt to Okay, Then there's reporting. How does SO reporting
Speaker 1: differ from say, sim reporting, Sam's collect all the logs
Speaker 1: right right.
Speaker 2: SIME reporting often focuses on visualizing that massive amount of
Speaker 2: log data. So reporting the book explains, is more targeted
Speaker 2: towards the incident response process.
Speaker 1: So tracking the incidents themselves.
Speaker 2: Yes, tracking incidents, measuring how effective the automation is, like
Speaker 2: how many alerts did we close so automatically? What's our
Speaker 2: mean time to resolve? Stuff like that?
Speaker 1: Performance metrics for this SC.
Speaker 2: Exactly overall SC performance. And the book notes that some
Speaker 2: platforms are actually blending SIM and SOLAR now, which makes
Speaker 2: reporting more unified.
Speaker 1: Interesting Okay, And finally, the book briefly mentions Threat of
Speaker 1: Intelligence TI and Threat and Vulnerability Management TVM. How do
Speaker 1: they plug in?
Speaker 2: They provide essential context. TI gives you info about known threats, attackers,
Speaker 2: their methods.
Speaker 1: Like TTPs, tactics, techniques and procedures.
Speaker 2: Right, and TVM tells you about weaknesses in your own systems.
Speaker 1: So connecting those to SO so means when.
Speaker 2: An incident happens, the analyst immediately sees relevant threat intel
Speaker 2: and knows if the targeted system is vulnerable. It helps
Speaker 2: assess the risk and decide how to respond much faster
Speaker 2: and more effectively.
Speaker 1: Okay, that covers the core elements really well. Now, the
Speaker 1: book does give a quick look at some specific SO tools.
Speaker 2: Yeah, it gives an overview of a few big names.
Speaker 2: Microsoft Sentinel so Sore, Lunk so that used to.
Speaker 1: Be called phantom, right, I run a phantom and.
Speaker 2: Google Chronicle sohar which came from Simplify.
Speaker 1: So it doesn't compare every single feature, but gives a
Speaker 1: general idea exactly.
Speaker 2: It looked at common functions across them. Yeah, and you
Speaker 2: know each has its strengths. Splunk sore is known for
Speaker 2: being really customizable, good for complex automation okay, and Google
Speaker 2: Chronicles sr leverages Google's you know, massive threat intelligence and
Speaker 2: data analytics power.
Speaker 1: So what are some of those common functions it points out?
Speaker 2: Well across the board you see solid incident management, those
Speaker 2: cues we talked about, detailed case views, timelines managing the
Speaker 2: investigation life cycle from start to finish. Right then for investigation,
Speaker 2: they usually offer ways to explore the entities involved users devices,
Speaker 2: ips and often have thread hunting features built in makes sense.
Speaker 2: And obviously automation creating rules or playbooks or workflows different
Speaker 2: names for similar concepts to automate actions and coordinate responses
Speaker 2: across different security tools.
Speaker 1: Did it give any specific examples for these platforms.
Speaker 2: It did mention a few For Microsoft Sentinel It talked
Speaker 2: about automational rules triggered by incident creation or updates or
Speaker 2: even alert.
Speaker 1: Creation, so very flexible triggers.
Speaker 2: Yeah. And it highlighted that playbooks are built using Azure
Speaker 2: Logic apps. Think of logic ass as the powerful engine
Speaker 2: underneath that lets you connect to tons of different services
Speaker 2: and build these workflows graphically. It mentioned actions like changing
Speaker 2: status assigning owners automatically for plunks so are. It noted
Speaker 2: the idea of progressing from an event to a formal case,
Speaker 2: using workbooks to guide investigation step by step, and having
Speaker 2: a visual playbook builder.
Speaker 1: Visual builders are usually quite helpful.
Speaker 2: They can be. Yeah. And for Google Chronicle SR it
Speaker 2: mentioned the dashboard for a quick overview case management features
Speaker 2: and explorer view to visualize connections between security events. Ah,
Speaker 2: same relationships exactly and the playbook process with triggers and actions.
Speaker 2: So similar concepts may be implemented slightly differently.
Speaker 1: Right, I make automation really tangible. The book dives a
Speaker 1: bit deeper into Microsoft's Sentinels automation as an example.
Speaker 2: Yeah, that section is useful for seeing how it works
Speaker 2: in practice. It explains Sentinels automation rules first.
Speaker 1: What are the key parts of a rule.
Speaker 2: You've got triggers like when an incident is created, conditions
Speaker 2: like if the incident involves a high value asset or
Speaker 2: if the severity changes to.
Speaker 1: High so you can be specific very and.
Speaker 2: Then the actions which should happen automatically run a playbook,
Speaker 2: change the status, assign it to someone, add a tag.
Speaker 2: Lots of options definitely. The book also mentions setting an
Speaker 2: expiration date for rules, maybe for temporary ones, and defining
Speaker 2: the order they run in if you have multiple rules
Speaker 2: that could apply. Keeps things predictable.
Speaker 1: Okay, And then the playbooks themselves. Those are the actual
Speaker 1: automated workflows.
Speaker 2: Exactly as mentioned. They're built on azule Logic apps. The
Speaker 2: book talks about the visual designer, the connectors to integrate
Speaker 2: with all sorts of things email, ticketing, other security tools APIs.
Speaker 1: So you can connect to almost anything.
Speaker 2: Pretty much es actually using the generic HTTP connector for APIs.
Speaker 2: It also covers how you handle authentication securely using things
Speaker 2: like managed identities or service principles, so the playbook has
Speaker 2: a right permissions without exposing credentials.
Speaker 1: Security for the automation itself important crucial, and the book
Speaker 1: gives a concrete example of automating enrichment right with virus Total.
Speaker 2: Yes, it's a great example. The idea is an incident
Speaker 2: comes in with an IP address or a URL. Instead
Speaker 2: of the analyst manually copying that IP and checking it
Speaker 2: on virus.
Speaker 1: Total, which takes time, right, the.
Speaker 2: Playbook runs automatically. It grabs the IP or URL from
Speaker 2: the incident, uses a virus Total connector to query their
Speaker 2: API for thread intelligence, gets back.
Speaker 1: The reputation any known malicious associations exactly, and.
Speaker 2: Then the playbook automatically adds that information as a comment
Speaker 2: right back into the sentinel incident.
Speaker 1: Ah, so the analyst sees it immediately immediately.
Speaker 2: The book outlines this flow trigger get entities, call API,
Speaker 2: add comment. It doesn't give the code, but it shows
Speaker 2: the purpose us in the value, saves time, provides instant context,
Speaker 2: huge win.
Speaker 1: That really illustrates the power. Well, okay, so wrapping things
Speaker 1: up for you the listener, what are the key takeaways
Speaker 1: from this deep dive into the book on SR.
Speaker 2: Well, hopefully you now have a much clearer idea of
Speaker 2: what SR actually is. It's core parts Internet management, investigation, automation, reporting, TI.
Speaker 1: Integration, and why it's so important today exactly you've seen.
Speaker 2: How these tools help security teams cope with that massive
Speaker 2: volume of threats, automating routine stuff, making investigation smoother.
Speaker 1: Leading to faster, better incident response.
Speaker 2: Right, and those Sentinel examples give you a real sense
Speaker 2: of how it works in practice.
Speaker 1: And like the source materials stressed, staying ahead in cybersecurity
Speaker 1: means adapting using modern tools.
Speaker 2: Like so far, it's not just about buying more.
Speaker 1: Tools, is it, No, it's about orchestrating them, automating them
Speaker 1: smartly to make your security team more efficient, more effective, Which.
Speaker 2: Leads to a good question for you to think about.
Speaker 2: How could these sor principles automation orchestration, centralizing incident management
Speaker 2: apply to the challenges you see in your organization or
Speaker 2: your field.
Speaker 1: Yeah, what are those repetitive tasks, those enrichment steps that
Speaker 1: could maybe be automated? What could free up analyst time
Speaker 1: for the really tricky stuff. It's worth considering, absolutely, And
Speaker 1: remember the world of so is always changing, always evolving.
Speaker 1: I feeling so. We really hope this deep dive service
Speaker 1: is a good starting point. We encourage you explore the
Speaker 1: tools we mentioned, maybe look deeper into those NIST and
Speaker 1: SANDS frameworks.
Speaker 2: Or dig into platforms like Azure logic apps to see
Speaker 2: what's possible with automation.
Speaker 1: Yeah, there's a lot more to discover. This is really
Speaker 1: just scratching the surface.