SOC/SOAR
Last updated
Was this helpful?
Last updated
Was this helpful?
Was this helpful?
Security Operations Center Operations
Wazuh
- HIDS
- OSSEC
MISP
- Threat Intellegence
Zeek/Suricata/Snort
- IDS/IPS
PFSense
- Firewall
Building blocks SOC
People
SOC Analyst
Incident Responders
Threat Hunters
SOC Managers
IT Security/ Compliance/Auditor
Security Architects
Process
Robust
Repeatable playbooks
Guidance with consistency
Technology
Data Collection
Log Sources
Types of SOC's
Proactive SOC
Reactive SOC
SOC Operations
Log Sources
Access Logs
System Activity logs
FTP server logs
Program execution error logs
Database query logs
Webserver access logs
Examples
AD, DC, Azure, Apache, Database logs
Log Management
NIST SP 800-92 guidelines
System Logs
Network Logs
Alert Management
Prioritize True Positives
Discard False Positives
Triage the alert
Resolve
Prevention
Implementing preventive approach
Detection
Unusual traffic
Incident Management
Threat Analysis
How it disrupt organization operations
Incident Response
Resolving the issue
Creating the new detection Rules
Compliance Management
Industry and Government compliance and regulations
Application standards
Protocol Usage
SOC Functions
Threat Detection
Threat Mitigation
Threat Monitoring
Threat Hunting
Troubleshooting the configuration and operational issues
Incident Investigation
Incident Forensics
Industry and government compliance auditing
Few queriers
HTTP status codes
User login country
Application used to login
Request data file
Most clicked links
Most downloaded files
HTTP GET requests
Long tail analysis
Source IP
Destination IP
Destination Port
Periodical updates of Rules/TTP's
Data Management
Threat Detection
Threat Analytics
Log Generation, Transmitting, Storing, Analyzing and Disposing
geolocations
Protocol
Username
Resource
HTTP methods
Status codes
URI query
HTTP request header parse all the parameters useful for analysis