XDR, EDR, XSOAR, SIEM, UEBA Flashcards
What does UEBA stand for?
User and Entity Behavior Analysis
What is UEBA?
security analytics approach that focuses on detecting and analyzing abnormal or suspicious behavior exhibited by users and entities within an organization’s network or system
What does UEBA combine to establish baseline behavior patterns of users and entities (devices, applications, servers, …) within an organization’s environment?
- machine learning
- statistical analysis
- behavioral modeling
What is the benefit of combining UEBA with SIEM?
organizations can correlate behavioral anomalies with other security events and log data, providing a more comprehensive view of potential threats
What are the three parts of UEBA?
-
use cases
- establishes what’s the normal behavior
-
data sources
- defines what to capture and what to watch for
-
analytics
- machine learning and AI compare the normal behavior to the current behavior of the entities in order to catch anything suspicious
What does SOAR stand for?
Security Orchestration, Automation, and Response
What is SOAR?
framework that combines security orchestration, security automation, and incident response into a unified approach
What is the goal of SOAR?
improve the efficiency and effectiveness of security operations by automating repetitive tasks, orchestrating security processes, and enabling faster incident response and remediation
What tasks are included in security automation in terms of SOAR? (8)
Stop and think
-
Threat Intelligence Gathering and Enrichment
- automatically collecting and aggregating threat intelligence from various sources
-
Alert Triage and Prioritization
- analyzing and filtering security alerts to identify false positives and prioritize real threats
-
Incident Response and Remediation
- executing predefined response procedures for common types of incidents
-
Workflow and Process Automation
- automating routine tasks and workflows to streamline security operations
-
Vulnerability Management
- automatically applying security policies across the network
-
Phishing Response
- automating the analysis and response to reported phishing emails
-
Threat Hunting
- automating the search for indicators of compromise or suspicious activities within the network
-
Case Management
- automatically generating incident reports and maintaining case logs
In terms of purpose and focus, what are the differences between SIEM and SOAR?
-
SIEM systems
- primarily designed to collect, correlate, and analyze security event logs and data from various sources
- real-time monitoring, threat detection, and incident response capabilities
-
SOAR platforms
- focus on automating and orchestrating security processes, including incident response, vulnerability management, and security operations
What does EDR stand for?
Endpoint Detection and Response (EDR)
What’s the goal of EDR?
detect abuses that are potentially more advanced than what can be detected by traditional antivirus or HIDSs, while optimizing the response time of incident response, discarding false positives, implementing blocking for advanced threats, and protecting against multiple threats occurring simultaneously and via various threat vectors
What’s Managed Detection and Response (MDR)?
cybersecurity service model in which an external company or Managed Security Service Provider (MSSP) is responsible for monitoring an organization’s IT environment, detecting security threats and incidents, and responding to them on behalf of the organization
What’s EDR?
- evolution of traditional antimalware products
- seeks to detect, record, evaluate, and respond to suspicious activities and events, which may be caused by problematic software or by valid and invalid users
- natural extension of continuous, monitoring focusing on both the endpoint device itself and network communications reaching the local interface
- some EDR solutions employ an on-device analysis engine whereas others report events back to a central analysis server or to a cloud solution
What are common features of EDR solutions?
- auditing a device for common vulnerabilities
- proactively monitoring a device for suspicious activity such as unauthorized logins, brute-force attacks, or privilege escalations
- visualizing complex data and events into neat and trendy graphs
- recording a device’s normal operating behaviour to help with detecting anomalies
What are the two basic log source types that SIEM handles?
- Host-Centric Log Sources
- Network-Centric Log Sources
What are the key features provided by SIEM?
- correlation between events from different log sources
- provide visibility on both Host-centric and Network-centric activities
- search through the logs
- real-time log Ingestion
- alerting against abnormal activities
- protection against the latest threats through early detection
- hunt for threats that are not detected by the rules in place
What are the different ways that SIEMs handle log ingestions from clients?
-
Agent / Forwarder
- lightweight tool called an agent that gets installed in the Endpoint
- configured to capture all the important logs and send them to the SIEM server
-
Direct Event Log Collection
- using Windows native event forwarding
-
Syslog
- collect data from various systems like web servers, databases, etc., are sent real-time data to the centralized destination
-
Manual Upload
- users can ingest offline data for quick analysis
-
Port-Forwarding
- listen on a certain port, and then the endpoints forward the data to the SIEM instance on the listening port
What are the responsibilities of SOC analysts?
- monitoring and Investigating
- identifying False positives
- tuning Rules which are causing the noise or False positives
- reporting and Compliance
- identifying blind spots in the network visibility and covering them
How does SIEM look for unwanted behavior or suspicious pattern within the logs?
with the help of the conditions set in the rules by the analysts
What are correlation rules in SIEM?
logical expressions set to be triggered under certain conditions
- if a User gets 5 failed Login Attempts in 10 seconds - Raise an alert for Multiple Failed Login Attempts
- if login is successful after multiple failed login attempts - Raise an alert for Successful Login After multiple Login Attempts
What are some of the actions that are performed after an analysis in SIEM?
-
Alert is False Alarm
- may require tuning the rule to avoid similar False positives from occurring again
-
Alert is True Positive
- perform further investigation
- contact the asset owner to inquire about the activity.
-
Suspicious Activity Is Confirmed
- isolate the infected host
- block the suspicious IP
What are some of the most common and popular SOAR solutions?
- Splunk Phantom
- IBM Security Resilient
- Palo Alto Networks Cortex XSOAR
- Rapid7 InsightConnect
- Siemplify (now part of Google Cloud)
What is a playbook in SOAR?
a set of predefined procedures and workflows designed to automate and orchestrate the response to cybersecurity incidents
What are the advantages of EDR over an antivirus solution?
- provides more comprehensive behavioral-based detection
- extensive response and remediation options
- continuous and detailed endpoint monitoring
- proactive threat hunting capabilities
- better integration within a larger cybersecurity infrastructure
What is the difference in visibility between EDR and antivirus?
- EDR captures data such as process executions, network connections, and registry changes
- AV solutions generally have a narrower focus, primarily monitoring for file-based threats
What does XDR stand for?
Extended Detection and Response (XDR)
How does XDR differ from EDR in terms of scope and focus?
extends beyond endpoints to include network traffic, cloud environments, email systems, and servers - integrates data from various security layers, offering a more holistic view of an organization’s security posture
How does XDR differ from EDR in terms of complexity and user experience?
XDR aims to simplify the security operation by providing a more integrated and automated approach
What is the main advantage of an organization having a SOC team?
organizations can enhance their security incident handling through continuous monitoring and analysis
What are the key SOC capabilities?
- Monitoring and Detection
- Incident Response
- Threat Intelligence
- Log Management
- Recovery and Remediation
- Security Process Improvement
What are some of the log challenges?
- Alert fatigue
- Disparate tools
- Manual Processes
- Talent Shortage
What is Security Orchestration?
- act of connecting and integrating security tools and systems into seamless workflows
- orchestration chains together individual security tools, tasks and processes to work together towards the same tune
- works in tandem with automation
What is a security playbook?
also Standard Operating Procedure (SOP)
structured checklist of actions used to detect, respond and handle threat incidents
How do security playbooks assist SOC teams?
having an end-to-end process of handling routine incidents and establishing repeatability and metrics for the response
What are runbooks?
predefined procedures to achieve a specific outcome and have a high degree of automation
What is the workflow of a SOAR?
-
Detection
- triggered and detected by an integrated security system (NIDS, SIEM …)
-
Enrichment
- TI gathered from feeds, reports and other sources to provide additional context about the event, such as TTPs
-
Triage
- SOAR analyse the event, determining its severity and potential impact on the organisation
-
Response
- automated actions are set in motion to contain the threat and mitigate any potential damage (block IP, remove attachments)
-
Remediation
- RCA of the event is done through the coordinating efforts of security analysts and incident responders
-
Reporting
- communication and reports about the incident and remediation are standardised to ensure a reliable and repeatable flow of information involving both internal and external stakeholders
What does EDR monitor?
- Process Execution
- File Activity
- Network Activity
- Registry Changes
- Memory and Disk Access
- User Login Activity
- Application Activity
- Anomalies and Behavior Patterns
Where does UEBA processing usually occur?
client vs server
typically, the processing occurs within the SIEM system (like QRadar) rather than on the client - requires analyzing a large volume of data and complex behavioral patterns, which is more efficiently handled at the server level where the SIEM system resides
What is the primary factor that distinguishes XDR from EDR?
XDR extends beyond endpoints to provide a more holistic view of threats across the entire network and cloud environment - integrates data from endpoints, network, cloud, and email, offering broader visibility and context for threat detection and response
Is there any way for an administrator to fine-tune learned UEBA profiles?
- yes, although the level of customization can vary between different solutions
- can adjust parameters such as risk scores, thresholds for anomalies, and specific behaviors to monitor more closely
