Another cool integration as part of the 40 Analyzer is the integration with MIT
RE and their attack
framework and they spelled that A-T-T-AT sign C-K. So MITRE is a nonprofit
organization,
at least it is today, that works with many different organizations including
government
agencies like the Department of Defense and the Department of Homeland Security
here in the US
regarding security challenges. And one of their biggest offerings is their
attack framework.
And again they have an at symbol there instead of the A. So the attack is also WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And again they have an at symbol there instead of the A. So the attack is also
an acronym and
it stands for adversarial tactics, techniques, and common knowledge. So that's
the acronym A-T-T-N
the outside common knowledge. And some of the key components there are looking
at things like
what are the tactics, for example the goals an attacker is trying to achieve
and what techniques
are they using, for example things like phishing or compromising
vulnerabilities that exist in systems
or protocols, and as well as some best practices to prevent or identify those WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or protocols, and as well as some best practices to prevent or identify those
types of techniques.
So it's often common that the minor attack framework is leveraged or used for
things like
threat detection and response, threat hunting, the red team, blue team or pen
testing,
or looking for security gaps for vulnerabilities in an organization, or
integration with platforms
like Splunk or in this case Fortinet and Microsoft they're also leveraging that
information and
that framework. And in the case of Fortinet analyzer a lot of that information
is integrated as part
of Fortinet analyzer. So let me share with you some of that common integration WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of Fortinet analyzer. So let me share with you some of that common integration
with the
minor attack framework and the Fortinet analyzer. We'll do that by heading over
to the Fortinet analyzer.
So back here the Fortinet analyzer are going to running firmware version 763
feature which is the
latest and greatest as of this recording and we're here in license information
let me expand that.
And I currently have licenses for indicators of compromise, outbreak detection,
security
automation, but what I don't have a license for is the ICS components for
industrial control systems
and OT which stands for operational technologies associated with it. But based WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and OT which stands for operational technologies associated with it. But based
on what I do have,
let's go down to incident events and under incident events, let's start off by
going back to event
handlers. So these are currently we're looking at the let me make sure I have
it selected correctly.
Let's just show the predefined event handlers. That's what we see right here.
So if we select one
these let's select the default botnet communication detection by threat. So we
'll double click on that.
So here are as many rules any of which in this basic event handler if they're
matched
is going to go ahead and create an event. But in addition to this basic event WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is going to go ahead and create an event. But in addition to this basic event
handler,
it's also identifying the miter tech ID and that's these two the t 1584.005 bot
net and the t 1071
application layer protocol, which are all selected from the dropdown. If we're
adding miter tech
IDs, for example, in a custom event handler. So for example, for this one, let
's go ahead and
click there and let's go ahead and just type in botnet. So that's going to
refine the list based
on the filter to just those that have botnet in it. And there's the t 1584, 005 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on the filter to just those that have botnet in it. And there's the t 1584, 005
botnet that is
currently selected. So if we want to see the various event handlers that are
supported and covered,
we can see that very easily as well right here in the 40 analyzer by going
under incidents and
events going to incidents and check this out. So here's our incident right
there that we worked on
the previous couple of videos, but also here with instance selected on the left
on the top we have
a second tab for miter attack and from a dropdown. There's an option for
coverage and that shows us
how we're covered for the 222 event handlers and showing 65 coverage. If you WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
how we're covered for the 222 event handlers and showing 65 coverage. If you
want to know how
we're covered, we simply hover over one that's non zero. So for example, here
we have five,
which is about scanning blocks of IP addresses, vulnerability scanning, word
less scanning,
right here exploit public facing applications. We have 78. If we click here on
the hyperlink effect,
let's go ahead and do that. It'll open up a new tab and it'll take us to the
specifics regarding
that miter attack framework and that specific aspect right there. Then from WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that miter attack framework and that specific aspect right there. Then from
here, regarding
coverage, it can show us how many event handlers are regarding that specific
aspect in this case,
the exploit public facing applications. If you go over here to privilege
escalation for those
techniques for boot log on or auto start execution and showing five. So here
showing us the whole
list and has, you know, two plus one plus one, which is the five that are
covered on this 40
analyzer regarding event handlers. Another cool option is that if we go over to
one of our tiles
here, let's go to initial access external remote services. If we click on the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here, let's go to initial access external remote services. If we click on the
hyperlink,
it's going to take us to a separate page about that detail. However, if we
click on the free space
here, it's going to show us and then go ahead and error this over a little bit,
it's going to show
us those four handlers that are covering those types of attacks. So here's
showing the top one
is enabled and the third one down is enabled. And these two are not. However,
if we want to
enable them, we go back to our event handlers and we could go ahead and enable
them. So if I scroll
this a little bit to the left to give our columns a little more space, they WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this a little bit to the left to give our columns a little more space, they
give us more detail. We
can have a little bit more real estate to look at. So here in the event handler
column, we can go
ahead and click on the hyperlink for the event handler and it'll take us to the
details for that
event handler. And if we scroll down because it's a basic event handler, it has
two roles and either
one if they're matched, we'll go ahead and create an event. And if we want it
to also go ahead and
automatically create an incident, we can just enable the creation of an
incident right there
and click on OK. So that's showing the coverage and then if we use the drop
down here and we need to
attack, this can show us what it's actually identified based on the timeframe, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
attack, this can show us what it's actually identified based on the timeframe,
which is the last week.
And I'm going to go ahead and say, let's look at the last three weeks. So one
brute force,
I think we did that one today. Yep, yep, yep. Active scanning a while back. So
we could go ahead
and for example, double click here here showing us the events that were created
by this event
handler. And if we click here on incident, it would show us any instance where
those events were
a part of that. So when we go back to events, right click and click here on
event count of one,
then it'll open up a new window. And then from here, I'm going to right click WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
then it'll open up a new window. And then from here, I'm going to right click
and I'm going to go
ahead and create a new incident from that and click on OK. So now we have a new
incident. So now if we
go back to the original page here regarding our brute force login attempts, I'm
going to go ahead
and close that and I refresh the page now it's showing for brute force one and
one. And so the one
here is representing the fact that we have an event and here it's also
indicating that we have
one incident. So if we double click on the free space there, here's the event
and also now incident
wise, it's associated with this incident. So then we can take that incident and
continue to work with
it and investigate until we close that incident. So we go ahead and close that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it and investigate until we close that incident. So we go ahead and close that.
So that's the first
one here for MITRE attack regarding what's actually covered by the 40 analyzer.
Again, green means
more coverage yellow means less and no color in the background at all means it
's not covered.
Then if we go to attack, it's showing us both the event as well as any
incidents associated
regarding that MITRE framework element. The second tab here is for MITRE attack
ICS and that's the
industrial control systems and operational technology. So if you're looking for
coverage,
so here for coverage is showing what's covered. Unfortunately, I don't have the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so here for coverage is showing what's covered. Unfortunately, I don't have the
license for
operational technologies on this 40 analyzer. And as a result, it's not going
to be too effective,
even though there are some prebuilt event handlers there. And then we go down
to actual
attack. We're not going to have any results here because we don't have licenses
available on the
40 analyzer looking for those specific elements again due to the lack of a
license. But I do have
these right here under MITRE attack and at the moment this is what's covered
and again from the
dropdown it can go ahead and show us the actual attacks which includes events
as well as incidents WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as well as incidents
associated with that.