WEBVTT

1
00:00.000 --> 00:06.160
Another cool integration as part of the 40 Analyzer is the integration with MIT

2
00:06.160 --> 00:08.800
RE and their attack

3
00:08.800 --> 00:14.140
framework and they spelled that A-T-T-AT sign C-K. So MITRE is a nonprofit

4
00:14.140 --> 00:15.040
organization,

5
00:15.040 --> 00:19.910
at least it is today, that works with many different organizations including

6
00:19.910 --> 00:20.240
government

7
00:20.240 --> 00:23.520
agencies like the Department of Defense and the Department of Homeland Security

8
00:23.520 --> 00:24.480
here in the US

9
00:24.480 --> 00:28.450
regarding security challenges. And one of their biggest offerings is their

10
00:28.450 --> 00:29.280
attack framework.

11
00:29.280 --> 00:33.590
And again they have an at symbol there instead of the A. So the attack is also
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:29.280 --> 00:33.590
And again they have an at symbol there instead of the A. So the attack is also

12
00:33.590 --> 00:34.640
an acronym and

13
00:34.640 --> 00:40.150
it stands for adversarial tactics, techniques, and common knowledge. So that's

14
00:40.150 --> 00:42.800
the acronym A-T-T-N

15
00:42.800 --> 00:47.840
the outside common knowledge. And some of the key components there are looking

16
00:47.840 --> 00:48.480
at things like

17
00:48.480 --> 00:52.210
what are the tactics, for example the goals an attacker is trying to achieve

18
00:52.210 --> 00:52.800
and what techniques

19
00:52.800 --> 00:55.860
are they using, for example things like phishing or compromising

20
00:55.860 --> 00:58.000
vulnerabilities that exist in systems

21
00:58.000 --> 01:02.670
or protocols, and as well as some best practices to prevent or identify those
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:58.000 --> 01:02.670
or protocols, and as well as some best practices to prevent or identify those

22
01:02.670 --> 01:03.760
types of techniques.

23
01:03.760 --> 01:07.600
So it's often common that the minor attack framework is leveraged or used for

24
01:07.600 --> 01:08.560
things like

25
01:08.560 --> 01:13.520
threat detection and response, threat hunting, the red team, blue team or pen

26
01:13.520 --> 01:14.400
testing,

27
01:14.400 --> 01:18.060
or looking for security gaps for vulnerabilities in an organization, or

28
01:18.060 --> 01:19.360
integration with platforms

29
01:19.360 --> 01:23.760
like Splunk or in this case Fortinet and Microsoft they're also leveraging that

30
01:23.760 --> 01:24.560
information and

31
01:24.560 --> 01:27.750
that framework. And in the case of Fortinet analyzer a lot of that information

32
01:27.750 --> 01:29.440
is integrated as part

33
01:29.440 --> 01:33.500
of Fortinet analyzer. So let me share with you some of that common integration
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
01:29.440 --> 01:33.500
of Fortinet analyzer. So let me share with you some of that common integration

34
01:33.500 --> 01:33.840
with the

35
01:33.840 --> 01:37.440
minor attack framework and the Fortinet analyzer. We'll do that by heading over

36
01:37.440 --> 01:38.480
to the Fortinet analyzer.

37
01:38.480 --> 01:42.490
So back here the Fortinet analyzer are going to running firmware version 763

38
01:42.490 --> 01:43.200
feature which is the

39
01:43.200 --> 01:47.050
latest and greatest as of this recording and we're here in license information

40
01:47.050 --> 01:48.080
let me expand that.

41
01:48.080 --> 01:52.400
And I currently have licenses for indicators of compromise, outbreak detection,

42
01:52.400 --> 01:53.360
security

43
01:53.360 --> 01:57.120
automation, but what I don't have a license for is the ICS components for

44
01:57.120 --> 01:58.800
industrial control systems

45
01:58.800 --> 02:02.960
and OT which stands for operational technologies associated with it. But based
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
01:58.800 --> 02:02.960
and OT which stands for operational technologies associated with it. But based

46
02:02.960 --> 02:04.240
on what I do have,

47
02:04.240 --> 02:08.310
let's go down to incident events and under incident events, let's start off by

48
02:08.310 --> 02:09.360
going back to event

49
02:09.360 --> 02:13.080
handlers. So these are currently we're looking at the let me make sure I have

50
02:13.080 --> 02:14.560
it selected correctly.

51
02:14.560 --> 02:18.660
Let's just show the predefined event handlers. That's what we see right here.

52
02:18.660 --> 02:19.200
So if we select one

53
02:19.200 --> 02:23.440
these let's select the default botnet communication detection by threat. So we

54
02:23.440 --> 02:24.560
'll double click on that.

55
02:24.560 --> 02:28.480
So here are as many rules any of which in this basic event handler if they're

56
02:28.480 --> 02:29.120
matched

57
02:29.120 --> 02:33.600
is going to go ahead and create an event. But in addition to this basic event
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:29.120 --> 02:33.600
is going to go ahead and create an event. But in addition to this basic event

58
02:33.600 --> 02:34.160
handler,

59
02:34.160 --> 02:42.410
it's also identifying the miter tech ID and that's these two the t 1584.005 bot

60
02:42.410 --> 02:44.480
net and the t 1071

61
02:44.480 --> 02:48.520
application layer protocol, which are all selected from the dropdown. If we're

62
02:48.520 --> 02:49.520
adding miter tech

63
02:49.520 --> 02:54.020
IDs, for example, in a custom event handler. So for example, for this one, let

64
02:54.020 --> 02:54.400
's go ahead and

65
02:54.400 --> 02:58.150
click there and let's go ahead and just type in botnet. So that's going to

66
02:58.150 --> 02:59.040
refine the list based

67
02:59.040 --> 03:04.930
on the filter to just those that have botnet in it. And there's the t 1584, 005
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:59.040 --> 03:04.930
on the filter to just those that have botnet in it. And there's the t 1584, 005

68
03:04.930 --> 03:05.760
botnet that is

69
03:05.760 --> 03:09.120
currently selected. So if we want to see the various event handlers that are

70
03:09.120 --> 03:10.480
supported and covered,

71
03:10.480 --> 03:14.170
we can see that very easily as well right here in the 40 analyzer by going

72
03:14.170 --> 03:15.040
under incidents and

73
03:15.040 --> 03:17.920
events going to incidents and check this out. So here's our incident right

74
03:17.920 --> 03:18.880
there that we worked on

75
03:18.880 --> 03:22.690
the previous couple of videos, but also here with instance selected on the left

76
03:22.690 --> 03:23.440
on the top we have

77
03:23.440 --> 03:27.880
a second tab for miter attack and from a dropdown. There's an option for

78
03:27.880 --> 03:29.520
coverage and that shows us

79
03:29.520 --> 03:36.680
how we're covered for the 222 event handlers and showing 65 coverage. If you
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:29.520 --> 03:36.680
how we're covered for the 222 event handlers and showing 65 coverage. If you

80
03:36.680 --> 03:37.120
want to know how

81
03:37.120 --> 03:41.010
we're covered, we simply hover over one that's non zero. So for example, here

82
03:41.010 --> 03:41.680
we have five,

83
03:41.680 --> 03:45.260
which is about scanning blocks of IP addresses, vulnerability scanning, word

84
03:45.260 --> 03:45.920
less scanning,

85
03:45.920 --> 03:52.250
right here exploit public facing applications. We have 78. If we click here on

86
03:52.250 --> 03:53.120
the hyperlink effect,

87
03:53.120 --> 03:56.850
let's go ahead and do that. It'll open up a new tab and it'll take us to the

88
03:56.850 --> 03:58.160
specifics regarding

89
03:58.160 --> 04:02.130
that miter attack framework and that specific aspect right there. Then from
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
03:58.160 --> 04:02.130
that miter attack framework and that specific aspect right there. Then from

90
04:02.130 --> 04:03.120
here, regarding

91
04:03.120 --> 04:07.210
coverage, it can show us how many event handlers are regarding that specific

92
04:07.210 --> 04:08.080
aspect in this case,

93
04:08.080 --> 04:11.880
the exploit public facing applications. If you go over here to privilege

94
04:11.880 --> 04:12.880
escalation for those

95
04:12.880 --> 04:16.990
techniques for boot log on or auto start execution and showing five. So here

96
04:16.990 --> 04:17.840
showing us the whole

97
04:17.840 --> 04:21.920
list and has, you know, two plus one plus one, which is the five that are

98
04:21.920 --> 04:23.200
covered on this 40

99
04:23.200 --> 04:26.790
analyzer regarding event handlers. Another cool option is that if we go over to

100
04:26.790 --> 04:27.600
one of our tiles

101
04:27.600 --> 04:31.440
here, let's go to initial access external remote services. If we click on the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
04:27.600 --> 04:31.440
here, let's go to initial access external remote services. If we click on the

102
04:31.440 --> 04:32.160
hyperlink,

103
04:32.160 --> 04:36.120
it's going to take us to a separate page about that detail. However, if we

104
04:36.120 --> 04:37.200
click on the free space

105
04:37.200 --> 04:40.450
here, it's going to show us and then go ahead and error this over a little bit,

106
04:40.450 --> 04:41.040
it's going to show

107
04:41.040 --> 04:46.600
us those four handlers that are covering those types of attacks. So here's

108
04:46.600 --> 04:47.440
showing the top one

109
04:47.440 --> 04:51.250
is enabled and the third one down is enabled. And these two are not. However,

110
04:51.250 --> 04:51.920
if we want to

111
04:51.920 --> 04:55.450
enable them, we go back to our event handlers and we could go ahead and enable

112
04:55.450 --> 04:57.280
them. So if I scroll

113
04:57.280 --> 05:00.300
this a little bit to the left to give our columns a little more space, they
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
04:57.280 --> 05:00.300
this a little bit to the left to give our columns a little more space, they

114
05:00.300 --> 05:01.520
give us more detail. We

115
05:01.520 --> 05:03.910
can have a little bit more real estate to look at. So here in the event handler

116
05:03.910 --> 05:04.640
column, we can go

117
05:04.640 --> 05:07.950
ahead and click on the hyperlink for the event handler and it'll take us to the

118
05:07.950 --> 05:08.880
details for that

119
05:08.880 --> 05:12.430
event handler. And if we scroll down because it's a basic event handler, it has

120
05:12.430 --> 05:13.520
two roles and either

121
05:13.520 --> 05:17.730
one if they're matched, we'll go ahead and create an event. And if we want it

122
05:17.730 --> 05:19.120
to also go ahead and

123
05:19.120 --> 05:22.780
automatically create an incident, we can just enable the creation of an

124
05:22.780 --> 05:24.000
incident right there

125
05:24.000 --> 05:27.980
and click on OK. So that's showing the coverage and then if we use the drop

126
05:27.980 --> 05:29.120
down here and we need to

127
05:29.120 --> 05:33.200
attack, this can show us what it's actually identified based on the timeframe,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
05:29.120 --> 05:33.200
attack, this can show us what it's actually identified based on the timeframe,

128
05:33.200 --> 05:34.160
which is the last week.

129
05:34.160 --> 05:37.470
And I'm going to go ahead and say, let's look at the last three weeks. So one

130
05:37.470 --> 05:38.240
brute force,

131
05:38.240 --> 05:42.660
I think we did that one today. Yep, yep, yep. Active scanning a while back. So

132
05:42.660 --> 05:43.440
we could go ahead

133
05:43.440 --> 05:47.460
and for example, double click here here showing us the events that were created

134
05:47.460 --> 05:48.080
by this event

135
05:48.080 --> 05:52.020
handler. And if we click here on incident, it would show us any instance where

136
05:52.020 --> 05:52.960
those events were

137
05:52.960 --> 05:56.210
a part of that. So when we go back to events, right click and click here on

138
05:56.210 --> 05:57.360
event count of one,

139
05:57.360 --> 06:00.250
then it'll open up a new window. And then from here, I'm going to right click
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

139
05:57.360 --> 06:00.250
then it'll open up a new window. And then from here, I'm going to right click

140
06:00.250 --> 06:00.720
and I'm going to go

141
06:00.720 --> 06:04.360
ahead and create a new incident from that and click on OK. So now we have a new

142
06:04.360 --> 06:05.520
incident. So now if we

143
06:05.520 --> 06:08.410
go back to the original page here regarding our brute force login attempts, I'm

144
06:08.410 --> 06:09.040
going to go ahead

145
06:09.040 --> 06:12.840
and close that and I refresh the page now it's showing for brute force one and

146
06:12.840 --> 06:14.000
one. And so the one

147
06:14.000 --> 06:17.690
here is representing the fact that we have an event and here it's also

148
06:17.690 --> 06:18.880
indicating that we have

149
06:18.880 --> 06:22.630
one incident. So if we double click on the free space there, here's the event

150
06:22.630 --> 06:23.760
and also now incident

151
06:23.760 --> 06:27.210
wise, it's associated with this incident. So then we can take that incident and

152
06:27.210 --> 06:28.080
continue to work with

153
06:28.080 --> 06:32.000
it and investigate until we close that incident. So we go ahead and close that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

153
06:28.080 --> 06:32.000
it and investigate until we close that incident. So we go ahead and close that.

154
06:32.000 --> 06:32.640
So that's the first

155
06:32.640 --> 06:37.520
one here for MITRE attack regarding what's actually covered by the 40 analyzer.

156
06:37.520 --> 06:38.640
Again, green means

157
06:38.640 --> 06:42.410
more coverage yellow means less and no color in the background at all means it

158
06:42.410 --> 06:43.200
's not covered.

159
06:43.200 --> 06:47.180
Then if we go to attack, it's showing us both the event as well as any

160
06:47.180 --> 06:48.640
incidents associated

161
06:48.640 --> 06:53.160
regarding that MITRE framework element. The second tab here is for MITRE attack

162
06:53.160 --> 06:54.400
ICS and that's the

163
06:54.400 --> 06:58.500
industrial control systems and operational technology. So if you're looking for

164
06:58.500 --> 06:59.040
coverage,

165
06:59.040 --> 07:02.750
so here for coverage is showing what's covered. Unfortunately, I don't have the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

165
06:59.040 --> 07:02.750
so here for coverage is showing what's covered. Unfortunately, I don't have the

166
07:02.750 --> 07:03.600
license for

167
07:03.600 --> 07:07.520
operational technologies on this 40 analyzer. And as a result, it's not going

168
07:07.520 --> 07:08.240
to be too effective,

169
07:08.240 --> 07:11.360
even though there are some prebuilt event handlers there. And then we go down

170
07:11.360 --> 07:12.080
to actual

171
07:12.080 --> 07:15.960
attack. We're not going to have any results here because we don't have licenses

172
07:15.960 --> 07:16.560
available on the

173
07:16.560 --> 07:20.150
40 analyzer looking for those specific elements again due to the lack of a

174
07:20.150 --> 07:21.440
license. But I do have

175
07:21.440 --> 07:24.590
these right here under MITRE attack and at the moment this is what's covered

176
07:24.590 --> 07:25.280
and again from the

177
07:25.280 --> 07:29.400
dropdown it can go ahead and show us the actual attacks which includes events

178
07:29.400 --> 07:30.800
as well as incidents
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

178
07:29.400 --> 07:30.800
as well as incidents

179
07:30.800 --> 07:32.160
associated with that.