WEBVTT 1 00:00.000 --> 00:03.690 Once again, to wrap up this set of videos regarding incident management and 2 00:03.690 --> 00:05.520 instance on the 40 analyzer, 3 00:05.520 --> 00:08.720 I'd like to pose this customer scenario and here it is. The customer has the 4 00:08.720 --> 00:10.000 following questions 5 00:10.000 --> 00:16.280 regarding the differences between events and incidents on the 40 analyzer. So 6 00:16.280 --> 00:16.960 my question for 7 00:16.960 --> 00:21.600 you is before we chat with this customer, how would you explain the differences 8 00:21.600 --> 00:22.560 to that customer 9 00:22.560 --> 00:27.360 between incidents and events? So take a moment right now, think about how we 10 00:27.360 --> 00:28.080 should respond to 11 00:28.080 --> 00:31.330 that customer. And then when you're ready, click on resume and we'll take a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 11 00:28.080 --> 00:31.330 that customer. And then when you're ready, click on resume and we'll take a 12 00:31.330 --> 00:32.240 look at this question 13 00:32.240 --> 00:39.440 together. All right, so before we go chat with the customer, we probably just 14 00:39.440 --> 00:40.960 want to confirm 15 00:40.960 --> 00:44.820 just you and I that we understand a couple pieces. Number one, devices, fordnet 16 00:44.820 --> 00:45.280 devices, 17 00:45.280 --> 00:49.420 include fordigates, are sending log information over to the 40 analyzer that 40 18 00:49.420 --> 00:50.000 analyzer puts 19 00:50.000 --> 00:53.710 them into SQL database. And when it does so, we can start using features like 20 00:53.710 --> 00:55.360 fordive you and also 21 00:55.360 --> 01:00.650 simultaneously, the 40 analyzer is using event handlers to create events based WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 21 00:55.360 --> 01:00.650 simultaneously, the 40 analyzer is using event handlers to create events based 22 01:00.650 --> 01:01.600 on the rules in 23 01:01.600 --> 01:05.940 those event handlers. So for the first part regarding events is the 40 analyzer 24 01:05.940 --> 01:06.720 event handlers 25 01:06.720 --> 01:10.620 that are looking at all that log information coming in and then based on 26 01:10.620 --> 01:11.760 conditions based on 27 01:11.760 --> 01:16.030 set of rules, creating the events. So think of events like little notifications 28 01:16.030 --> 01:17.440 , events inside 29 01:17.440 --> 01:22.680 of 40 analyzer stating what happened and they're created by the event handlers. 30 01:22.680 --> 01:23.840 However, if we want 31 01:23.840 --> 01:27.260 to do something about those events that are happening, we'd want to make sure 32 01:27.260 --> 01:28.240 we have some kind of a 33 01:28.240 --> 01:32.400 ticketing system so that we can, you know, you know, start focusing as a team WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 33 01:28.240 --> 01:32.400 ticketing system so that we can, you know, you know, start focusing as a team 34 01:32.400 --> 01:33.520 on what's going on 35 01:33.520 --> 01:37.890 and do further analysis. And that's when we take one or more events and we 36 01:37.890 --> 01:39.520 include them as part 37 01:39.520 --> 01:42.960 of an incident. And for the customer, I'd probably tell them that the incident 38 01:42.960 --> 01:43.840 is really more like 39 01:43.840 --> 01:49.090 a ticket, meaning a ticket identifying that there's some issue or question or 40 01:49.090 --> 01:50.000 problem. And then we 41 01:50.000 --> 01:54.630 can do our threat hunting and searching and updating of that ticket, aka the 42 01:54.630 --> 01:56.000 incident, to work it all 43 01:56.000 --> 01:59.990 the way through to completion. Now as part of that, we can also leverage the 44 01:59.990 --> 02:01.200 MITRE ATT&CK framework, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 44 01:59.990 --> 02:01.200 MITRE ATT&CK framework, 45 02:01.200 --> 02:04.610 which is built into the 40 analyzer with the right licensing, which can help 46 02:04.610 --> 02:05.520 give us additional 47 02:05.520 --> 02:09.690 insight because if we have an incident that's automatically created by an event 48 02:09.690 --> 02:10.640 handler and it 49 02:10.640 --> 02:14.420 includes the MITRE ATT&CK framework information, that's more information that 50 02:14.420 --> 02:15.680 we can use to research 51 02:15.680 --> 02:19.390 about what's happening on our network that we can include as part of that 52 02:19.390 --> 02:20.560 incident. So again, 53 02:20.560 --> 02:24.240 as a summary for our customer, events are based on rules that are set up 54 02:24.240 --> 02:25.680 regarding what's happened 55 02:25.680 --> 02:29.520 across our network devices and our fordnet devices that are reporting in. And 56 02:29.520 --> 02:30.720 the incident is like WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 56 02:29.520 --> 02:30.720 the incident is like 57 02:30.720 --> 02:34.820 the ticketing service or the method that we can track an investigation or 58 02:34.820 --> 02:35.920 analysis where we can 59 02:35.920 --> 02:39.220 collaborate as a security team to help work all the way through to identify 60 02:39.220 --> 02:40.160 what it is. Is it a 61 02:40.160 --> 02:44.460 false positive? Is it super critical? Or do we need to change some policies on 62 02:44.460 --> 02:45.520 some of our firewalls? 63 02:45.520 --> 02:49.360 So thanks for joining me in this set of videos for getting incident management 64 02:49.360 --> 02:49.760 and I'd like 65 02:49.760 --> 02:53.970 forward to seeing you my friend in another set of videos very, very soon. Until 66 02:53.970 --> 02:54.320 then, 67 02:54.320 --> 03:01.440 I hope this has been informative and I'd like to thank you for viewing.