WEBVTT 0:00:03.920000 --> 0:00:06.880000 Hello everyone and welcome to this video. 0:00:06.880000 --> 0:00:11.600000 In this video we're going to be taking a look at the sock tears and rolls. 0:00:11.600000 --> 0:00:16.660000 So now that you have an understanding of the various types of socks, what 0:00:16.660000 --> 0:00:19.040000 a sock is, what it does, etc. 0:00:19.040000 --> 0:00:22.680000 We're now going to take a look at the individuals that work within a sock 0:00:22.680000 --> 0:00:28.320000 and how they're organized, what their rolls are or what rolls exist, as 0:00:28.320000 --> 0:00:33.560000 well as the responsibilities associated with set rolls. 0:00:33.560000 --> 0:00:37.440000 And more specifically we're going to be focusing really on the tier one, 0:00:37.440000 --> 0:00:39.500000 two and three analysts. 0:00:39.500000 --> 0:00:41.660000 So let's get started. 0:00:41.660000 --> 0:00:47.860000 So a sock is structured into tears and you may be asking, so why is it 0:00:47.860000 --> 0:00:49.240000 structured into tears? 0:00:49.240000 --> 0:00:50.100000 Well, it's done. 0:00:50.100000 --> 0:00:54.940000 It is structured into tears to ensure efficient and effective incident 0:00:54.940000 --> 0:01:00.180000 detection, analysis, response, and of course, remediation. 0:01:00.180000 --> 0:01:05.360000 So first point, sock tears define the levels of expertise, responsibilities 0:01:05.360000 --> 0:01:08.020000 and workflow in a sock. 0:01:08.020000 --> 0:01:11.560000 I want you to pay very close attention to that point. 0:01:11.560000 --> 0:01:17.040000 So not only do they sort of show seniority within the sock team, but they 0:01:17.040000 --> 0:01:21.420000 also outline different responsibilities or they entail different responsibilities. 0:01:21.420000 --> 0:01:30.280000 So in that the junior most analysts are tier one analysts, and you may 0:01:30.280000 --> 0:01:32.880000 think, well, okay, tier two must be slightly advanced. 0:01:32.880000 --> 0:01:38.620000 However, that's really not that really isn't the only distinction. 0:01:38.620000 --> 0:01:42.220000 The other key distinction is the responsibilities which you'll actually 0:01:42.220000 --> 0:01:50.020000 see play a big role in terms of the outcomes or the outputs of a specific 0:01:50.020000 --> 0:01:56.080000 role. The second point is that each tier handles incidents based on complexity, 0:01:56.080000 --> 0:02:00.380000 severity, and the required technical skills. 0:02:00.380000 --> 0:02:04.560000 So required technical skills obviously makes sense, you know, the higher 0:02:04.560000 --> 0:02:09.580000 your role within the hierarchy in a sock team, you know, the more skills, 0:02:09.580000 --> 0:02:12.240000 you know, I would hope that you have. 0:02:12.240000 --> 0:02:17.980000 However, you know, the other factor that I was pointing out earlier had 0:02:17.980000 --> 0:02:22.180000 to do with some additional factors tied to your responsibilities. 0:02:22.180000 --> 0:02:28.400000 And really what a lot of the responsibilities will, you know, sort of 0:02:28.400000 --> 0:02:35.820000 include or entail a mix of increasing complexity and of course, increased 0:02:35.820000 --> 0:02:40.520000 severity. So it's most likely that the sock tier three analysts or tier 0:02:40.520000 --> 0:02:46.380000 two analysts are going to be dealing with much more severe events or alerts 0:02:46.380000 --> 0:02:49.520000 if you were just as an example, you know, I'm not saying that that's the 0:02:49.520000 --> 0:02:55.280000 case, just giving you an idea as to why this tiered system exists. 0:02:55.280000 --> 0:03:01.040000 So the bottom line is that this tiered approach allows for a scalability, 0:03:01.040000 --> 0:03:07.020000 b specialization, and c faster incident response that's really tailored 0:03:07.020000 --> 0:03:09.040000 to this particular learning path. 0:03:09.040000 --> 0:03:12.600000 But you know, don't worry, it'll make sense what I'm saying here. 0:03:12.600000 --> 0:03:16.060000 So what are these three tiers or roles? 0:03:16.060000 --> 0:03:20.560000 Well, I've listed them out here in a table that firstly lists out the 0:03:20.560000 --> 0:03:21.340000 particular tier. 0:03:21.340000 --> 0:03:26.080000 Secondly, the role in terms of experience, if you will, and then the primary 0:03:26.080000 --> 0:03:31.960000 responsibility. So we have your tier one sock analyst and their primary 0:03:31.960000 --> 0:03:36.980000 responsibilities, as I've highlighted in the brackets there, alert monitoring 0:03:36.980000 --> 0:03:47.320000 and triage. Now that, you know, the, the tiers always remain in terms 0:03:47.320000 --> 0:03:51.360000 of them being, you know, tier one, two, three, or level one, two, three, 0:03:51.360000 --> 0:03:54.740000 as they also known, those will remain the same. 0:03:54.740000 --> 0:03:58.820000 But the responsibilities, the primary responsibilities might be slightly 0:03:58.820000 --> 0:04:02.600000 different, you know, depending on region or sector, etc. 0:04:02.600000 --> 0:04:07.040000 But generally speaking, based on my own experience, it's alert monitoring 0:04:07.040000 --> 0:04:10.380000 and triage. So, you know, this is an entry level role. 0:04:10.380000 --> 0:04:14.340000 And the primary responsibilities are firstly, they're sort of the first 0:04:14.340000 --> 0:04:20.280000 line of defense, responsible for monitoring security alerts, perform initial 0:04:20.280000 --> 0:04:23.240000 triage, and escalate serious threats. 0:04:23.240000 --> 0:04:27.780000 So you may be asking who, who does the tier one sock analyst escalate 0:04:27.780000 --> 0:04:32.460000 to? Well, that's where we have the tier two analyst or also known as incident 0:04:32.460000 --> 0:04:36.520000 responder. So we are finally at it or we're finally at the point where 0:04:36.520000 --> 0:04:38.180000 you understand where you fit. 0:04:38.180000 --> 0:04:43.300000 If you are looking to become an incident responder or if you are one already. 0:04:43.300000 --> 0:04:46.680000 And the primary responsibilities as I've highlighted in the brackets, 0:04:46.680000 --> 0:04:49.720000 there are to do with investigation and respond. 0:04:49.720000 --> 0:04:54.500000 So you investigate what the tier one analyst escalates to you. 0:04:54.500000 --> 0:04:56.280000 And then you respond if required. 0:04:56.280000 --> 0:05:00.080000 So this is a mid level role, generally speaking. 0:05:00.080000 --> 0:05:03.520000 What are the primary responsibilities here, you know, conduct in depth 0:05:03.520000 --> 0:05:08.380000 analysis, investigate confirmed threats, and of course, mitigate incidents. 0:05:08.380000 --> 0:05:11.400000 Now, making very simple here, but you know, just giving your high level 0:05:11.400000 --> 0:05:15.140000 view. And then you have the tier three analyst, which could either be 0:05:15.140000 --> 0:05:19.860000 a threat hunter or a senior analyst, and their primary responsibilities 0:05:19.860000 --> 0:05:23.060000 to do it advanced threat analysis and hunting. 0:05:23.060000 --> 0:05:25.340000 So this is a senior level role. 0:05:25.340000 --> 0:05:28.520000 Now, I haven't added the sock manager in here because that's really not 0:05:28.520000 --> 0:05:30.160000 important at this point in time. 0:05:30.160000 --> 0:05:35.340000 But the primary responsibilities of a tier three analyst are, you know, 0:05:35.340000 --> 0:05:40.000000 to proactively hunt threats, reverse engineer malware, create detection 0:05:40.000000 --> 0:05:46.620000 rules like with Yara, fine tune the sea more so, stuff like that. 0:05:46.620000 --> 0:05:50.360000 So let's take a closer look at the tier one sock analyst. 0:05:50.360000 --> 0:05:54.960000 So primary responsibilities, yeah, alert monitoring and triage. 0:05:54.960000 --> 0:05:59.320000 A tier one sock analyst, as I've mentioned, is the first line of defense, 0:05:59.320000 --> 0:06:03.920000 you know, and is responsible for monitoring security alerts, triaging 0:06:03.920000 --> 0:06:10.460000 incidents, and escalating serious threats to tier two or three analysts. 0:06:10.460000 --> 0:06:12.560000 What are the required skills? 0:06:12.560000 --> 0:06:16.880000 Firstly, a basic knowledge of the same ideas, IPS solutions, endpoint 0:06:16.880000 --> 0:06:18.840000 security solutions. 0:06:18.840000 --> 0:06:23.220000 Be familiarity with log analysis and threat intelligence platforms. 0:06:23.220000 --> 0:06:24.720000 That's very important. 0:06:24.720000 --> 0:06:28.820000 See strong analytical and decision making skills that goes without saying 0:06:28.820000 --> 0:06:32.420000 you need to know when to escalate stuff like that. 0:06:32.420000 --> 0:06:35.680000 And of course, an understanding of cyber attack patterns. 0:06:35.680000 --> 0:06:39.880000 So think of the MIT attack framework, the cyber kill chain, etc. 0:06:39.880000 --> 0:06:43.480000 And then what are some of the common tools used by tier one analysts? 0:06:43.480000 --> 0:06:44.800000 Well, you'll obviously have your seams. 0:06:44.800000 --> 0:06:49.800000 So Splunk, elk, q radar, Microsoft Sentinel, Microsoft Sentinel one, I 0:06:49.800000 --> 0:06:54.540000 should say. And then threat intelligence feeds like alien vault OTX virus 0:06:54.540000 --> 0:06:57.320000 total recorded future. 0:06:57.320000 --> 0:06:59.680000 And then endpoint security solutions. 0:06:59.680000 --> 0:07:03.880000 Think of crowd strike, maybe not crowd strike, Sentinel one Microsoft 0:07:03.880000 --> 0:07:06.560000 defender stuff like this. 0:07:06.560000 --> 0:07:11.120000 So I've sort of outlined the key, I'm sort of outlined the responsibilities 0:07:11.120000 --> 0:07:15.900000 here for a tier one sock analyst and what they entail. 0:07:15.900000 --> 0:07:17.640000 So firstly, continuous monitoring. 0:07:17.640000 --> 0:07:19.540000 What does that entail? 0:07:19.540000 --> 0:07:23.980000 Well, monitoring the seam alerts, ID S IPS logs firewall logs, endpoint 0:07:23.980000 --> 0:07:28.940000 security logs for potential security incidents, using real time dashboards 0:07:28.940000 --> 0:07:31.500000 to track anomalies and suspicious activity. 0:07:31.500000 --> 0:07:33.960000 So that's what continuous monitoring involves. 0:07:33.960000 --> 0:07:36.640000 And then alert triage and categorization. 0:07:36.640000 --> 0:07:38.020000 What does this involve? 0:07:38.020000 --> 0:07:42.100000 Firstly, reviewing, reviewing incoming alerts, filtering out false positives 0:07:42.100000 --> 0:07:44.960000 and classifying threats based on severity. 0:07:44.960000 --> 0:07:47.020000 What else will you be doing in there? 0:07:47.020000 --> 0:07:52.120000 Well, you'll be utilizing MIT attack framework or mapping to determine 0:07:52.120000 --> 0:07:55.440000 if an alert matches known attack patterns. 0:07:55.440000 --> 0:08:00.240000 And then you'll also be taking care of initial threat analysis. 0:08:00.240000 --> 0:08:02.800000 What does that involve or entail? 0:08:02.800000 --> 0:08:09.360000 A conducting basic investigation by checking logs, the IP reputation, 0:08:09.360000 --> 0:08:14.180000 and of course consulting with threat intelligence feeds. 0:08:14.180000 --> 0:08:17.660000 You'll also be correlating alerts to determine if multiple security events 0:08:17.660000 --> 0:08:19.400000 indicate a larger attack. 0:08:19.400000 --> 0:08:23.660000 That's, I wouldn't say that's a tier one analyst responsibility or something 0:08:23.660000 --> 0:08:25.180000 that they would do necessarily. 0:08:25.180000 --> 0:08:29.320000 But generally speaking, you know, something that is always useful for 0:08:29.320000 --> 0:08:33.200000 you to know how to do not that, you know, focus in this course, as well 0:08:33.200000 --> 0:08:36.620000 as this learning path is a tier one analyst. 0:08:36.620000 --> 0:08:38.700000 But, you know, I just wanted to point that out. 0:08:38.700000 --> 0:08:41.880000 And then of course, some other responsibilities are documentation and 0:08:41.880000 --> 0:08:45.620000 escalation. So you need to be able to create detailed incident response 0:08:45.620000 --> 0:08:49.080000 reports for the tier two analysts. 0:08:49.080000 --> 0:08:54.720000 Escalate incidents when they exceed predefined risk thresholds. 0:08:54.720000 --> 0:08:58.880000 And then finally, this may not always be the case, but containment and 0:08:58.880000 --> 0:09:04.220000 response. So as I've listed here, the key activity with regards to that 0:09:04.220000 --> 0:09:08.600000 responsibility essentially involves may perform. 0:09:08.600000 --> 0:09:13.480000 So you may end up performing simple response actions like blocking an 0:09:13.480000 --> 0:09:18.800000 IP address or disabling a, you know, disabling compromised accounts. 0:09:18.800000 --> 0:09:22.880000 All right, so that brings us to our role or the focus of this learning 0:09:22.880000 --> 0:09:27.960000 path, which is the tier two or incident responder whose primary responsibility 0:09:27.960000 --> 0:09:30.540000 is investigation and response. 0:09:30.540000 --> 0:09:37.500000 So a tier two SOC analyst incident responder, as it were, investigates 0:09:37.500000 --> 0:09:41.700000 escalated alerts, determines the attack scope and takes direct action 0:09:41.700000 --> 0:09:44.240000 to contain and mitigate incidents. 0:09:44.240000 --> 0:09:45.860000 What are the required skills? 0:09:45.860000 --> 0:09:49.800000 A, advanced log analysis, forensic investigation and network security 0:09:49.800000 --> 0:09:54.620000 expertise. B, understanding of malware reverse engineering and exploit 0:09:54.620000 --> 0:09:57.600000 analysis, quite important nowadays. 0:09:57.600000 --> 0:10:02.380000 And C, may this is not really I would say a key requirement, but experience 0:10:02.380000 --> 0:10:05.040000 is obviously going to be very useful. 0:10:05.040000 --> 0:10:11.100000 Experience with incident handling frameworks like NIST, Sans and ISO 27035. 0:10:11.100000 --> 0:10:14.760000 You know, what are the common tools used by tier two analysts or incident 0:10:14.760000 --> 0:10:17.420000 responders, they're sorted into categories. 0:10:17.420000 --> 0:10:21.500000 So for forensics, you'll obviously have tools like volatility or top C, 0:10:21.500000 --> 0:10:27.240000 FTK, imager for threat hunting, you'll have Splunk, elk, Zeke, Suri-Kata, 0:10:27.240000 --> 0:10:32.000000 malware analysis, you're obviously going to have IDAPRO, Gidra or Gidra, 0:10:32.000000 --> 0:10:34.600000 Gidra, Kaku, Sandbox. 0:10:34.600000 --> 0:10:37.640000 So a lot of specialist tools here. 0:10:37.640000 --> 0:10:42.140000 And in terms of the primary responsibilities for you, the incident responder, 0:10:42.140000 --> 0:10:45.860000 as I should call you now, you have threat investigation and root cause 0:10:45.860000 --> 0:10:49.780000 analysis, incident containment and remediation, digital forensics and 0:10:49.780000 --> 0:10:52.660000 malware analysis, which, you know, will obviously include some reverse 0:10:52.660000 --> 0:10:55.920000 engineering and incident documentation and reporting. 0:10:55.920000 --> 0:11:00.320000 So starting off with threat investigation and root cause analysis, what 0:11:00.320000 --> 0:11:02.480000 are the key activities performed in here? 0:11:02.480000 --> 0:11:06.380000 Well, you're going to need to investigate escalated incidents to determine 0:11:06.380000 --> 0:11:08.740000 a, how did the attacker gain access? 0:11:08.740000 --> 0:11:15.100000 B, which systems are affected and C, what actions did the attacker perform? 0:11:15.100000 --> 0:11:19.660000 You'll also be performing forensic log analysis to trace the attacker 0:11:19.660000 --> 0:11:23.360000 movement across the network in the event of a breach. 0:11:23.360000 --> 0:11:33.660000 Moving on to the next responsibility, which is the key activity here involves 0:11:33.660000 --> 0:11:38.660000 isolating compromised endpoints, block malicious IPs, and disabling compromised 0:11:38.660000 --> 0:11:44.700000 accounts. He also going to need to work with the IT teams to remove malware, 0:11:44.700000 --> 0:11:49.120000 restore affected, affected systems and apply security patches or mitigations 0:11:49.120000 --> 0:11:50.500000 where necessary. 0:11:50.500000 --> 0:11:54.340000 In terms of digital forensics and malware analysis, you're obviously going 0:11:54.340000 --> 0:11:58.820000 to require, you're going to be required to use memory forensics tools 0:11:58.820000 --> 0:12:03.980000 like volatility or recall to analyze active threats, dissect malware samples 0:12:03.980000 --> 0:12:10.160000 in sandboxes like caku or any dot run, which is a third party solution, 0:12:10.160000 --> 0:12:12.560000 you know, in order to understand how they behave. 0:12:12.560000 --> 0:12:15.460000 And then you have incident documentation and reporting. 0:12:15.460000 --> 0:12:18.460000 So what, what are the key activities here? 0:12:18.460000 --> 0:12:22.260000 Well, you're going to need to be able to write detailed forensic investigation 0:12:22.260000 --> 0:12:25.220000 reports for the security leadership. 0:12:25.220000 --> 0:12:28.780000 And you're going to need to be able to provide recommendations to prevent 0:12:28.780000 --> 0:12:30.500000 similar incidents in the future. 0:12:30.500000 --> 0:12:33.740000 So these are the key responsibilities of an incident respondent. 0:12:33.740000 --> 0:12:37.600000 Of course, I may have left out of, you know, few of the minor ones. 0:12:37.600000 --> 0:12:38.820000 I don't think so. 0:12:38.820000 --> 0:12:43.160000 But hopefully now this clarifies what you'll be responsible for. 0:12:43.160000 --> 0:12:47.900000 And you know, as we've already taken a look at within this course, you 0:12:47.900000 --> 0:12:51.840000 should also know by this point what your inputs are and what your outputs 0:12:51.840000 --> 0:12:54.660000 are within a SOC team. 0:12:54.660000 --> 0:12:58.160000 But that's a tier two incident responder or tier two SOC analyst, if you 0:12:58.160000 --> 0:13:02.980000 will. Finally, we have the tier three threat hunter or senior analyst. 0:13:02.980000 --> 0:13:08.180000 A tier three SOC analyst, also known as a threat hunter or senior analyst, 0:13:08.180000 --> 0:13:14.540000 is responsible for proactively hunting for proactive for proactively hunting 0:13:14.540000 --> 0:13:18.660000 for undetected threats, performing advanced forensic analysis and developing 0:13:18.660000 --> 0:13:20.840000 new detection techniques. 0:13:20.840000 --> 0:13:22.600000 What are the required skills here? 0:13:22.600000 --> 0:13:27.040000 A expert knowledge of network forensics, malware analysis and and adversary 0:13:27.040000 --> 0:13:32.240000 emulation, be proficiency in scripting, so think Python, PowerShell, bash, 0:13:32.240000 --> 0:13:37.440000 etc. for the purpose of automation and see a deep understanding of the 0:13:37.440000 --> 0:13:41.520000 MIT ATT&CK framework and threat intelligence methodologies. 0:13:41.520000 --> 0:13:44.620000 What are some of the common tools used by tier three analysts? 0:13:44.620000 --> 0:13:48.140000 They are broken down into categories like reverse engineering, threat 0:13:48.140000 --> 0:13:50.340000 hunting and sore automation. 0:13:50.340000 --> 0:13:53.640000 In the case of reverse engineering, you're going to have IDAPRO, radar 0:13:53.640000 --> 0:13:58.960000 two, GIDRA, and then for threat hunting, obviously, Velociraptor, very, 0:13:58.960000 --> 0:14:01.500000 very popular Zeke Splunk. 0:14:01.500000 --> 0:14:06.820000 For sore automation, you have stuff like Phantom or Cortex XSOR. 0:14:06.820000 --> 0:14:12.700000 Again, those are a bit too confusing for you, but that's a breakdown there. 0:14:12.700000 --> 0:14:18.820000 What are the key or primary responsibilities of a tier three SOC analyst 0:14:18.820000 --> 0:14:21.160000 or threat hunter or senior analyst? 0:14:21.160000 --> 0:14:24.140000 Well, A, I'll just go through the key responsibilities. 0:14:24.140000 --> 0:14:28.740000 First, we have threat hunting and adversary emulation, B, malware reverse 0:14:28.740000 --> 0:14:34.060000 engineering, C, C, men's sore rule development, and D, threat intelligence 0:14:34.060000 --> 0:14:36.800000 and attack attribution. 0:14:36.800000 --> 0:14:40.280000 In terms of threat hunting and adverse emulation, you're going to need 0:14:40.280000 --> 0:14:44.860000 to utilize proactive hunting techniques to detect stealthy attacks before 0:14:44.860000 --> 0:14:46.360000 they cause damage. 0:14:46.360000 --> 0:14:49.360000 You're going to need to be able to map adversary behavior to the MIT ATT 0:14:49.360000 --> 0:14:55.440000 &CK framework and then use that mapping to plan and conduct facilitate 0:14:55.440000 --> 0:14:58.440000 purple team exercises. 0:14:58.440000 --> 0:15:02.220000 In terms of malware reverse engineering, you're typically going to be 0:15:02.220000 --> 0:15:06.260000 deconstructing or reverse engineering zero day malware and ransomware 0:15:06.260000 --> 0:15:10.500000 strains in order to understand their impact, but also their origin. 0:15:10.500000 --> 0:15:15.240000 You're also going to need to be able to develop custom yara tools to detect 0:15:15.240000 --> 0:15:20.420000 new malware variants, especially when a new strain is released, so on 0:15:20.420000 --> 0:15:24.460000 and so forth. In terms of the third responsibility, which is C, men's 0:15:24.460000 --> 0:15:27.500000 sore rule development, you're going to need to be able to write custom 0:15:27.500000 --> 0:15:31.660000 correlation rules to improve the SOC detection capabilities. 0:15:31.660000 --> 0:15:35.280000 You're also going to need to be able to automate repetitive incident response 0:15:35.280000 --> 0:15:40.080000 tasks using sore playbooks, and then finally, threat intelligence and 0:15:40.080000 --> 0:15:41.380000 attack attribution. 0:15:41.380000 --> 0:15:45.200000 So you need to have the ability to analyze nation state or equivalent 0:15:45.200000 --> 0:15:51.980000 APT groups and track evolving their evolving TTPs or trade craft. 0:15:51.980000 --> 0:15:55.680000 And finally, you need to be able to collaborate with external cyber threat 0:15:55.680000 --> 0:15:59.300000 intelligence teams to enrich SOC threat intelligence. 0:15:59.300000 --> 0:16:03.320000 So those are the key responsibilities of a tier three SOC analyst or a 0:16:03.320000 --> 0:16:04.880000 threat hunter or senior analyst. 0:16:04.880000 --> 0:16:09.020000 And you know, I've sort of broken down the activities within each of these 0:16:09.020000 --> 0:16:13.240000 core areas of responsibility, if you will. 0:16:13.240000 --> 0:16:14.840000 So hopefully that makes sense. 0:16:14.840000 --> 0:16:17.640000 And with that being said, that's going to be it for this video. 0:16:17.640000 --> 0:16:20.180000 And I will be seeing you in the next video.