WEBVTT 0:00:03.880000 --> 0:00:07.480000 Understanding events, alerts and instance. 0:00:07.480000 --> 0:00:12.080000 So, as the title of this video suggests, we're now going to get an understanding 0:00:12.080000 --> 0:00:18.160000 of what events are, what alerts are, and of course what incidents are, 0:00:18.160000 --> 0:00:24.280000 and the keep underlying objective of these videos to not only explain 0:00:24.280000 --> 0:00:29.240000 what they are, you know, in isolation, what each of these three are in 0:00:29.240000 --> 0:00:34.660000 isolation, but to compare them or to juxtapose them against each other. 0:00:34.660000 --> 0:00:38.900000 So, you actually understand once and for all in one video what an event 0:00:38.900000 --> 0:00:42.820000 is, what an alert is, and what an incident is because they're not the 0:00:42.820000 --> 0:00:47.700000 same thing, although they may be referring to the same thing, because 0:00:47.700000 --> 0:00:53.220000 again, you know, you may classify an incident as an alert if you, you 0:00:53.220000 --> 0:00:56.320000 know, you haven't performed or you haven't fine tuned your detection. 0:00:56.320000 --> 0:00:59.720000 But let's not get ahead of ourselves here. 0:00:59.720000 --> 0:01:05.080000 So, understanding events, alerts and incidents, what is all of this about? 0:01:05.080000 --> 0:01:09.840000 Well, in the context of security monitoring and incident response, it 0:01:09.840000 --> 0:01:27.380000 is essential to distinguish between events, alerts and incidents. 0:01:27.380000 --> 0:01:30.460000 So, we're going to talk a little bit about this one. 0:01:30.460000 --> 0:01:37.100000 We'll be going over false positives and true positives and why that's 0:01:37.100000 --> 0:01:42.300000 important. But a lot of that can be traced back to this sort of understanding 0:01:42.300000 --> 0:01:48.980000 what an event is, what constitutes an alert and what, again, constitutes 0:01:48.980000 --> 0:01:55.940000 an incident. And, you know, that this all relates or is pretty much closely 0:01:55.940000 --> 0:02:00.720000 tied to the triage process or very important to that process. 0:02:00.720000 --> 0:02:02.500000 So, what is an event? 0:02:02.500000 --> 0:02:03.840000 Let's start there. 0:02:03.840000 --> 0:02:09.700000 An event is any observable occurrence in a system, network or device. 0:02:09.700000 --> 0:02:13.420000 And I know we've covered this before, but we need to go through it a little 0:02:13.420000 --> 0:02:16.640000 bit deeper now. So, let me just repeat that one more time. 0:02:16.640000 --> 0:02:22.240000 An event is any observable occurrence in a system, network or device. 0:02:22.240000 --> 0:02:27.320000 An examples of this are a user logs into a workstation, a file is opened 0:02:27.320000 --> 0:02:30.960000 or modified, a process is created or terminated. 0:02:30.960000 --> 0:02:34.300000 Of course, we need to be a little bit more specific there as to what process 0:02:34.300000 --> 0:02:37.940000 exactly is being created or terminated. 0:02:37.940000 --> 0:02:41.260000 Another example is, you know, a packet is transmitted across a network. 0:02:41.260000 --> 0:02:47.380000 So, think of events as just regular activity within the environment or 0:02:47.380000 --> 0:02:53.240000 network. So, someone opening file explorer on their computer is, you know, 0:02:53.240000 --> 0:02:56.740000 that's most likely going to be registered or should be registered as an 0:02:56.740000 --> 0:03:00.860000 event. Of course, there's a lot of metadata and telemetry associated with 0:03:00.860000 --> 0:03:06.120000 that that could, you know, allude to the fact that that may be part of 0:03:06.120000 --> 0:03:07.420000 malicious behavior. 0:03:07.420000 --> 0:03:11.480000 But generally speaking, this is, you know, normal stuff that you'd expect 0:03:11.480000 --> 0:03:15.240000 on a system, network, etc. 0:03:15.240000 --> 0:03:19.100000 So, what are some of the key characteristics of an event? 0:03:19.100000 --> 0:03:23.940000 So, first key characteristic, and I'm sure you'll actually get used to 0:03:23.940000 --> 0:03:27.100000 this, is they're generated in large volumes. 0:03:27.100000 --> 0:03:33.360000 So, an example or just using a very brief example here, you know, millions 0:03:33.360000 --> 0:03:36.140000 per day in the case of large networks. 0:03:36.140000 --> 0:03:42.780000 The second characteristic is that most are benign and part of normal operations. 0:03:42.780000 --> 0:03:48.120000 Not always, but generally speaking, they are representative of normal 0:03:48.120000 --> 0:03:53.700000 operations. And thirdly, the third key characteristic of events are that 0:03:53.700000 --> 0:03:58.360000 they're logged typically for auditing, troubleshooting and monitoring. 0:03:58.360000 --> 0:04:03.760000 And the best way to understand events is to, you know, use the following 0:04:03.760000 --> 0:04:08.200000 sentence or explanation. 0:04:08.200000 --> 0:04:11.140000 So, think of events as raw data, right? 0:04:11.140000 --> 0:04:14.960000 They're the atoms of your security telemetry. 0:04:14.960000 --> 0:04:16.660000 Very, very important. 0:04:16.660000 --> 0:04:20.480000 And you'll understand what they are a little bit better when we get into 0:04:20.480000 --> 0:04:22.580000 alerts. So, that brings us to alerts. 0:04:22.580000 --> 0:04:23.460000 What is an alert? 0:04:23.460000 --> 0:04:30.640000 An alert is a notification generated by a security monitoring system. 0:04:30.640000 --> 0:04:36.120000 An example of this system would be a SIEM, an intrusion detection system, 0:04:36.120000 --> 0:04:37.340000 or an antivirus. 0:04:37.340000 --> 0:04:39.500000 Those are very basic examples. 0:04:39.500000 --> 0:04:43.680000 So, it's a notification generated by either one of these security monitoring 0:04:43.680000 --> 0:04:47.280000 systems. But when is it generated? 0:04:47.280000 --> 0:04:54.260000 It is generated when a predefined rule or condition is met. 0:04:54.260000 --> 0:04:58.040000 Often indicating potentially suspicious or malicious activity. 0:04:58.040000 --> 0:05:02.420000 So, that introduces a couple of key things that will be taken a look at 0:05:02.420000 --> 0:05:06.460000 in a practical way, which is, okay, you have a SIEM and you're getting 0:05:06.460000 --> 0:05:08.920000 logs from a Windows system. 0:05:08.920000 --> 0:05:12.500000 And, you know, you haven't done any fine-tuning or anything like this. 0:05:12.500000 --> 0:05:13.940000 You're just getting the logs. 0:05:13.940000 --> 0:05:18.980000 Well, is that enough, you know, for security or incident detection or 0:05:18.980000 --> 0:05:20.380000 security monitoring? 0:05:20.380000 --> 0:05:24.500000 No. You know, it sort of defeats the purpose of having a SIEM. 0:05:24.500000 --> 0:05:29.280000 One of the features that a SIEM offers you is the ability to create rules, 0:05:29.280000 --> 0:05:34.400000 right? So, you can create predefined rules that will essentially prompt 0:05:34.400000 --> 0:05:40.900000 or trigger the SIEM to generate an alert when a certain condition is met. 0:05:40.900000 --> 0:05:43.320000 And you get to define what those conditions are. 0:05:43.320000 --> 0:05:49.600000 So, for example, if I wanted to fine-tune my SIEM to generate alerts whenever 0:05:49.600000 --> 0:05:55.380000 the PowerShell process is executed on all Windows systems that are being 0:05:55.380000 --> 0:05:57.920000 monitored, I can write that, right? 0:05:57.920000 --> 0:06:04.820000 And that's sort of the, you know, that is the stuff that you do, you know, 0:06:04.820000 --> 0:06:08.620000 typically detection engineering or when you're doing detection engineering, 0:06:08.620000 --> 0:06:11.440000 which will actually take a look at to a certain extent. 0:06:11.440000 --> 0:06:19.080000 It's not really important, you know, from a first-hand perspective or 0:06:19.080000 --> 0:06:22.100000 point of view, you know, putting yourself in the shoes of an incident 0:06:22.100000 --> 0:06:28.920000 responder, this process is generally already going to be done or should 0:06:28.920000 --> 0:06:30.380000 be done, I should say. 0:06:30.380000 --> 0:06:33.880000 And, you know, detection engineering should already be in place because 0:06:33.880000 --> 0:06:38.980000 otherwise, you know, the actual alerts will not get escalated up to you 0:06:38.980000 --> 0:06:44.900000 for analysis. I should say, in any case, examples of an alert would be 0:06:44.900000 --> 0:06:50.300000 things like a login attempt from an unauthorized country that's done through 0:06:50.300000 --> 0:06:54.600000 IP geolocation correlation. 0:06:54.600000 --> 0:06:56.420000 So, that's one example. 0:06:56.420000 --> 0:07:00.020000 And second example is a malware signature detected in memory. 0:07:00.020000 --> 0:07:05.080000 A third example is where you have a user, a new user being added or created 0:07:05.080000 --> 0:07:09.920000 and then being added to very interesting type of groups like the local 0:07:09.920000 --> 0:07:14.740000 administrators group or domain, the domain admins group unexpectedly or 0:07:14.740000 --> 0:07:17.100000 without, you know, warning. 0:07:17.100000 --> 0:07:25.320000 Another example would be an unusually large amount of outbound data or 0:07:25.320000 --> 0:07:27.620000 data being transferred, I should say. 0:07:27.620000 --> 0:07:33.340000 So, that's likely going to be exaltration or an attacker that's uploading 0:07:33.340000 --> 0:07:36.780000 or exaltrating data from the organization's network. 0:07:36.780000 --> 0:07:39.680000 Of course, that's just a first glance. 0:07:39.680000 --> 0:07:43.100000 You know, you should always, you should never jump to conclusion. 0:07:43.100000 --> 0:07:47.900000 So, that's why these are alerts because it's not really an incident yet. 0:07:47.900000 --> 0:07:49.880000 So, very, very important. 0:07:49.880000 --> 0:07:54.200000 So, what are some of the key characteristics of alerts? 0:07:54.200000 --> 0:07:58.780000 Well, number one, or A, they're based on detection rules, heuristics or 0:07:58.780000 --> 0:08:00.500000 behavioral baselines. 0:08:00.500000 --> 0:08:04.500000 So, if you have a baseline defined for what normal activity looks like 0:08:04.500000 --> 0:08:09.480000 and there's any deviation from that, you can use that baseline versus 0:08:09.480000 --> 0:08:14.260000 deviation matrix as it were to generate rules. 0:08:14.260000 --> 0:08:18.360000 So, again, if you've been monitoring a network for a while or an environment 0:08:18.360000 --> 0:08:24.280000 for a while and you see, the partial is very rarely executed or opened 0:08:24.280000 --> 0:08:30.700000 up on one particular subnet, I'll sort of segment it down to a very small. 0:08:30.700000 --> 0:08:32.960000 segment of an organization's network. 0:08:32.960000 --> 0:08:37.320000 Let's say the accounting department network or subnet as it were. 0:08:37.320000 --> 0:08:40.560000 And, you know, let's say after a month or two months, you get, you sort 0:08:40.560000 --> 0:08:45.200000 of get a feel for what is normal and what isn't, right? 0:08:45.200000 --> 0:08:48.200000 And you get to know what isn't normal by studying what is normal. 0:08:48.200000 --> 0:08:52.260000 So, if you see that every day, the individuals using those computers, 0:08:52.260000 --> 0:08:56.900000 you know, open up Word, Outlook, Excel, obviously, QuickBooks, stuff like 0:08:56.900000 --> 0:08:58.640000 this. That's normal activity. 0:08:58.640000 --> 0:09:05.520000 But, you know, based on that, you know, heuristics, you know, if you see 0:09:05.520000 --> 0:09:10.340000 a PowerShell process being opened up, it doesn't necessarily, you know, 0:09:10.340000 --> 0:09:12.800000 that's not evidence that, okay, this is an incident. 0:09:12.800000 --> 0:09:16.300000 Because again, there may be some system administrator doing something 0:09:16.300000 --> 0:09:20.680000 on that system, but it's something that you should be notified of or your 0:09:20.680000 --> 0:09:24.500000 team should actually classify as an alert because it's not normal. 0:09:24.500000 --> 0:09:29.340000 In any case, another key characteristic here is that it may include false 0:09:29.340000 --> 0:09:31.120000 positives and that's a given, right? 0:09:31.120000 --> 0:09:35.740000 And it sort of ties to the example I gave you just a few seconds ago. 0:09:35.740000 --> 0:09:39.960000 So, you're going to be dealing with, I wouldn't say a lot of false positives, 0:09:39.960000 --> 0:09:41.720000 but they're going to be there, right? 0:09:41.720000 --> 0:09:47.120000 And the key point is that they require triage and validation by the analysts. 0:09:47.120000 --> 0:09:54.520000 And again, a very simple and concise way to understand this is via this 0:09:54.520000 --> 0:09:57.280000 sentence or statement here. 0:09:57.280000 --> 0:10:03.780000 And that is that an alert is like a signal and the signal is, hey, something 0:10:03.780000 --> 0:10:08.840000 might be wrong. The keyword there is might be a might, I should say, that's 0:10:08.840000 --> 0:10:11.800000 the keyword. So, might be wrong. 0:10:11.800000 --> 0:10:14.900000 It doesn't necessarily mean something is wrong or we have a full-scale 0:10:14.900000 --> 0:10:16.620000 incident and everyone panics. 0:10:16.620000 --> 0:10:19.560000 No, it means, hey, pay attention to this. 0:10:19.560000 --> 0:10:24.500000 An alert is something you should be attention to, analyze, and then classify, 0:10:24.500000 --> 0:10:26.560000 you know, put it through the triage process. 0:10:26.560000 --> 0:10:31.900000 And if it turns out to be an incident, which is what we'll get to shortly, 0:10:31.900000 --> 0:10:39.140000 then another, you know, set of procedures or another process comes into 0:10:39.140000 --> 0:10:45.540000 play. Really, the incident response process, which brings us now to the 0:10:45.540000 --> 0:10:52.280000 man of the moment, or not man, but term of the moment, which is incidents, 0:10:52.280000 --> 0:10:54.400000 right? Or incident. 0:10:54.400000 --> 0:10:56.340000 So, what is an incident? 0:10:56.340000 --> 0:11:01.680000 An incident is a confirmed or suspected breach of security policy or acceptable 0:11:01.680000 --> 0:11:06.600000 use as determined by the analysis of alerts and associated data. 0:11:06.600000 --> 0:11:09.520000 So, it's anything that's been through the triage process that has been 0:11:09.520000 --> 0:11:15.160000 classified or triage, you know, has been classified, prioritize, contextualize 0:11:15.160000 --> 0:11:17.980000 this. You know, yeah, this is an incident here. 0:11:17.980000 --> 0:11:22.420000 An example of this would be a run-somewhere attack encrypting files on 0:11:22.420000 --> 0:11:26.760000 multiple endpoints, you know, fairly obvious what an incident would look 0:11:26.760000 --> 0:11:31.360000 like. Another example is an attack, again, unauthorized access to sensitive 0:11:31.360000 --> 0:11:39.400000 systems, very basic exaltration of customer PII data to an external server, 0:11:39.400000 --> 0:11:41.960000 credential theft and lateral movement within the network. 0:11:41.960000 --> 0:11:46.560000 You know, those are incidents, you know, they need to be dealt with. 0:11:46.560000 --> 0:11:50.380000 And what are the key characteristics of incidents? 0:11:50.380000 --> 0:11:55.120000 A, incidents are actionable and require an IR response. 0:11:55.120000 --> 0:11:59.340000 B, they can involve one or multiple alerts and events, which is true. 0:11:59.340000 --> 0:11:59.980000 Very, very important. 0:11:59.980000 --> 0:12:06.140000 You know, an incident is not just going to be limited to or constrained 0:12:06.140000 --> 0:12:12.080000 to just one alert or event, right? 0:12:12.080000 --> 0:12:16.180000 There's going to be a slew of activity when an attacker gets in, they're 0:12:16.180000 --> 0:12:18.280000 not just going to be operating on one system. 0:12:18.280000 --> 0:12:21.620000 They will, you know, most likely perform lateral movement. 0:12:21.620000 --> 0:12:27.860000 That generates a different set of, I should say, events, as it were. 0:12:27.860000 --> 0:12:32.060000 They'll then, you know, operate on the systems that they're interested 0:12:32.060000 --> 0:12:38.920000 in. So, you know, maybe think of the domain controllers, multiple high 0:12:38.920000 --> 0:12:42.180000 value or critical endpoints. 0:12:42.180000 --> 0:12:46.080000 They'll then perform, you know, persistence, credential access, privilege 0:12:46.080000 --> 0:12:50.120000 escalation, and then they'll move to exaltration, which is, you're most 0:12:50.120000 --> 0:12:54.760000 likely going to detect this through the network, right? 0:12:54.760000 --> 0:12:57.560000 Or network analysis, as it were. 0:12:57.560000 --> 0:13:03.500000 And the other key characteristic here is that, you know, must be documented, 0:13:03.500000 --> 0:13:07.340000 analyzed, and remediated, which, you know, is self-explanatory. 0:13:07.340000 --> 0:13:12.060000 So, again, coming back to the keystone statement that I've sort of added 0:13:12.060000 --> 0:13:16.260000 for events, alerts, and now incidents. 0:13:16.260000 --> 0:13:21.440000 In the case of an incident, this sentence or statement pretty much encapsulates 0:13:21.440000 --> 0:13:26.200000 it. So, an incident is the confirmed threat that must be investigated, 0:13:26.200000 --> 0:13:27.980000 contained, and resolved. 0:13:27.980000 --> 0:13:29.000000 Very, very simple. 0:13:29.000000 --> 0:13:32.260000 So, keyword here is confirmed, right? 0:13:32.260000 --> 0:13:33.580000 So, it's confirmed. 0:13:33.580000 --> 0:13:38.740000 That means you now have, you know, it now becomes actionable or something. 0:13:38.740000 --> 0:13:44.420000 The incident response team can now, you know, take action on or begin 0:13:44.420000 --> 0:13:50.440000 working on. So, what is the relationship between events, alerts, and incidents? 0:13:50.440000 --> 0:13:52.160000 And I have two diagrams. 0:13:52.160000 --> 0:13:53.400000 This is the first one. 0:13:53.400000 --> 0:13:58.480000 And they'll both explain the relationship in different ways, or, you know, 0:13:58.480000 --> 0:14:02.460000 using different angles or points of view. 0:14:02.460000 --> 0:14:06.320000 So, in the case of events, events are constantly generated and collected, 0:14:06.320000 --> 0:14:11.760000 okay? That then, you know, leads into alerts, because alerts are generated 0:14:11.760000 --> 0:14:16.720000 from events. So, alerts are filtered and triggered from relevant or suspicious 0:14:16.720000 --> 0:14:22.220000 events, okay? And then, from alerts, you then have incidents, or incidents 0:14:22.220000 --> 0:14:29.080000 are, you know, pretty much, um, derived from alerts after they've been 0:14:29.080000 --> 0:14:30.840000 through the triage process, right? 0:14:30.840000 --> 0:14:35.900000 So, incidents are confirmed after alerts are investigated and validated. 0:14:35.900000 --> 0:14:41.000000 And then this other diagram sort of explains or provides you with the 0:14:41.000000 --> 0:14:47.440000 differences or the relationship between these three events alerts and 0:14:47.440000 --> 0:14:52.160000 incidents in the form of or in way of providing their definition. 0:14:52.160000 --> 0:14:57.000000 So, just as a way to summarize, you know, what each of these are, in the 0:14:57.000000 --> 0:15:01.960000 case of events, these are observable occurrences in systems and networks, 0:15:01.960000 --> 0:15:07.080000 not limited to, but generally speaking, alerts, these are notifications 0:15:07.080000 --> 0:15:09.960000 of potentially suspicious activity. 0:15:09.960000 --> 0:15:14.880000 And then, incidents are confirmed or suspected security breaches, right? 0:15:14.880000 --> 0:15:16.760000 Or incidents, as it were. 0:15:16.760000 --> 0:15:20.720000 So, you know, just wanted to give you a or utilize diagram so you can 0:15:20.720000 --> 0:15:24.180000 actually understand that they're interrelated with each other. 0:15:24.180000 --> 0:15:30.680000 They, of course, represent different, um, they represent different things 0:15:30.680000 --> 0:15:32.200000 or different types of data. 0:15:32.200000 --> 0:15:38.240000 And they all encapsulate, um, different processes. 0:15:38.240000 --> 0:15:43.080000 So, events and alerts, that's your triage and then escalation. 0:15:43.080000 --> 0:15:47.200000 That's your, the transition point from alerts to incidents. 0:15:47.200000 --> 0:15:53.340000 And then incident response begins at the incidents or begins with confirmed 0:15:53.340000 --> 0:15:56.720000 incidents. So, hopefully it's starting to make sense. 0:15:56.720000 --> 0:16:02.320000 And so that brings us to, you know, why understanding the difference between 0:16:02.320000 --> 0:16:06.580000 events alerts and instances important in incident response. 0:16:06.580000 --> 0:16:11.980000 If it isn't already a, it helps focus the analyst attention on what truly 0:16:11.980000 --> 0:16:18.260000 matters. Prevents a lead fatigue by filtering noise from, you know, signal, 0:16:18.260000 --> 0:16:19.480000 just general signal. 0:16:19.480000 --> 0:16:25.040000 Uh, enables proper incident classification, escalation, um, and documentation. 0:16:25.040000 --> 0:16:28.900000 And ensures efficient use of IR resources. 0:16:28.900000 --> 0:16:32.640000 Okay, so with that being said, that's going to be it for this video. 0:16:32.640000 --> 0:16:34.840000 And I will be seeing you in the next video.