Ask me anything:A Conversational Interface to Augment Information Security workers

Editor's Notes

• #2: Summary Security operations center (SOC) teams are burdened with a deluge of alerts, repetitive processes for data analysis, and lack of skills and tools to stop advanced threats. To address these challenges, it is crucial to empower junior analysts to stop advanced threats before damage and loss occurs.  Just as digital assistants like Siri or Alexa have proved their ability to give time back to our day by tackling tasks, a security chatbot can streamline workflows, perform complex tasks, and make recommendations to the SOC analyst. Using a combination of subject matter expertise from SOC analysts and the power of machine learning, chatbots can help teams overcome resource shortcomings by using conversations to offload data collection and guide analysts through recommended courses of action. This process provides an intuitive interface to remediation/investigation workflows and complex storage structures so the analyst can spend less time on collection efforts and more on analysis and response.
• #4: So lets address the security industry as a whole. Generally, there are streams of new exploits types and malicious attacks constantly threaten enterprises environments To combat this, security products have been created to detect and respond and remediate problem areas - in their environment But for these products to be deployed successfully, the right teams had to be employed to monitor and act on these suspicious and malicious events. These teams are know as SOC teams – Security Operations Center – Who physically sit in these centers and remediate a stream of alerts. When approaching our predisposed soc problem (which we will discussed in the next slide) – We wanted to better understand our soc users- In order to create the best tools for own personas, we wanted to understand who they were and their daily workflow habits.  We split this approach into three distinct phases: 1) Discovery; 2) Concepting and 3) Prototyping and User Testing
• #5: Bascially… what the bosses said... Forces conformity as opposed to integrating into teams & workflows
• #6: I can get into this more in the Q/A - but during this discovery phase.. confirming our biases/ capturing team dynamics and creating user personas.
• #7: When a SOC analyst starts their shift, they first participate in the shift handover from the analysts on the previous shift. Here they get a briefing on current ongoing investigations or open alerts, ticket numbers associated with those alerts, whois assigned to the investigations, and anything that needs attention. They then monitor a SIEM, an assigned endpoint UI dashboard, email and wait for a security event to occur. Typically that doesn't take very long - with the amount of tools generating alerts in a typical SOC environment (especially those monitoring large networks) - getting alerts is not the problem. Determining which alerts to focus on is the problem. The analyst is typically in reactive mode - where they respond to alerts as they come in, quickly identifying the high priority alerts. Typically, Tier 1 Analysts will have little to no authority to take immediate action on suspected malicious security events and will instead move the alert up the SOC chain. When escalating they will create a case/investigation/incident and assign that case/investigation/incident to the SOC investigator (or Tier 3 analysis). Both the SOC Investigator and the Tier 3 Analyst will take further steps in verifying the anomalous event, and will take the proper response in remediating the alert. While the Tier 3 Analyst will also sift through a SIEM alongside the Tier 1 Analyst, SOC Investigators will often times only work on escalated alerts. At the end of the shift, all levels of analysts needs to prepare a report of the alerts triaged, what was resolved, and what is still open in order to handover the activities to the oncoming shift. Larger reports depicting alert and investigation trends are generated for a SOC Manager on a daily or weekly basis. The SOC Manager will use these reports to focus in on key metadata in the coming weeks, determine the SOC shift schedule and build a custom summary report for the organization's executive level.
• #10: Analysts must battle a tide of incoming alerts Data deluge Morning coffee situation Too much data, too many sources AV EDR Firewall Application logs Threat Intel Feeds No Context No shared context Hard to tie the events from feed A to the events from feed B Repetitive Searching through event logs can be a repetitive process. Alert, Search, Find or Not, Repeat Can we automate this work without creating another data stream? Searching not analyzing Lack of expertise Even tier 3 analysts have blind spots Tier 1 analysts want to build skills and be effective as the first line of defense Can a security product teach new users how to use it effectively while supporting users all skill levels? Lack of time
• #11: Analysts must battle a tide of incoming alerts Data deluge Morning coffee situation Too much data, too many sources AV EDR Firewall Application logs Threat Intel Feeds No Context No shared context Hard to tie the events from feed A to the events from feed B Repetitive Searching through event logs can be a repetitive process. Alert, Search, Find or Not, Repeat Can we automate this work without creating another data stream? Searching not analyzing Lack of expertise Even tier 3 analysts have blind spots Tier 1 analysts want to build skills and be effective as the first line of defense Can a security product teach new users how to use it effectively while supporting users all skill levels? Lack of time
• #13: User: Show me process event data for odinaff.exe on all Windows 10 endpoints Artemis: Okay.
• #15: User: Show me process event data for odinaff.exe on all Windows 10 endpoints Artemis: Okay.
• #17: User: Show me process event data for odinaff.exe on all Windows 10 endpoints Artemis: Okay.
• #19: Analysts must battle a tide of incoming alerts Data deluge Morning coffee situation Too much data, too many sources AV EDR Firewall Application logs Threat Intel Feeds No Context No shared context Hard to tie the events from feed A to the events from feed B Repetitive Searching through event logs can be a repetitive process. Alert, Search, Find or Not, Repeat Can we automate this work without creating another data stream? Searching not analyzing Lack of expertise Even tier 3 analysts have blind spots Tier 1 analysts want to build skills and be effective as the first line of defense Can a security product teach new users how to use it effectively while supporting users all skill levels? Lack of time