Technically SOAR Platform Agenda 6 In Depth Example Architecture, Data Flow, Components 3 Scaling People Security culture and team profile 4 Scaling Processes Introducing vs Removing
specialized roles - Increased investment in tools and staff to meet demand - Integration with Engineering and other functions - Psychological safety - Awareness around how to leverage Security to drive revenue and sales - Specialized roles - Team at capacity, tight workload - Team is used to reaching out to Security (SIRT@) - Phishing reports, vuln management - Positive reinforcement around security reporting - Cultural norm
New norms, behavioral changes or modifications take time - Broader cultural influences may be out of our control, but directly impact how effective Security can be - Ex. Security incidents and how the following play a role in our IR: - Psychological safety - High accountability, but low blame - Lack of strong ownership
is in flux - Internal Auditing processes are getting established - No automation in place - Metrics exist, but monitoring is just starting - Data is not consistently aggregated - Security policies are inconsistent - Clear ownership of controls - Risk Assessment and Register exist with likelihood, impact, classification - Organization has a more structured approach to audits - Metrics are defined. Programs have KPIs/OKRs - Leading and lagging indicators are identified Policies
and adding friction in the right places at the right time - Metrics are hard - Data can be manipulated to tell a story - Deciding what to track - Compliance is not a replacement for Security, but it does help to shape more secure practices - Lack of ownership at start ups - Vuln management or a bug bounty - Incident Response
to build, maintain, and iterate ◦ Budgets • At startups, you generally may have more flexibility in adopting vendors or tools that are still in their own growth phase ◦ You can accept some shortcomings in order to adopt bleeding edge tech, get better customer support, cheaper prices ◦ Better to buy some technology (maybe don’t build your own EDR)
a SIEM (security incident and event management) actively running detections on all of our log sources • Lack of a SOAR (security orchestration and automation response) poses a significant risk in our ability to do one of our main responsibilities, respond to Security issues • We are a small team • We need to respond to the alerts in a timely way • We want to spend less time responding, without sacrificing quality
Custom built using GCP Functions & Workflows to cheaply scale ◦ When we say cheap, we mean it (~$40/month) vs 250k (Tines) • v1 - Main Functionality Goals ◦ Simple deployment pipeline ◦ Processes alerts from Panther ▪ Enrich alerts with additional data ▪ Suppress edge-case rules ▪ Additional deduplication layer ◦ Runs automation from Jira ▪ Execute response workflows in comments (ended up being vNext) ▪ Keep findings in one place to consolidate information and for compliance
is created ◦ SA will create a Panther ingestion bucket ◦ Request to the webhook creates an alert file in Firestore ◦ Writes alert metadata from Panther ▪ Alert ID - created by Panther (rep. as p_alert_id) ▪ Rule ID - created by Panther (rep. as p_rule_id) Panther API Ingestion Jira Alerts Firestore • First step after Panther creates a ticket from a triggered detection • Public webhook Grab Alert events and write to Firestore and Jira
alert ID and rule ID upon creating an alert • We attach relevant events to the JIRA ticket as events.json using alert ID for easy response • The challenge is with the Panther API and pulling the relevant events
table to map rule IDs to log types ◦ We had other priorities and we accepted this as tech debt • Panther implements another mechanism to grab relevant events and stores them more intuitively • Addition of log source list in alerts
list of results Write map to Firestore Dump JSON to JIRA as a comment We run these concurrently where we can Set of queries to pull usernames, IPs, hashes, domains for a given alert
Response Triggers Response Workflows • Second public webhook • Trigger-JIRA-command cloud function ◦ Parse the command ◦ Trigger pre-registered cloud functions that make the request to the API (such as github, permiso)
enough • Spun up a Grafana instance ◦ Total spend is $40/month for our SOAR, $36 go to Grafana ◦ Consistently 80 - 90% of our monthly costs • Started collecting metrics for alerts ◦ Jira ▪ Created vs Resolved, Ticket duration by state, Avg ticket age, severity, etc ◦ Grafana ▪ Workflow Failures, Alerts Published, Unique Rule IDs, Severity ▪ Infrastructure Monitoring ◦ GCP Dashboards ▪ Total Function Executions, Crashes, etc
- Jump on the train, not in front of it - 3 Main takeaways: - Make the secure path the easy path when you can - Listen to your customers, internal stakeholders, and make working with security a collaborative process. May need to put the business needs first more that you’d like - Be patient, Security is a long term investment
source for matching alert events • Panther doesn’t let us use the rule ID to pull events from their GraphQL API using the log source ◦ Detections can be generic and run across multiple sources • Each log source has its own table of events that triggered an alert Workaround: Query every single log source table for matching p_alert_id • We have to rerun this every time we scan a table and come up empty • Panther cache may be taking a while to populate tables with events so we rerun it • We run this component within seconds of an alert getting generated so our guess is they are caching somewhere and we’re querying the DB too soon Why it works: Very little extra cost to us, we want to make response easier, no other way to query the table
pull events doesn’t return confirmation • Panther’s API doesn’t confirm after our SQL query is done and we’ve successfully grabbed the events • We submit the query, then it tells us “it’s running” Workaround: We send multiple requests to ask status of initial SQL query • We have to run this 2*n times, wait 30 seconds • They have to pay for the compute time for the GraphQL request and the SQL request • ~150 alerts/week, 30 seconds/run, ~20 seconds/compute time Why it works: Very little extra cost to us
full time YOE) ◦ First time at a SaaS company ◦ Needed guidance on how to write RFCs, trade-offs, decisions ◦ An opportunity to demonstrate technical aptitude and impact • My role ◦ Review PRs ◦ Design guidance ◦ Feedback at every stage ◦ Identify opportunities for cross functional adoption to increase impact ◦ Coaching ◦ Plan for open source ◦ Guidance during or tie-break for decisions ◦ Identify partners for enrichments
mishaky
marktimemedia
mojombo
pauljervisheath
honnibal
kimpetersen
garrettdimon
tammyeverts
rocio
danielanewman
chikuwait
aarron
jcasabona
