[Autogenerated] Hello everyone.
My name is nick metropolis and I would like to welcome you all to
the magic of managing incidents with the Hive.
In this course you're going to learn what the Hive is,
how to administrate and how to harness its power to perform common
tasks like creating and managing cases using templates,
reviewing alerts and being able to create powerful
reporting using dashboards and tags.
But before we go any further, let's take a look at what the Hive actually is.
The Hive is an amazing incident response to offering a wealth of
options to record track and manage security incidents.
It does that while it supports various integrations with other
tools like your favorite scene platform of choice.
It also offers the possibility of integrating with threat
intelligence platforms and you've guessed it it uses api calls
to rapidly handle incident response.
But first before we continue our journey with the Hive,
let's give credit to where credit is due.
The Hive was created and being constantly nurtured and loved by nabil thomas,
sad jerome Danny and Nils number of security operations and incident
response teams used the Hive for the daily incident analysis.
One of its most convenient features relates to being able to
create cases with incident information and load them with
associated indicators of compromise.
You might have heard those being referenced as IOC.
S and there are items like file hashes IP address is URLs or anything
else that you can use as a security analyst or incident responder to
perform your incident investigation.
In addition to that and bi directional integration with a great open
source threat intelligence platform known as mist can be used to offer
enhanced intelligence to the Hive not to mention,
you also have an option to use the powerful cortex analyzers which can
offer determinations about any artifact potentially being suspicious
and working a more in depth look from you.
You can use the nist cybersecurity framework which in case you
haven't used before is a commonly used framework which addresses
security incidents by providing a collection of inter ship best
practices and approaches to managing risk.
The framework contains five core elements which are identified protect detect,
respond and recover focusing on the hive.
We can say that it fairly squarely falls within the response function of the
framework and that function contains five categories in total.
Three of those categories are response planning analysis and mitigation.
Now each of those categories in order to add a wrench into the
mix is divided into further subcategories.
So for example focusing in response planning,
we have RP one relating to response planning and executing those plans
during an incident analysis contains notifications relating to
detections and how to perform system investigations,
impact of incidents which we need to understand and also how to
categorize incidents consistently without response planning.
If you're focusing on mitigation items like how to contain incidents or how to
mitigate incidents afterwards are also the ones that you want to be focusing
at another framework of choice which is very crucial to any cybersecurity
analysts is the miter attack framework.
Within the miter attack framework,
we have a wealth of information regarding adversary
tactics techniques and procedures, also known as T DPS.
Those allow incident handlers to classify incidents and perform adversary
attribution to respond appropriately to those incidents.
In addition,
the Metro attack matrix can provide a great technique and sub technique
visualization to give security analysts a great overview of any attack
that might be taking place As an example,
we're going to be focusing on two particular
categories with two associated techniques.
So in relation to final analysis,
we're going to be focusing on fishing as the adversary using
a potentially malicious file attachment,
center geronimo and focusing on threat intelligence.
We're going to be looking at a drive by compromise where
the attacker might have compromised a website and using it
for their malicious purposes.
We have the micro shield which allows us as defenders to be
able to respond to those particular attacks.
Again, focusing on the two scenarios that I mentioned,
we're going to be covering fishing with spear fishing in
particular and drive by compromise.
We have the two associated mitigations for fishing and spearfishing.
We have user training as being First up,
you've guessed it,
the best training known to us to be able to protect
against phishing is user training.
We can launch all the countermeasures in the world.
We can have email gateways, we can have proxies.
We can have quite a lot of different security tools,
but nothing beats a good old fashioned user training,
someone not clicking on a suspicious or malicious even link is
going to be the best approach versus someone clicking on that
because they don't know better.
And then our tools being able to take action upon that in relation
to drive by compromise our defense again virus,
but the one that we're going to be looking at is using a decoy system.
So how can we as defenders use a system which is isolated from our corporate
our core backbone in order for us to analyze something malicious like a file
or you are all of interest next stop Hive integrations with the Hive we have
numbers integrations we can be using,
we don't limit ourselves but we actually have a variety of choices.
For example, if we want to be pouring seem information into the Hive,
then we can use the curator to the Hive integration so
we can push telemetry from curators.
If we want to be pouring threat intelligence information into the Hive,
then we can use Myspace which we've already mentioned or
integrations like digital shadows,
crowdstrike and other similar ones which can give us a lot of information in
order for us to be able to effectively responding to incidents on top of that
we have the cortex analyzers which warranty.
A very special reference with the cortex analyzers.
What we have is an ability for the analyst to be able to analyze
artifacts of interest and rapidly understand if there's anything
warranting further investigation.
So for example if we have a malicious IP or malicious
URL or a malicious email address.
We can use _____ finder just as one sub case in order for us to
check to see if this has been known to the community of analysts
as being potentially malicious, we have additional integrations that we can use.
For example,
we might have a malicious file hash we can use the hash look
up analyzer in order to be able to check if that has been
seen as being malicious or not.
Some of these analyzers are free for use,
some of them are paid so we need to pay a subscription fee
in order for us to be able to use them.
Again,
quite an abundance of approaches that we can have in order for us to
be able to effectively responding to incidents.
Now without further ado,
let's jump into our demo environment and see how the Hive actually takes