[Autogenerated] So what I'm going to do is I'm going to look out from
the option that I have here and as I do that now,
I'm actually going to use my administrator,
that organization administrator user that I showed you earlier in
order for me to look into that Pluralsight organizational
instantiate Once I do that I'll be dropped within the high instance
that correlates to that organization.
Quite a lot of options that we can have here in order for us to
start checking alerts going over instance.
But first things first,
one of the most basic things that any security analysts
would do is create new cases to capture particular alerts
or particular items of interest.
Now with that in mind you can create a case,
you can import cases from telemetry that you get from your
tools from log entries and so on and so forth,
hitting the drop-down gives us an option to either create an
empty case or check one of the templates.
These templates have been pre created by me but we're going to go over
templates later on so I'm going to leave it for now,
choosing the empty case, I'm gonna use a title of a test case,
I'll specify an earlier date,
assuming that the incident has been reported to me prior in time And
I'm going to classify 4th of January after that I'm going to input a
short description for the test case and then I'm going to use that
to create my first case.
As soon as that happens,
I get dropped into the case details in order for me
to perform additional actions.
One of the classical ones is to edit the task list in order to
mirror what I need to perform as an analyst so I can create a new
log entry within the task list and after that's created I can go
into that and add my first Logan tree.
An analyst would commonly do that multiple times within a given
incident so I can come in and add my first entry and save that and
then myself or another financial analyst can come in again and at
the new entry to the very same incident as the investigation
progresses in the same manner.
We can have multiple logs in any given incident.
So if I go here within the observables page I can start populating
any observable that I have in mind that could be of interest for
this particular case that I'm creating.
For example,
I have some telemetry in relation to some malicious artifact
relating to a local boat sample campaign from 2020.
With that in mind I have a malicious hash that had been observed at
the time and a few malicious IP address is as well.
So what I'm going to do is I'm going to start dropping these as
useful indicators of compromise within the hive.
Now I'm going to flag this as an indicator of compromise here and I'm going
to use this field in order to report on it afterwards.
Again being very useful for my case analysis.
I'm going to,
I stole this particular rise of interest by creating that observable.
Another thing I've done and you might also choose to do is
create an integration of the Hive with cortex.
In order for me to be able to use the powerful cortex
analyzers an analyst without going too overly too much
detail about what that IOC is about.
We have a position to know that something does look suspicious.
If I run additional analyzers here I can get an insight as to my
potential need to investigate this further.
The second analyzer I'm using doesn't report anything malicious
which is another thing that you need to note.
Sometimes you'll have just one within the same logic.
You can incorporate additional I.
O.
C.
S.
So for example you can go to the observables again and say that you're going to
add a new IOC and this time we're going to add a foul hash.
So going to the type and choosing file hash and then
incorporating that particular file hash of interest.
Again, tagging it as an IOC.
Now same logic applies if I were to click on this malicious
hash or suspicious at this moment in time because we actually
don't know if it's malicious,
I will have different options for me to be able to analyze it.
Note that you have different sets of analyzers corresponding
to the IOC that you just incorporated.
So this being a file hash gives me these potential
analyzers to use some of the analyzers, as I mentioned earlier,
are paid while some of these are free now I'm using only the free months in
order to be able to demonstrate things that you can also use.
Now I've just run to one of them was unreachable,
which is perfectly fine because that happens as well.
But one of them just shows zero results.
Sometimes when we do analysis,
apart from just using these analyzers that we see here,
we might need to use additional telemetry.
We might need to use websites like for example,
hybrid analysis or virus total or anything similar.
All of that is fair game,
all within the scope of us being able to analyze efficiently.
Now we saw how we can incorporate some useful observables in order for us
to be able to reach a particular verdict about the case.
So being in a position to say if something is potentially
malicious or potentially warranting additional investigation
apart from creating items manually.
Like in this example, we can also incorporate alerts