Security Vision
Security Vision Threat Intelligence Platform (TIP) is an updated product from Security Vision. What is the purpose of this solution, what does it represent and what opportunities does it offer to businesses? Let's get to the bottom of it.
What is TIP for?
Every year more and more processes in companies are transferred to the virtual sphere, and as a consequence, the number of threats related to unauthorised access to information is growing. Modern organisations are starting to form a much larger digital footprint, so information security tools must also evolve. You need to analyse your company's risks, investigate threat sources and attack indicators, and monitor the presence of signs of compromise in your infrastructure, thus building your own unique threat landscape.
Threat Intelligence Platform is a class of automated systems that, based on threat data (it can be IOC, IOA, TTP, etc.), generate real-time detections of suspicious activity in the Customer's infrastructure, perform enrichment of indicators and detected incidents, integrate with the Customer's infrastructure and defences, and provide situational awareness.
The market for threat analysis and cyber intelligence solutions is a fast growing and evolving market. The TI solutions on the market differ from each other, including the coverage of the data layers they operate on. In the Russian segment, TI is traditionally divided into four main levels: technical, tactical, operational and strategic. Before TIP, SOAR or IRP class systems used to turn to feeds to check an incident already generated by internal rules for involvement in compromised indicators (IoC).
With the advent of TIP, it is now possible to generate incidents based on indicators of compromise identified in the internal infrastructure. It became possible to build links between incidents, attack indicators (IoA) and other types of threats. Finally, information about attackers' techniques and tactics began to be accumulated and systematised, and retro-analysis became possible.
Security Vision TIP
TIP interacts with other information protection tools, infrastructure objects and external services. It looks to feed providers and analytics services for IoC, IoA, threats, attacker and malware information, vulnerabilities, bulletins. Event information for matchmaking is collected from primary sources (Web Proxy, Linux server, Windows server, NGFW), Data Lake and DB (Apache Kafka, PostgreSQL, MS SQL), SIEM, EDR, and others.
Incident and indicator data can be automatically or manually transferred to SIEM, SOAR/IRP, NGFW, etc. Security Vision's TIP software product is designed with functionality to cover the needs of every level of TI. The solution helps to search for signs of attacks based on behavioural indicators and build a long-term strategy of information security of the enterprise taking into account current threats and risks.
TIP is based on the unified Security Vision platform. Customers have access to all the benefits of the platform, including extensive customisation options. The solution is fully parametric, and no programmer is required to create a new connector, report or dashboard: everything is configured through the user interface with appropriate administrative rights.
Security Vision TIP architecture
When implementing the Security Vision TIP platform at the customer's premises, it is possible to install all components on a single virtual server or spread the components across different servers for load balancing. The system architecture supports full fault tolerance of all components. The platform does not require direct access to the Internet, interaction with feed providers and external analytical services is possible through a special dedicated component located in the DMZ segment.
For all components of the platform it is supported to work on any OS: MS Windows, Ubuntu, CentOS, RedHat, Oracle Linux, Alt Linux, Astra CE ‘Orel’, Astra SE ‘Smolensk’/‘Voronezh’/‘Orel’. PostgreSQL, Postgres Pro or Microsoft SQL Server are used as DBMS.
Data loading
Security Vision TIP supports loading an unlimited number of various TI sources (feeds). For example, a list of suspicious IP addresses for the last month or attribution of attackers, APT attacks and malware, etc.
The basic delivery already includes integration with the most popular services that provide various indicators of compromise. These include Russian feed providers (Kaspersky, Group IB, BI.ZONE, RSTCloud), public platforms (Alien Vault, MISP, GitHub), popular open source feeds (Feodo Tracker, Digital Side, URL Haus, etc.), universal connectors to STIXII and other common formats.
In addition to compromise indicators, the system loads attack indicators, threat sources and other additional attributes received from both feed providers and specialised external services.
The system allows the user to add any indicator source using either a standard format (MISP, STIX2, etc.) or a unique proprietary format. For each source and feed, the user can set an arbitrary filter for selecting the downloaded data.
Individual schedules can be configured for each data load, both per vendor and per feed.
API
In TIP platform there is a possibility to upload data via API, which works by standard REST/JSON mechanisms via HTTP/HTTPS. It is possible to upload data both by IoC (e.g. for incident enrichment in external systems IRP, SOAR, SIEM, asset management systems, etc.) and by detections and any other system objects (IoA, threat sources, vulnerabilities, bulletins, etc.). It is also possible to create new indicators in TIP through the API.
Indicator sources
For each feed, system users can view and edit information about IOC, vendor, source trust scores, TLP, etc.
Indicator List
In Security Vision's TIP platform, indicators can be viewed as a general list or grouped by type, criticality, infrastructure detection, etc. The system provides three options for easy search of the required indicators:
- Full-text search - searches the value by the displayed IOC attributes;
- Quick - search by selected attribute;
- General - complex filter, with unlimited number of nesting levels of conditions on different IOC attributes.
The user can save the configured filter for reuse.
The user can perform preconfigured mass operations on the selected indicators, mark them as False-Positive, send them to NGFW, etc. The user can also create arbitrary mass operations. It is also possible to create an arbitrary mass operation, for example, to change attributes of selected IOCs or send them to an external system.
Indicator card
For each indicator you can view detailed information, which displays:
- Detection dates (including in the Customer's infrastructure);
- Indicator geodata;
- Life cycle status;
- Assessments (trust, criticality, TLP, etc.);
- Links to IOC and IOA indicators, MITRE ATT&CK, industries, categories, kill chain stages;
- Strategic attribution - related malware, attackers, threats, vulnerabilities;
- Information from analytics services;
- Detection information;
-‘ Raw’ indicator data from the vendor (JSON);
- History of changes in the indicator;
- etc.
Information from different suppliers is automatically deduplicated in the IOC card, the user can set flexible settings on the priority of suppliers and merging of received data.
For each indicator it is possible to perform a certain set of preconfigured actions, e.g. edit indicator values, add to favourites, upload in STIXII format, etc. This set can be extended by other actions.
This set can be extended by other actions through the corresponding system constructor.
In a special section Analytics in a graphical form for each indicator, the user can analyse links with other indicators/IOA/sources of threats, perform enrichment of IOC from external analytical services, perform actions both on the indicator itself and on related objects.
On the indicator card it is possible to upload a preconfigured report in a standard format (PDF, Word, Excel, ODS, ODT, etc.) containing all necessary information on the indicator. The user can adjust the report format through the constructor available in the platform and working on the no-code principle.
The system implements the indicator life cycle, which the user can manage both manually and automatically, setting the parameters of activity and presence in the system for each type of indicator through special settings.
Scoring
By default, TIP trusts the scoring given to the indicator by the vendor. For cases where an indicator is received from a vendor without a criticality score, Security Vision has developed a proprietary model for calculating the criticality of compromise indicators that takes into account, among other factors, the credibility, category significance, and relevance of the indicator.
Whitelisting
During the threat analysis process, it may be necessary to introduce certain exceptions into the detection process to exclude legitimate activities of the user, Customer infrastructure or trusted sources and thus reduce the number of False-Positive. In the TIP platform, exceptions can be started in a special ‘whitelist’ that specifies IP address ranges, parts of domains and URLs.
Detection process
The main functionality of the platform is to search for indicators of compromise in the infrastructure and, if detected, create incidents. For efficient and complete operation it is necessary to connect event streams from the maximum number of primary sources from the Customer's infrastructure to the system: network traffic, events from servers and workstations, mail traffic, logs from Web and proxy servers, etc.
Security Vision TIP implements the following mechanisms for receiving events to detect suspicious activity:
- receiving a data stream via TCP/UDP;
- access to APIs of external systems;
- receiving events from the queue (Kafka, RabbitMQ);
- execution of queries in the database/DataLake.
В Платформе реализованы преднастроенные коннекторы для получения событий из всех популярных SIEM-систем (MaxPatrol SIEM, Kaspersky KUMA, IBM QRadar SIEM, Microfocus ArcSight, и др. ), NGFW (Cisco, Checkpoint, Juniper, F5, etc.), proxy servers (Squid, BlueCoat, etc.), mail servers (including analysis of mail messages), Windows/Linux servers, Kafka/RabbitMQ event queues, etc., and others.
Universal data stream reception by standard formats: Syslog, CEF, LEEF, EBLEM, Event log.
Matching
Security Vision TIP uses its own optimised matching engine, which allows to perform detection on large data streams with an impressive IoC database. The system has performed consistently on 100,000 EPS, with over 10 million indicators.
The solution uses an optimised algorithm to work on Mask-type IoCs supplied by, for example, Kaspersky.
Retro Search
A very useful feature of Security Vision TIP is retro search. The system stores data received from related systems over a long period of time (e.g. a month or a quarter - can be set in the system) in an optimised form, and new indicators of compromise are matched with events that occurred in the past. In this way, you can see which internal infrastructure items were compromised before the threat was reported. You can set up a schedule and perform retro-analyses automatically, for example at night when the load on the system is minimal.
DGA / Phishing
An important functionality of Security Vision TIP is a heuristic engine that uses various ML models to automatically identify suspicious domain names or URLs in the Customer's infrastructure that are generated using Domain Generation Algorithm (DGA) or mimic well-known domains.
Detection Card
Based on the results of detected alarms, the system automatically creates detection incidents, which accumulate the information received from the event source, indicators and the system engine:
- Infrastructure detection dates and criticality;
- Lifecycle status and detection processing data (responsible, date of triggering, etc.);
- Key characteristics of ‘triggered’ indicators and ‘engines’ (types, categories, tags, etc.);
- List of triggered indicators with the ability to switch to the indicator card;
- Activated assets (hosts, accounts, mail addresses, attachments);
- Results of actions performed during the investigation/processing of the detection;
- Organisations in which the detection was identified;
- Event IDs from the source (e.g., in a SIEM system) and the total number of events;
-‘ Raw’ event data from the source;
- History of changes to the detection data;
- Chat to allow interaction between staff involved in investigating/processing the discovery;
- Links to created incidents in external systems (IRP, SOAR, SIEM).
The system implements a lifecycle for detections, whereby each detection goes through a series of automated and manual steps during investigation and processing. For example, when a discovery is created or modified, all ‘triggered’ indicators are automatically enriched from external analytical services, and information is collected from the back-end infrastructure for all participating assets. Thus, when a user starts working with a discovery, they immediately receive the most complete information on the incident and the infrastructure involved.
As long as the discovery is not closed, all new information detected from new incidents is automatically added and aggregated, and data is deduplicated. The user receives a grouped set of events to be investigated and processed as a single incident.
When working with detection, the user has a number of preconfigured actions to handle detection and interact with external systems and involved assets. Examples of actions implemented in the system are:
- Sending data to IRP, SIEM, SOAR;
- Collecting data on hosts, accounts, processes, services, sessions, etc..;
- Incident response: account lockout, host shutdown, mail account lockout;
- Checking attachments in internal and external sandboxes;
- Obtaining asset data from CMDB systems (MaxPatrol VM, etc.);
- Submitting to NGFW blocklists;
- Etc.
All actions can be configured by the user to be performed both manually and automatically. The set of actions can be extended through the constructor available in the platform and working in no-code mode.
In the Analytics block, the user can investigate and analyse detection in graphical form. The data is presented in the form of a graph that displays:
- All indicators related to detection;
- IOA and threat sources;
- Assets involved;
- Additional attribution (e.g., MITRE ATT&CK, vulnerabilities, etc.).
On the graph, the user can perform linkage analyses, perform actions on assets and indicators, and open object cards.
On the discovery card, it is possible to upload a preconfigured report in a standard format (PDF, Word, Excel, ODS, ODT, etc.) containing all processing history and discovery data. The user can adjust the report format via the no-code constructor available in the platform.
Vulnerabilities
Many vendors, both domestic and foreign, provide up-to-date information on identified vulnerabilities. These can be software vulnerabilities, operating system vulnerabilities, and even hardware vulnerabilities. TIP features integration with the most well-known vendors and vulnerability databases, for example: NIST NVD, FSTEC BDU, NKCCI, Group IB, Kaspersky.
Vulnerability descriptions provide additional context to the compromise indicator. The system reflects in the vulnerability card information automatically aggregated from all knowledge bases with deduplication. Not only the information about the identified vulnerability, but also the vulnerability criticality assessment, decomposed vector and even the descriptive part concerning mitigating actions with links to external resources are downloaded. This approach allows you to react in time and double-check the presence of this vulnerability at your perimeter, perform mitigation actions, and link the vulnerability to detected suspicious activity in the infrastructure. Excluding a vulnerability reduces the likelihood of an attack and the criticality of the threat.
From the vulnerability card, the user can download a report in a standard format that contains all relevant information on the vulnerability.
Bulletins
In Security Vision TIP you can work with bulletins - documents that are issued on a one-time or periodic basis and contain the results of the analytical centre's research on a particular problem/threat/attack/grouping, etc. or summary information for a certain period. The bulletin may contain a description of vulnerabilities, the latest threats and ways to counteract unlawful access to data. Bulletins are generated by organisations with expertise in the field of analytics and response to computer attacks, such as NCCI, FinCERT (Bank of Russia), Group-IB and others. The system implements preconfigured connectors for automated receipt of bulletins from suppliers, as well as the ability to create a bulletin manually.
IOA
In addition to information about low-level indicators of compromise, such as IPs, domains, hashes, etc., the Security Vision TIP data model includes attack indicators, such as registry keys, malicious processes and JARM (a tool for active fingerprinting to identify a malicious server), among others. The system is configured with out-of-the-box connectors for obtaining IOA from vendors and public/open-source sources and mapping IOA to compromise indicators. Information from the attack indicators is used to enrich (provide extended context for) the compromise indicators.
MITRE ATT&CK.
The Security Vision TIP functionality provides work with the MITRE ATT&CK knowledge base of techniques, its automatic maintenance in an up-to-date state in all main sections: description of tactics, techniques and sub-techniques, attacks, hacker tools and hacker groups, ways to counteract unauthorised access to data. Attack indicators are linked to compromise indicators through MITRE ATT&CK data, allowing for more effective investigation of threat detection incidents.
Attribution
The strategic level of information security management is represented in Security Vision's TIP by an attribution mechanism for data types such as attackers, malware, and threats. The interaction of these three data types provides the most complete picture of potential threats, their criticality, level of development and propagation.
Alerts
Users of the Security Vision TIP platform can receive alerts for all new and monitored indicators, detections and changes in their status, and changes in their life cycles, including details of the new object, its changes, and links to the object card. In case of a large number of triggered objects, the data is automatically aggregated into a single notification. The system has preconfigured notification channels such as email, Telegram channel, file network resource, etc. Users can customise notification types and add their own filters for each set of monitored objects, as well as configure other notification channels through the platform's built-in constructors.
Role Model
The solution supports a role-based model, where the user has access to various system functionalities and limited access to data and actions depending on the assigned role. Several preconfigured roles are included in the platform delivery. Each role has its own set of actions, available data, reports and dashboards, as well as its own menu and display settings. Multiple roles can be assigned to a user, in which case the user will have the authority of all assigned roles.
If necessary, an unlimited set of roles can be created and each role can have its own accessibility settings for each object of the system. All settings are made through the constructor included in the platform.
Interface
TIP from Security Vision supports operation in light and dark themes for the entire used interface of the platform. These settings are set individually for each user. Multilingualism is also implemented - the system interface supports the use of several languages as basic for the entire system, as well as individually customised for specific users (Russian and English languages are included in the basic delivery set).
Dashboards
The Security Vision TIP platform includes several preconfigured dashboards that display key information on detections, indicators and other system data in operational, analytical and strategic perspectives.
All dashboards are automatically updated and interactive: the user can ‘plunge’ into the required data slice and see the source for calculating a particular indicator. For example, clicking on critical indicators in the pie chart will open a view with a list of all critical indicators active in the system. And if you click on a detection with the status ‘New’, a separate list will display a list of all new incidents that have not yet been accepted for work.
The user can also change the analysed period for each dashboard - key parameters are provided as input data for all displayed elements, with the ability to adjust their default values from the general interface of the dashboard.
In order to visually track the geography of detections in real time, the Security Vision TIP platform features a graphical map that displays: triggered indicators and associated territorial offices of the Customer, where detections were detected; new indicators with their geographical location. All information is interactive: it is updated when data changes in the system, and clicking on an IOC/detection opens a card with details.
Dashboard Editor
The Security Vision TIP platform has a built-in editor of dashboards and displayed widgets, which requires no programming skills and works in no-code mode.
The user through the system interface can create and edit data sources (with the possibility of complex filtering, selection of object types and reference data, their linking and grouping, defining input parameters, setting up calculation formulas), data display (pie chart, bar chart, line graph, table and many others), styles, actions (drill-down, etc.), location in the dashboard with the possibility to set any size for each element and many other settings and functionality that allows customising dashboards with any size and functionality.
Reports
Security Vision's TIP solution includes preconfigured reports that allow you to upload data both on individual system objects - indicators, detections, vulnerabilities, etc., and consolidated reports that contain consolidated information on all data for the period and separately for each section of the TIP platform.
Consolidated reports can be uploaded manually by the user through a special section of the platform interface, where you can select the format of the uploaded report (Docx, Pdf, Xlsx, Ods, Odt, Txt) and, if necessary, adjust the input parameters for report generation (for example, the period for which the data is uploaded).
There is also a functionality of automatic scheduled distribution of reports to different channels and recipients: email, Telegram, File Server, databases, external APIs, etc. The system can be used to send reports to different channels and recipients.
Users of the Security Vision TIP platform can independently create new report templates through the inbuilt editor, the functionality of which is similar to the dashboard editor (with additional specific settings for each report format), which does not require programming skills and works in no-code mode.
In conclusion, we note that TIP from Security Vision complies with the ideology of technological sovereignty, being a fully domestic product.
