Ruslan Rakhmetov, Security Vision
The development of information technologies, accelerated by pandemic effects, has led to a worldwide increase in the number of cyber attacks, an increase in the average size of damage resulting from a successful cyber attack, and increased public attention to information security issues. At the same time, the shortage of personnel has become much more acute: according to some sources, the current global shortage of IS specialists is characterised by almost 3.5 million open vacancies, while the total number of offers for cyber experts has almost quadrupled in 10 years.
In this environment, already employed IS professionals are under increased responsibility and pressure to deal with a large number of cyber incidents, configuring security systems, reporting and paperwork. At the same time, the number of protection systems is constantly increasing to minimise new cyber risks as companies evolve technologically and business processes digitally transform. A logical step is the formation of a request for consolidation of all events, alerts, alerts from the ‘zoo’ of security systems - so the company begins to think about the acquisition of a SIEM-system.
Modern SOC centres and cyber incident response teams, as well as MSS providers, are usually presented as a team of IS specialists and processes united around a main and core tool - a SIEM system that processes data from a wide variety of information infrastructure elements, ranging from network devices to business applications. However, for small IS departments, working with the SIEM system becomes just an additional burden: initial configuration, administration, writing parsers and correlation rules, setting up sources and monitoring them, dealing with a huge number of false positives (especially in the first six months to a year), and continuous tuning of the SIEM system take up scarce human resources. As a result, even if all the necessary preconditions have been successfully met and the SIEM system generates a meaningful incident in a relevant context, the IS analyst is left alone with a report of a probable attack, but without effective tools for additional analysis, localisation and elimination of the cyber incident, mitigation of possible damage, and post-intrusion recovery.
To implement this functionality, modern vendors of SIEM solutions offer an additional tool - their proprietary SOAR system (of course, for an additional fee).
Let's recall the succession of SOAR vendor acquisitions by major players and SIEM vendors: IBM bought Resilient in 2016, FireEye bought Invotas also in 2016, Rapid7 bought Komand in 2017, Splunk bought Phantom in 2018, Palo Alto Networks bought Demisto in 2019, Sumo Logic bought DFLabs in 2021, and in 2022 Google bought Siemplify. For buyers, of course, the tangible benefits of integrating SIEM and SOAR ‘under one roof’ are declared, but from the customers' side it looks more like selling an additional product without which the main one - SIEM - will not be 100% effective and will not be able to provide maximum value for the buyer.
With the development of SIEM-system technologies (Gartner, by the way, defined SIEM-system back in 2005, and the first Log Management/SIEM-solutions appeared at the end of the last century), manufacturers gradually added new functions to their functionality: First came normalisation rules, taxonomies and correlations, deduplication, auto-detection of IS event source type, downloadable forensics and content packages, then modules for asset inventory, vulnerability analysis, building and visualising attack chains, anomaly detection, and finally an incident management module (response scripts, case management, data enrichment, reporting). At the same time, the maximum benefit in terms of the core functionality of SIEM systems - incident detection - is still provided by the triggers of protection tools: network and host-based protection systems (including EDR, firewalls, IDS/IPS), traffic analysis systems, WAF and DLP solutions, sandboxes, account management systems, etc. - these are the data sources that will be most useful in identifying incidents when implementing a SIEM system. Data from directory services, endpoints and network devices, applications and infrastructure servers can undoubtedly provide a lot in terms of event correlation and incident enrichment, but it is not essential to have a SIEM system to effectively process this information - big data processing and analytics platforms can easily handle it.
Right now, some global SOC centres are not relying on a SIEM system as the ‘core’ of their SOC: the interest of reputable SIEM vendors in selling additional proprietary functionality for response, cyber threat analytics, and anomaly detection can lead to the so-called ‘vendor lock-in’, which benefits the vendor. However, along with ease of deployment and seamless integrations, the user also gets dependence of the entire IS infrastructure on a particular vendor, which, as practice has shown, may either suddenly leave the market or close a deal to sell its business to a larger player with vague prospects for the entire product line.
Realising this risk, astute managers of SOC centres and IS departments bet on big data processing and analysis platforms using such technologies as Apache Spark, Apache Hadoop, Apache Cassandra, Elasticsearch, MongoDB, Microsoft Azure Data Explorer, Microsoft Azure Monitor, etc. These solutions are designed to process large arrays of unstructured data, and any information from completely different systems (not only from IT/IS solutions, but also from business applications, from CRM and ERP systems, from web servers and mobile applications, etc.) can be sent to them for its consolidation and mutual enrichment in order to achieve a synergistic effect and increase the value of information. The resulting ‘data lakes’ can be made available to data miners, business analysts, employees of IS and IT departments, and heads of business areas - after proper processing, interaction with aggregated information will become convenient, the concept of ‘redundant data’ will lose its meaning, and the calculation of the cost-benefit ratio will demonstrate the economic feasibility of using a data analysis system compared to SIEM.
NG SOAR (Next Generation SOAR) solutions can be entrusted with handling the most valuable and cybersecurity-relevant data: such systems not only receive information from the original source (directly from the defence equipment), but also interact with security systems without intermediaries such as SIEM or log collection and forwarding systems. The use of modern API methods of interaction between the NWI and NG SOAR allows not only to extend the functionality of such integrations (as compared to SIEM systems), but also to ensure prompt sending of control signals from NG SOAR to the NWI (for example, to terminate a suspicious process, stop a service, block network communication with a certain IP address, network isolation of the device, reboot, etc.). The task of fine-tuning of protection systems to prevent false positives is important outside the context of SIEM-systems application - without such fine-tuning we cannot talk about cybersecurity. Thus, the issue of redundant irrelevant events that consume significant resources of IS specialists is solved: after tuning the protection system in accordance with corporate IS policies and taking into account the specifics of the infrastructure, only true positives will be transmitted to NG SOAR, of which there will be few, but each of them will have to be carefully dealt with.
Historically and technically, SOAR tools have a correlation mechanism but no set of ready-made correlation rules. The mechanism has typically been used to flexibly customise the response and enrichment process. NG SOAR class solutions actually include both a correlation mechanism and a set of basic correlation rules that provide incident detection with the ability to extend with its own correlation rules. This is necessary on infrastructures where purchasing standalone systems (SIEM, VM, IRP, SOAR, etc.) is not feasible for infrastructural or commercial reasons.
NG SOAR class solutions can independently triage (primary categorisation) the alerts received from an IPS, prioritise incidents, select an appropriate response scenario and promptly take countermeasures to contain the incident to prevent it from spreading and causing significant damage to the company. It is advisable to interact with protection systems to perform active response actions (sending control signals) using modern methods via API integration, while for protection systems that do not support API, it is still possible to connect to them via SSH, RPC, MSSQL, etc. NG-SOAR systems use machine learning (ML - Machine Learning) and statistical analysis of incident properties to identify anomalies and possible previously undetected cyber incidents in the infrastructure (UEBA - User and Entity Behavior Analytics), as well as to predict the next steps of attackers and the development of the incident to select the optimal countermeasures. The Threat Intelligence Platform (TIP) and mechanisms for enriching incident data from external and internal (including Data Lake) sources available in NG SOAR allow contextualising incident data, providing the IS analyst with a complete picture of the threat and scale of the incident, affected entities and infrastructure elements, as well as the relationship of incidents, artefacts, and indicators of compromise with each other.
It should also be noted that one of the most important tasks for many Russian companies is to generate and send reports on cyber incidents to the NCSCI (via the GosSOPKA system), FinCERT (via the ASOI interface), Roskomnadzor and industry-specific CERTs; at the same time, strict regulations on the timing and content of the notifications sent are legally defined for CII subjects, PII operators and financial organisations. In addition, organisations are required to receive security bulletins, provide timely responses to requests, and exchange information with these structures. To automate this interaction, NG SOAR class solutions offer built-in functionality for sending notifications and exchanging data with these entities, as well as for creating internal reporting and visualisation of the company's cyber security status to provide situational awareness to managers.
Over the past two years, the Security Vision platform has evolved into an ecosystem of IS automation products, the flagship of which is our new Next Generation SOAR cyber threat response product - the first Next Generation SOAR on the Russian market.
The development of response tools from IRP to SOAR and from SOAR to NG SOAR seems logical and natural in building a closed cycle of problem solving. Security Vision NG SOAR is a composite of technologies and functions focused on automatic detection and resolution of cyber incidents on-the-fly in accordance with the full cycle of incident handling phases (NIST).
Security Vision NG SOAR functions across the different phases of incident handling (NIST) addressing systems such as (see Figure): AM, VM, SIEM, SIEM, IRP, LM, SGRC, SOAR, TIP, UEBA, etc. directly necessary for a focussed response to full-cycle IS threats.
1. preparation => AM
2. Detection - Detection => SIEM, VM, TIP, UEBA, integration with AV, IDS, etc.
3. Containment => IRP/SOAR, AV
4. Investigation - Investigation => IRP/SOAR, SIEM, Log management
5. Eradication => IRP/SOAR
6. Recovery - Recovery => AM, IRP/SOAR
7. Post-Incident => IRP/SOAR, SGRC, SIEM
The product features cybersecurity incident detection mechanisms, unique investigation and response methods based on dynamic playbook technology and machine learning. All stages of incident processing are maximally automated and are characterised by a modern object-oriented approach.
The main idea of the dynamic playbooks concept is the automatic adaptation of response plans to the specific situation of a triggered incident: the system automatically analyses the event, its attributes, attack technique, involved objects and based on this information automatically builds the required playbook with the help of atomic response scenarios included in the product. Through retrospective analysis of the incident vicinity, Security Vision NG SOAR identifies the attack chain and builds a response based on the received objects.
This approach does not require complex pre-design and configuration of multiple playbooks, assessment and pre-calculation of attacker routes, infrastructure reachability, calculation of attack variants, and construction of attack maps and network infrastructure. Security Vision NG SOAR assembles a suitable incident handling plan every time.
NG SOAR is based on the unified Security Vision platform. Customers have access to all the benefits of the platform, including extensive customisation options.
