Detection as Code - Effective Approach to manage & optimize SOC Development

Detection as Code - Effective Approach to manage & optimize SOC Development

1. Effective Approach to manage & optimize SOC Development

Detection as Code

Security Bootcamp 2024

2. Whoami
Name: Nguyen Huu Vu Long

Email: [email protected]

Exp: 05 years
#SIEM, #RuleDetection, #Monitoring,
#SOAR, #CI/CD, #SOC-Architecture

3. 1.Big Problems in Rule Detection Development
2.Detection as Code (DaC)
3.Use DaC to Maximizing SOC Efficiency
4.Measure Attack Detection Capability
5.Keynote Takeaways

Agenda

4. Big Problems in Rule Detection Development
Detection as Code

5. ●Zone: Finance, Logistic, Workstations

●Environment: Dev, Testing, Production

●Total ~ 3000:5000 rules need to
deploying

Total of RuleSets:
= 3.000 rules * 3 * 3 = 27.000 rules

Issues:
●Can be time-consuming review?
●Can be misconfigured when deploy
manually?










Big Problem: Rules Management

6. ●What is that?

●Why did create that Alerts?

●How I know that Alert is True Positive?

●Operation depends on experienced









Need a location to store documents and define rule detection format




Big Problem: Document/Storage

7. ●Hard to keep track of what is changed, who, when,
where?
●Don’t have log audit rules for report rule
development
●Security Analyst modify rule lead to miss threat
detection



Need a tool save Changelog and quality control


Big Problem: changes, approve

8. When have a deployment process, need to have methodology measure.

●SOC Team: more 5-10 members
●Research, develop Rules Detection continuous based on “interests”

Issues:
●Many Rules is duplicated for detecting a cyber threat
●Which rules are need to prioritize for development?
●How to calculate detection coverage with cyber threats?


Big Problem: Measure rule detection capability

9. Need a approach, process, a tool
to improve SIEM Development

Detection as Code (DaC)

10. 5W: what? why? when? how? who?
Detection as Code

11. Key-Points:
●Define security rulesets, configure them as code
●Automated testing, deployment and updates
●Review & Approve




Detection as Code (DaC) Definition
(https://www.googlecloudcommunity.com/gc/Community-Blog/Getting-Started-with-Detection-as-Code-and-Chronicle-Security/ba-p/702154)

12. Refer format of Sigma rule detection:
●Open-source
●Human-readable
●Large community contribute
●Contain detail informations about testcase
Format of Rule Detection
https://sigmahq.io/docs/guide/about.html

13. Detection as Code: Workflow
backlog review
rework
documents test
update
approve
update
deploy
Tune rule

14. ●Jira: Ticket management (pay fee)
●Gitlab: Document, CI/CD
●Terraform: Manage configuration as code, deployment
●Graylog: SIEM
●VECTR: measure threat detection



Detection as Code: Techstack

15. Workflow in Technology
backlog In progress commit review approve deploy
yes
feedback
Quality control
mapping
Vectr
Graylog
TerraformGitlab

16. ●Review latest commit of rules once a month

●Change rule status:
○Experimental: 30 days
○Test: 30 days - 90 days
○Stable: > 90 days

Maintenance and Improvement
stableexperimental test

30 days
90 days

17. Demo
Detection as Code

18. Target:
Detection when new user added to root/sudoers
group

Reference:
●T1053.003
●Follow format Sigma rule
●Detail information about use-case

Todo list:
●Monitor event create new file in
/etc/sudoer.d/.*
●Ignore administrator’s files






Use Case: Persistence
(https://github.com/SigmaHQ/sigma/blob/master/rules/
linux/file_event/file_event_lnx_persistence_sudoers_files.yml)

20. Build test-case on Testing environment:
●Testing rule with real attack scenarios
●Ensure that log source has collected
●PoC easy to verify





Use Case: Testing

21. ●alert a change to Blue Team
●save change history in message
instant
Use Case: Notification

22. Terraform support:

●Detect change configuration

●Validate configuration

●Deploying automatic

●Rollback if not change by use pipeline



Use Case: Deployment

23. How to Measure the Attack Detection Capability?
Rule Detection Coverage

24. ●Platform Open-source
●Map detection rules to the MITRE ATT&CK
by TTPs
●Visibility coverage by phase, category

Measure Rule Detection Capability
https://docs.vectr.io/

25. Mapping Rulesets with Mitre Att&ck using VECTR Platform:
●Technique: threat_technique
●Name: threat_name
●Description: threat_description
●Phase: threat_tactic
●Priority: threat_score
●Outcome Notes: PoC testing


Use Case: Document/Storage

26. VECTR: Heat map of threat detection

27. ●Much support in SOC management, development, maintenance

●Easy to expand knowledge for SOC Team

●be self-host your power


Keynote Takeaways

28. THANK YOU FOR LISTENING!