The SOC and its roles

0:00What is a security operations center? Well, in our hearts, it can really be anywhere, anytime, anybody we want it to be. In reality, it is a centralized location where an organization can bring all of its security functions together to safeguard the organization's infrastructure of electronics. Now, if you notice, I didn't say anything about the internet or servers or dime any other particular system out. And that's because in the SOC, we are all in it together to be able to provide security for the CIA triad, which we will cover more in depth in the next skill. But if it processes information, if it touches information, if it deals with information whatsoever, we are dealing with it inside the SOC to safeguard it from any kind of threat, be it on purpose or incidental. And the reason I say that we can have this anywhere we want it to be in our heart is because we're now more in a cloud environment than ever. And we have decentralized a lot of organizations to where really a SOC can be worldwide, spread out, geo-dislocated. Now, traditionally, an organization would have its SOC in the building with it,

1:20because that's where all the servers are. That's where all the network components are. That's where all the physical media is and all the paperwork and all this other great stuff. But as organizations are starting to utilize cloud infrastructures, we're starting to see SOCs that actually employ people from home. You can even be here with me, sit down, not at my desk, but you know, like over on the other side of the office here, and be a SOC operator, be a SOC engineer. A lot of SOCs just make sure they come in pairs. But why is this? Well, it's easier to have somebody connect remotely with resources either provided by the organization you're working for, or, you know, on your own and however that works out. And then it is actually relocate you, move you to a specific building and have you uproot wherever you're from and do all this other stuff.

2:15And I see jobs all the time that are offering SOC online. Now I'm not doing that to say, I'm not doing all this to tell you, you know, stop what you're doing and go fly for a SOC position, because either you're taking this course for one of two reasons. Either you'll want to learn more about the SOC or you'll want to learn more about the SOC because you're already in it and you're just curious to know more about Splunk. And don't you worry, starting in the next skill, actually towards the end of this one, we're going to be tying Splunk in together with how it works and operationally to better the SOC itself, because that's what we're here for, getting the most out of Splunk. Now, by this point in your journey, you should have a kind of a baseline of knowledge of Splunk. I don't want to say a certain level, just an understanding of what Splunk is.

3:04It's an IDS, intrusion detection system. We use it to generate alerts and monitor things that are happening within the organization's network and coverage to let us know if things are working as intended or if there's something to take a more interest in. And this allows us to be able to automate some of these tasks and scannings. Not all systems are going to report like they should. We utilize in Splunk, we have seen in previous courses where we have to make sure that there is some sort of feeder going into Splunk. So is the target system or systems or network devices configured to send logs over to Splunk? Things to think about as we're going through this course, because if there's any kind of oversight and we're blind spots within our organization, my experience has been more times than not that it's because that device ain't configured to send things to us and we just don't see it. And then do we have those inventories inside of Splunk lined up with the hardware and software inventories of the actual organization?

4:15Basically getting with those system and network engineers to make sure that everything matches up one for one. But this is a good time to let you know that if you are just now getting into Splunk, I'd highly encourage you to take the Splunk basics course here first and then start coming back to this one, because we're at a certain point in our Splunk learning in this particular course where we know base commands. We're going to expand on those and learn some new ones as the course unfolds.

0:00But let's talk about some core purposes of what the SOC is and does and then we'll start moving along on how we kind of formulate this mystical mythical SOC. Central Command Function. The SOC operates as the centralized nerve center for providing continuous visibility, detection, triage, and rapid mitigation across enterprise networks. And this includes endpoints, cloud workloads in that cloud environment and operational technologies. So we have the ability to bring everything in together for one viewpoint essentially. So one SOC, one fight, right? Army day is starting to shine right there. The SOC is going to be ran by a SOC manager and it's going to be overseen either directly or indirectly by the CIO, CISO, or just directly the boss.

0:57And you'll hear throughout this course I refer to them as the C-suite or the boss. Different organizations have different structures and not every organization even has a SOC. Sometimes they third-party lease or vendor them like AWS. AWS has a third-party SOC operation that they can lease out to organizations that have some sort of network footprint across the interwebs. And that's okay for small organizations and there's absolutely nothing wrong with it.

1:28However, if you're an organization that does this and uses, let's say AWS is that third-party SOC for all of our security operations, it's only going to be as effective as the monitoring that you put into it, the person in charge of IT. Because if the SOC is only watching certain things, they're not being made aware of what's important to you. Because what's important to you may be different than what's important to me or to them or to somebody else. So keep that in mind as you think about the central command function of the SOC because that includes even organic SOCs. If it's not important to them, if it's not important to you, it's not important to them. So that's why the priority is set at executive level and dictated through delegation of authority to the SOC manager and then the different departments within. And what makes those departments are the people. Because this encompasses the front line of defense with all of those security analysts. I'm not getting into the different sections that we have just yet, but this is covering from tier one in initial triage all the way up to tier three in deep dive.

2:44What do I mean by tiers? Well, and those tiers are not set in stone by any means. These are kind of guidelines right here. And we'll cover them a little bit here shortly. But whenever you hear tier announcements throughout this course and we refer to them, it's either from my previous experience or just a general characterization of the different levels of security that we need to implement guided by certain frameworks already in existence. So then those people play into the actual process of what's going on inside the SOC.

3:20We have standardized workflows because the SOC doesn't operate independently of each individual within it. What happens is, is all of those individuals work together for one joint combined purpose. And that purpose is protect the organization and what the priority is of that organization set in our policies and procedures. We're going to rely on repeatable, and I can't stress that enough, repeatable standard operating procedures, SOPs. Automated playbooks that we're going to be introducing throughout this course that let us be able to say that looks like a duck, smells like a duck, go get the duck playbook and not the chicken one.

4:02Yes, it can be simplified that easy inside the SOC because the different roles, although they are looking for different things and performing different duties, all follow the same path of escalation. And we have all these flow charts and procedures that align with operations to say if it's an incident, it goes there. If it's an investigation for a digital forensics case, it goes up there. If it's just general auditing, it goes over yonder. And we also have industry response frameworks to base all this off of. Throughout this course, you will see references to NIST Cybersecurity Framework 2.0, Meter Attack Framework, and plenty of others. And this is really important right here, and I don't want to tongue twist over it more than anything else.

4:54We have a finite level of knowledge in the SOC. We only know what we know, and you don't know what you don't know, you know? And how we address this is by understanding it's called knowledge gaps. There will be things that you run across in some of your discoveries in Splunk that you just don't know what it is, and that's okay. I can't stress this enough. It's okay. So what we do is we address these gaps through those established frameworks and the other resources that I've outlined for you throughout the rest of this course to say it's okay to look things up, it's okay to ask questions. No matter how experienced you are, no matter how inexperienced you are, it's okay to eliminate those knowledge gaps and ask questions. Now, what technology are we using for this particular SOC learning experience, you might ask? Well, Splunk, of course, because now we're getting into more detailed analysis and understanding with Splunk.

5:53As we go throughout this course, we're going to be taking a look at how Splunk not only monitors traffic and can receive different type of events and logs and notifications, but how we can actually leverage it to tell us if something looks funny or looks suspicious. We can actually build rules inside of Splunk to analyze traffic live that match up with techniques and tactics used out of the meter attack framework. This allows us to be able to see if somebody's actually trying to launch a real-time attack or if we can sniff something out that may have gone unnoticed before. And I just want to stress more than anything else, this all provides into a continuous feedback loop. Now, you may hear the term loop and think, that's a bad thing, but it's not because the feedback loop that we're talking about here inside the SOC goes through and fills everybody else with that lost knowledge or that it fills the knowledge gap that may exist because you may know more about networking than I know about actual systems or vice versa. And what gaps that I need filled help me build out better Splunk defenses to better benefit our organization's defenses and overall the CIA triad.

0:00It should be no secret by now that a lot of the good idea fairies that we get in the IT world actually come from the innovative needs of the Department of Defense slash Department of War, whatever you want to call them. And that comes from the actual security need that the Defense Department has for operational security, not just IT security, just overall, because at the end of the day, it's about the people. For those that don't know, I actually am retired from the Army here in the United States, and I spent some time in some of these socks. I'm going to show you an example of one of these here momentarily. Now, this is not a one-for-one.

0:38This is not any existing sock out there. This is not a skiff. This is not anything. This is basically a rendering, if you will, of a composite of the different socks that I have worked in. Some may be this big. Some may not be this big. Who knows? But this is the general idea of what a sock might look like if it was in the Pentagon. That being said, what are we looking at here? Well, when we go through this course, we're going to be talking about different cybersecurity defensive operations that play into what this is. And I have it opened up in Snippet View because I have a highlighter here, and I can John Madden across here if I want. Generally, when we talk about tiers, we say Tier 1, Tier 2, Tier 3, and those have different meanings depending on which publication that you're looking at. For instance, here, Tier 1, come on now. There you go.

1:30We're talking about things that have been reported by users, helpdesk tickets, trouble tickets from some of the engineers, low-threat stuff. Not necessarily low-threat in the grand scheme of things. We're not trying to downplay anybody's importance, but what we are doing is trying to resolve issues at the lowest level possible. Now, that's not the only part, obviously. There's also being proactive in some of what we do in cyber defense. In sock operations, it's a joint effort. All these seats are filled by someone, and all of these someones have to work together for the overall big picture here on the big screen that is totally not used to play NBA at nighttime. We would never do that. But what we do have on those screens are different dashboard views that we learn to create throughout this course that feed different pieces of info. For instance, we have right here the Intel feed. This allows us to be able to start doing threat hunting and understand the emerging threats that may be coming in. This threat hunting that's done separately is fed all the way over here in, no, I'll fix that in a minute, over here to our Intel feed, threat Intel feed. If a ticket from

2:48these folks at tier one turns into be something that needs investigating, let's say it's a worm or it's something malicious in nature, it gets elevated to tier two right there. This tier two is all about being able to figure out what exactly is affecting the system and if there's any C2 going on, command and control communications between point A, point B. In addition to that, while tier two is going to be doing that, the Intel that is received from tier one and tier two is sent to our OSINT, Open Source Intelligence Analyst. Yes, we have military intelligence folks in here as well. And those MI folks are going to be sitting there trying to piece together from their Intel feeds from human and signal intelligence resources, nickel and diming together, if that threat is actually playing a part of the attack that may or may not be happening to our systems as we speak. It could be something that is an attempt and we actually go through and prevent it from happening. And I will let you know, more of these get blocked than are actually reported because folks want to see like tornadoes and stuff like that. It's not fun unless Evel Knievel runs it to the side of a mountain. That being said,

4:06we also work hand in hand with the network and system engineers. If we need inventories, if we need to find a system, change configurations for proper defensive patching. And then we also have our incident response and forensics teams. That's where I've been at a few times because my passion and background is digital forensics on the civilian side. And that what we do here is basically solve the crime aspect of this. And yes, we do get involved in legal problems that involve cyber crimes because an attack, be it malicious or not, falls into the realm of a crime, especially if you're going against the DoD slash DoW. Now, for the last few years that I was in, I sat back here and this is where the NCOIC sits. And I made sure that there were synchronous harmony between all of these different areas and made sure that reports that were sent up from all the different components and all the different configurations of these services made it to the actual operations OIC officer in charge and the SOC officer in charge all the way up to that core and joint level of signal operations to make sure that we kept

5:29the big boss, big, big boss up to date for all emerging threats. And now the other thing I want to point out too is the crossover to the civilian world. Your large organizations like Google, AWS and all them, they're going to have setups like this, very similar in nature to this. Your smaller operations, like mom and pop shops that can't afford all those different things, they ain't going to have this. That's where you have a one person shop that's going to be doing all of these different areas. And that's why we have this course right now, because we're going to be talking about what all these different areas of this fictional SOC is and what they do and how they do it with Splunk. You may not realize it or not, but all of this right here, we use Splunk. And most of what you see, I'd say all that right there, that's Splunk being displayed, all the different dashboards and reports and alerts and live monitoring that we're doing. These three right here are network status icons for the different systems and remote systems that we have out there. And this one is usually because the big, big boss wants to see the news. And then up here is a standard six time zone clock, because you got to have those in

6:45every DOD office. That being said, you ain't got to memorize this. You just need to know that everybody in here works together. And we're all in here for the same goal, and that is protect confidentiality, integrity, and availability of our organization, and more importantly, the people.

0:00Now believe me when I say this, I am not trying to oversimplify what SOC does. I am not trying to oversimplify what we do inside of Splunk. But I am going to try to oversimplify tier classification. And the whole primary reason behind me trying to oversimplify this is because no two snowflakes are alike. Much like tier classifications from one organization to the next are never alike. So you may be wondering why are we bringing this up? I don't want you to think of this as the end all be all.

0:32What I want you to think of it as is more of an outline. A guide, if you will, without the towels. Because this will give us a general idea of how SOCs handle certain things. How SOCs pass on certain bits of information and how we deal with certain levels of priority. So that being said, let's categorize our incident handling workflow into three tiers. As an example, in tier one, we want to do continuously monitoring.

1:06Look for incoming alerts. These alerts are going to be configured inside of Splunk throughout this course. And they're going to be set up towards different techniques and tactics that we learn about from the different frameworks. For example, if we have an alert configured to look for invalid logins, meaning somebody tries to log in five times within a five second period. Humanly impossible, unless a cat is walking across the keyboard. But if they have five failed logon attempts in a five second period, we need to be alerted.

1:40That's a tier one. Because they didn't get in, but at the same time, somebody's trying to attack it. If somebody does that exact same thing, and then on attempt number six, within that five second period, they log in. We might want to raise the importance of just a little bit, because then it's something that's been compromised. But these tactics are known as, let's say, like credential stuffing or brute force attacking. We have rules developed inside of Splunk to be able to look for just that kind of thing.

2:12And depending on if they're successful or not, or the type of rule that it is, it's going to send an alert regardless to us inside of the actual Splunk dashboard we get set up and configure. That alert is going to be flagged at a certain level of priority, and it's going to go through tier one, otherwise known as triage. When we look at triage, we're talking about getting the pulse and everything that you would do to a person in a hospital for that actual incident. Name, place, all the five W's and how, basically getting a pulse on what the actual incident is.

2:46Now, you know that if somebody goes into an emergency, matter of fact, I'm going to give you a prime example of an emergency room. Put me back on full screen for a second. During the summer, I had a horrible accident. You can't see it anymore, and I had to take a break, because I have some acres out back, and I was setting a brush fire. We weren't under burn ban or anything like that. I have some tallow trees, Chinese tallow trees, and for those that know, once you let them sit for a while, they can get really flammable really quick, and the sap from them generates nitrogen into the soil.

3:19Well, guess what? I didn't know that, and those trees have been sitting there until the first big rain we had of the season, so I can actually burn without burning the rest of the yard down. Well, that burn pile in the back cast fireball on me, and I rolled a nat one for my deck safe. So, I went to the ER, because it got all across my face, all down my arm, second and third degree burns, and the biggest thing I was concerned about was, you know, obviously, my hair. Obviously, I saved it. That being said, I go to the ER, and they're going to triage me.

3:52Now, there was somebody else in the ER that actually needed more attention than me at that moment. I'm not going to get into what they had going on, because, you know, it was pretty gruesome when I saw it. They obviously needed more attention than me, but due to the nature of my injury and what had happened, I needed to have something to be done to me, so they, instead of letting me wait in the waiting room, they brought me to the back. After 10 minutes of no medication and nothing, I was in the waiting room that I drove myself to for this.

4:26And their thinking was, is that because I drove myself, avoiding that high ambulance bill, that they can actually take their time on this more gruesome patient? That gruesome patient needed that extra attention. I needed some attention, too, and even after that gruesome patient left, I was still seeking that attention. Now, my problems with the ER here aside, there is a priority. No matter if you think your individual situation is bad or not, I can look back, and even in that moment, realize that person needed more help than me.

4:57And I can suffer through something that was, not necessarily neglect, but unknown information on my part to make sure they get okay. And, you know, I got better. You can't even see it anymore. You know, my face is okay. My hair is still good. I'm okay. Learning lessons, right? Well, what if it had been worse? Put me back on the chalkboard, me. Good job, me. So we then go into tier two for the investigation portion of this, where when we investigate something, we're trying to figure out what exactly happened.

5:29For me, it was Chinese tallow trees sat around so long, and according to my mother, who is actually in forestry and has a full-on master's degree in it, apparently Chinese tallow trees can develop nitrogen bubbles in the soil if left too long, and the sap drains in, and can cause flare-ups and immediate fireballs if ignited. That was the investigation part after the fact. But now that we know, we can build rules on how to defend this at that tier two investigation level too, because we are doing that deep dive investigation.

6:03The rule for me now is, is that anytime I cut the remaining last of the Chinese tallow trees in my backyard, I'm just going to call a dumpster and dump them in there and pay to have them hauled off. That's my rule for this, because I'm not dealing with that no more. But what happens if we know about this ahead of time, and we want to be able to prevent this from even happening to somebody else, or in another way? What if there's another tree back there that I don't know about that's actually sniping around the corner, trying to get me in my sleep and whatnot?

6:38Well, that's where tier three is, and tier three is basically threat hunting. We're learning about the enemy. We're learning about that Chinese tallow tree. And this is where we handle advanced persistent threats, APTs, and you can build rules out for them as well. So long as they're studied and isolated in, let's say, like a sandbox environment where you want to practice on them and things like that. But frameworks are really good for APTs because this is one of those cases to where it's best you learn about these Chinese tallow trees from me, because I made that mistake, then have it happen to you.

7:12And I'm going to tell you right now, it didn't feel good at all.

0:00The SOC covers a lot of ground in covering the defenses and intelligence gathering of all the IT systems, everything that is encompassed inside of the CIA triad. That is a lot of stuff. Now, with all those different devices, we're talking different operating systems, different manufacturers, systems and networking devices, even the toaster. I'm going to the extremes there, but we even have refrigerators that have touchscreens and internet capabilities.

0:35So every one of these devices that can communicate is also sending traffic in the form of an event log or some sort of capability of communication logging the ins and outs and actions that happen on that particular system. We know already that we can send all of that information inside of Splunk and it can be handled using a common information model. Basically, what we're doing is we're taking a field and a value and pairing them together. This is usually done with some sort of XML or JSON format behind the scenes for that particular device and that logging event will go to Splunk, be parsed inside of the actual data set that it collects everything in, and then is read inside of Splunk. We'll take a look at that here momentarily as an example.

1:36But you may be wondering, is this the only system that we're going to be using inside the SOC? Well, for this course, yes, because we want to see how the Splunk can ease our tensions and make life a whole lot easier for us, especially in security operations. But allow me to put something on the screen that I also have in this particular nugget right below. And I'm on it, I promise. It's right here. These are the four variety types of systems that you will find inside of a SOC.

2:11Now, I say variety type because these are not name brand. These are not like specifics here. These are just generalizations. For instance, you have an IDS, which is Intrusion Detection System. And this is going to basically read all the alerts that we're getting from all those wide variety types of devices within the organization and parse through the information in that field and key value partnership and send us an alert based on the rules that are put in.

2:43Now, that alert is really the only action that this IDS can take because it's detection. It has no other action than to tattle on everything. Whereas the IPS, the Intrusion Prevention System, actually takes an action. And it can read all the events coming from these different systems and go even beyond by taking a preventive step or an action against something. For instance, if it sees something not right on a router, it can actually block certain bits of traffic and implement this in real time. Again, this is just an overgeneralization.

3:21Then you have, as far as the overall operations are concerned, a SEAM and a SOAR. Now, a SEAM is where we're going to be dealing with Splunk here because there are two areas in what you see here on the screen that Splunk fits in perfectly, IDS and SEAM. Splunk will not take an action against any particular piece of data that comes through other than to let us know that it actually took place based on the rules that we get or set or import or develop ourselves. And you'll see in this course that we have ways to either manually make these rules or get them from a third-party source because, hey, I ain't afraid to learn. But the SOAR is where Splunk will eventually send its data to later on down the line in terms of like the overall picture that we looked at a while ago of a SOC in its entirety. Splunk is not the end-all be-all with a SOC.

4:20Splunk makes SOC life easier. You see in here, let me see if I can point correctly, right there. Integrate security tools to run automated playbooks, orchestrate incident workflows, and execute rapid containment actions at machine speed. Well, these are a lot of actions that are being taken based on the information that it receives. Does it need to initiate a work ticket? Does it need to initiate a containment action, meaning like an IPS where it either blocks, isolates, goes even further to delete something? Whereas the same aspect of what we're dealing with is in line with Splunk. We are just the referees right now. We are watching a football game in progress, and it's up to us to throw that penalty flag if needed. Now this is the Splunk that we will be using. I go more into this in the next couple of skills as far as like how to get in and how to start this back up. If you've been a part of our courses already concerning Splunk, it's almost the exact same way with the other courses. A couple of slight differences. The only reason I wanted to bring this up to your attention is because as we're starting to get into SOC and really defensive operations using Splunk, we need to keep in mind that there are events for everything. For instance, this one data set that

5:40we've been working with for the past couple of courses, and for those new joining us, we have a bot sv3 demo data set that we got off of GitHub. I'll have the link for that in the upcoming skills that basically have recorded a couple of years worth of data and put it all in one data set for lab purposes. And you can see that there are over 2.8 million individual events that took place in this period that are recorded. This is just one data set. Inside of a SOC, you're going to see a data set nearly for every department that's within the actual SOC. OSINT's going to have theirs.

6:23Digital Forensics is going to have theirs. Overall is going to have theirs. And Tier 1, Tier 2, etc. Systems Network. You'll see all these different data sets to include all the internal ones that work behind the scenes with Splunk. And all of these different Splunk data sets could all be on individual Splunk servers. They could all be talking to one master Splunk server to create the dashboards that show us in real time the plays that are happening. Because we don't want to just blindly throw penalty flags on stuff if we don't get all the details. We have other referees on the football field. We are the White Hat. But there's a line judge. There's an umpire. There's all sorts of different judges out there. And all those referees work together to tell the White Hat what the actual penalty was that happened on the field. And that's what we're doing with our Splunks with the integration inside of the SOC all together.

0:00Now for those of you that are just now joining me, Eric, here for the first time on CBT Nuggets, you'll start to understand that I like my scenarios. I don't try to make them difficult. I try to keep them more real world-ish. And that way, if you do decide to take, I don't know, some sort of test or whatever that may be related to this, it might be in line with doing so without using exact questions. Because I want you to get the practical experience behind this and a true understanding of any content we do together, more so than I want you to understand the black and white of it. Don't get me wrong, there's places for both, but I'm all about practicality and, you know, knowing that you can actually do the work. Now, that being said, let us jump into our scenario.

0:48During a standard evening shift, a tier one analyst in a regional defense contractor SOC observes a spike in suspicious activity on internal workstation. Following their standard playbook, the analyst notices multiple failed logon attempts, followed by an unusual PowerShell execution script reaching out to an external IP. Guided by the organization's defense in-depth model, the analyst knows not to handle this in isolation. They verify the baseline telemetry, document the internal timeline, and immediately escalate the ticket to tier two for deeper investigation and potential host isolation. The tier two analyst pulls up Splunk Enterprise security to evaluate the scope of the incident. Ingesting normalized endpoint firewall and authentication logs, Splunk aggregates the host's recent activity and triggers a high severity alert via its risk-based alerting framework. Running a quick search processing language, SPL, query, the analyst correlates the outbound connection with a known threat intelligence indicator, confirming beaconing activity from a compromised credential.

2:06With Splunk connecting the timeline of events across the network, the analyst confidently determines the incident is an active intrusion and executes the containment playbook. Now, one thing before we get into the questions. I integrated a lot of terminology to prep you for the rest of this course. So if there are a couple of things that I know that are in here that you are looking at going, hmm, well, think of it as a teaser, because everything in this scenario can be answered out of this skill. In addition to that, everything in this scenario is covered throughout the rest of the course in wonderful detail with prime examples in our labs.

2:50Now that takes us to our questions, because in this scenario, question one, by the way, what primary factor prompted the tier one analyst to escalate the incident rather than close it in attempting containment independently? And the answer, oh, wait, I forgot to do the pause. I normally do those two. So read the questions, try your best, and we'll review it here. Ready? Pause. The answer for this one is organization playbooks and defense in-depth policy required escalating correlated anomalies. This is basically sending everything up to tier two for deeper investigation.

3:24And this is because our tier one, and remember, this is not doctrine. This is not gospel. This is not anything written in kind of statute or whatever. These tiers vary by names across different organizations. This is a generalized overview, an oversimplification of different priority levels within the SOC. So I am using terminology from the DOD slash DOW. You may have something in your organization already that deals with this in a different manner. For example, you may say tier one, tier two, and then black watch plaid for whatever reason.

4:06But tier one in this scenario is focusing on the actual initial triage. So something has been detected. We're going to verify the actual alert itself through validation, and we do this in Splunk using all the events that we've collected from the different devices throughout the entirety of the organization. Our timeline documentation is pretty simple. We can do a chain of events based on common timestamps. Now, we go through later in the course on how to do that because different devices report time differently. And depending on our organization, we may be geo-dislocated from each other and have different time zones to cover. So not only do we have to worry about universal time and making sure everybody's on GPS time, but we also have to make sure that we understand what time is it in a central standardized time zone. In the military, we use Zulu time. In the great republic of Texas here, we use Texas time. It's all Texas time. Yes, I know there's two time zones here. When suspicious behavior actually spans those multiple indicators is when, and I'm talking about like the failed log-ons and the authentication or the

5:22execution of different things. That's when we start putting everything together and the tier one folks are going to escalate it up saying this is a suspicious activity. We want to start pushing it forward. Now, our second question is, is how did Splunk Enterprise Security assist the actual tier two folks in determining that this event warranted immediate containment? And the answer for this one is, is that it aggregated normalized logs across disparate sources. This is one of those words I can read, but I have a hard time pronouncing, I'm sorry. And we're talking about the end point, the different end points, the firewalls, the network devices, everything, and flag the cumulative risk score via risk-based alerting. So what does that mean?

6:07Well, it took all, the tier one folks took all that information, made that timeline, made that storyboard of what actually happened from all those different devices. And then based on all that information, they sent the chain of events up to tier two. Tier two is able to look at it and assign a risk value to it through RBA. And based on that risk and basic prioritization determines how it's going to be handled right after that. So if it's a low priority or a low risk factor, do we need to handle it right away? Probably not. Is it something that is critical that needs to be done right now? Well, it depends on a lot of factors. And this is just a kind of a tip of the iceberg thing. Is it a high priority system? Is it something that has something directly to do with CIA? Is it one of the bosses or C-suites systems? Is it a forward-facing service that provides revenue for our organization, et cetera, et cetera, et cetera. And there are many things like PII that have nothing to do with what we just mentioned that can also play into that risk and prioritization. So this is where tier one is just getting the chain of events, all the information. They're that side judge that saw the offsides. They're going to the referee

7:25with the white hat to say, this is what I saw. I think we should call a penalty on it. Or do you want me to go pick up the flag and just let it go? Our last question is, is that which action performed by the tier two analysts directly verified that the outbound PowerShell connection was an active threat rather than routine administrative activity? The answer for this one is, is executing an SPL query that correlated the outbound destination IP with known threat intelligence indicators. So we're going through even further with tier two and saying, we checked all the logs, we checked all the events, and this was not ran by anybody locally. And we're going to see who owns that IP address. Now, this is where inventory comes into play because those tier two folks in this scenario are going to get with the systems and networks engineers inside that neat little picture of the sock that I put up earlier and say, hey, does this IP address belong to you? If not, who does? Who owns it? And if it's one of those known baddies, or if it's out there in the wild, then it doesn't belong to us. Why are they executing PowerShell? All this and more in how we use Splunk to make sock operations a whole lot easier for us. So buckle in and let's

8:46do it to it. I hope this has been informative for you. I'd like to thank you for viewing.