Johanna

McPhee

Yes we support multiple SIEM technologies and all are capable of integrating the listed technologies. Getting the right log sources is the foundation for an effective detection capability. Without effective coverage and the selection of the right logs, all other elements of a SOC workflow are compromised. To ensure our customers gain the most effective monitoring, we assist our customers by assessing the quality of the logs and the purpose behind ingesting them.

We would therefore work with the SJGHC team to onboard all needed log sources, including Firewalls, IDS/IPS, EDR, Cloud and Identity Services, into the SIEM platform. As most SIEM solutions base their costing on log ingestion, by assisting you in ensuring only useful logs are ingested, we help optimise your SIEM-related licensing costs. In conjunction with your team, we work to analyse your potential log sources and identify which will provide value, including:

• Identifying potential log sources.

• Determining their value in detecting security incidents.

• Analysing their appropriateness:

• Is it capable of sending logs to a SIEM?

• Are the logs currently being transmitted or used by any other system?

• What is the present level of configured logging?

• Provide guidance on any suggested changes.

• Configure and test that the SIEM is ingesting the logs correctly.

Custom Parsing For most customers, typical log sources will be supported by the SIEM natively; however, occasionally, we come across a system that uses a unique or unusual format. In this case, we have strong experience creating custom log source parsers and can do so for any unsupported log sources provided the following criteria is met:

• The logs must be available for collection via one of the supported collection methods.

• The logs must be appropriately delimited. This means that, where possible, the delimiting character should not also be present in the field or other mechanisms exist to differentiate the delimiter from data, such as quoting.

• All log data must be in a single log, not spread across multiple logs.

• Log data should be consistent.

If all the above criteria are fulfilled, then as part of the service, we will work to create accurate and efficient parsers. If not, then available options will be explored with our customers to ensure the outcome is achieved.

Threat intelligence forms an essential pillar of our service and is thus an indivisible part of our offering. As part of this, our service approach extends beyond simple Indicators of Compromise (IOCs) and utilises the Pyramid of Pain to guide our approach.

The lower four base levels of the pyramid are addressed in our service through advanced threat intelligence. This intelligence is gained from our combination of open, locally generated, client validated and private threat intelligence sources and enhanced by our Threat Intelligence Platform. This process provides wide coverage of Hash Values, IP addresses, domains, and artefacts which are then integrated into our ruleset.

However, a key differentiation in our approach when integrating threat intelligence into our service is our significant focus on the top two layers of the pyramid. Focusing our efforts on these layers results in higher value threat intelligence with significantly reduced false-positive rates in our associated Threat Hunting activities and ruleset

SOC Based Threat Intelligence Sharing

As the SOC and SIEM partner to many of Australia’s largest and well-known companies, we have developed our own approach to gather and utilise threat intelligence from across our customers to their mutual benefit.

Local intelligence is generated from devices and systems across our customers, along with key threat intelligence from detected incidents. We are able to collate this intelligence and uses it where appropriate to bolster our detection capabilities. Due to the nature of this feed, it is entirely in-house and not available for wider distribution, thus representing a unique value within our service. No identifying information is utilised in this feed and we do not disclose to customers where the data originated as a strictly adhered to policy.

Customer Supplied Threat Intelligence

Wherever possible and supported, we can assist in integrating any threat intelligence that the customer has access to into SIEM. This integration enables our customers to leverage their existing intelligence sources to enhance threat detection and response capabilities. Our team will work closely with the customer to ensure that the integration process is seamless and tailored to their specific needs, maximising the effectiveness of their monitoring.

ACSC & Other Bespoke Threat Intelligence

Finally, the ACSC and other threat feeds obtained due to our membership and subscriptions offer our customers considerable value as we have found their intelligence highly accurate, especially in the Australian context. Such feeds are integrated into our service and powers our automated threat-searching capability.

Every rule we implement for each customer is appropriately tuned and configured to their environment. Our careful approach to customisation differs from many SOC services that often take a one-size-fits-all approach to rule implementation, leading to high false positives or additional costs.

With our inclusion of rule customisation as a core service feature, we ensure that for every rule we implement for you, we undergo a four-phase process including:

• Understand – We will work with the appropriate contacts within your team to gather any organisational information needed for the rule. Tests will then be performed to ensure the correct log data is coming through.

• Implement – Based on the tests and information provided, the rule is implemented.

• Test – After the rule has been crafted, we will perform testing to confirm the rule fires when expected.

• Finalise – Once the rule has been tested, we will finalise the rule, which involves the following:

• Tune out any false positives.

• Create incident playbooks.

• Ensure risk rating is appropriate.

• Update communication matrix for email notifications, including incident escalation.

This process is also utilised for fully custom rules required within your environment and unique to your organisation. As no two organisations are the same even if they had identical log sources, we strive to ensure the SIEM deployment detects the activity required for your risk profile and requirements.

Rule Monitoring & Tuning

Once a rule is in place inside a customer’s SIEM, that is not the end of its development, as we internally monitor all rules for their firing rate, utilisation in cases and applicability based on customer changes and our threat research. Should a rule require further tweaking, we have a well-defined process which starts with the on-duty analyst who is trained to perform rule analysis and can include passing the rule back to our detection engineers for further research and tuning.

Cythera does not support Graylog as a SIEM platform but we welcome the opportunity to discuss other SIEM suitability that we could manage on your behalf. Our key partnerships are with:

• Crowdstrike

• LogRhythm (for on premise)

• Rapid7

• Microsoft Sentinel