MineMeld: threat intelligence automation – export internal IoC to the community [3]

This post is the third of a series on Threat Intelligence Automation topic.
Post 1: Architecture and Hardening of MineMeld
Post 2: Foundation: write a custom prototype and SOC integration
Post 4: Search received IoC events with Splunk
Post 5: Connect to a TAXII service

After building the architecture and integrating the InfoSec feeds from italian CERT-PA into MineMeld and the near-real-time SOC engine, it’s time to put another brick to build an effective community: export internal IoC to the community in a standard format so authorized parties can get it and use them as they want.

The ultimate goal is to build a community that can share IoC using a standard language and a transport mechanism (STIX/TAXXI) getting data from heterogeneous sources (more integration examples in next posts) and injecting data into the community network.

So let’s start with the configuration steps. Continue reading “MineMeld: threat intelligence automation – export internal IoC to the community [3]” →

MineMeld: threat intelligence automation – foundation: write a custom prototype and SOC integration (Splunk) [2]

This post is the second of a series on Threat Intelligence Automation topic.
Post 1: Architecture and Hardening of MineMeld
Post 3: Export internal IoC to the community
Post 4: Search received IoC events with Splunk
Post 5: Connect to a TAXII service

On the first post of my threat intelligence automation jurney I wrote why I choosed MineMeld, the architecture implemented and the hardening steps. One of the goals is to connect MineMeld to heterogeneous external sources to get IoC (Indicators of Compromise) and integrate it into our i-SOC (Information Security Operation Center) near-real-time engine to get evidences of security events to be analyzed by i-SOC analysts.

In this post I show the foundation of the threat intelligence automation model: how I wrote a custom prototype to get the InfoSec feeds from italian CERT-PA (Public Administration – italian web site) and how I integrated these feeds into Splunk near-real-time engine.
I started with this integration because InfoSec has very good feeds (IP, URLs, domains) that are not just copy&paste from OSINT sources but are often updated and automatically analyzed to check that IoC are still “alive”.

This page and this page give you all the information needed to understand how MineMeld works, so RTFM before moving on 😉 Continue reading “MineMeld: threat intelligence automation – foundation: write a custom prototype and SOC integration (Splunk) [2]” →

MineMeld: threat intelligence automation – architecture and hardening [1]

This post is the first of a series on Threat Intelligence Automation topic
Post 2: Foundation: write a custom prototype and SOC integration
Post 3: Export internal IoC to the community
Post 4: Search received IoC events with Splunk
Post 5: Connect to a TAXII service

Last slide at my HackInBo talk (italian) was about how to automatically integrate threat intelligence feeds into our near-real-time Information Security Operation Center (i-SOC) SPLUNK engine to reduce the time spent by SOC security analysts on IoC (Indicators of Compromise) analysis.

At the time I was testing an open source project from PaloAlto: MineMeld. It was the right choice; after extensive tests MineMeld now help me to solve the challenges I had in the past while playing with IoC coming from various threat intelligence sources: collection automation, unduplication, aging and SOC integration.

MineMeld can also share our internal IoC to the italian infosec community we are now building from the ground. We are working hard on this and I’m really confident we will succeed (want to join? DM me on twitter or in the comments). Continue reading “MineMeld: threat intelligence automation – architecture and hardening [1]” →

The WannaCry journey from a SOC point of view – internal sinkholing of killswitch servers

In the previous post I described how our Security Operation Center managed the WannaCry news.

We also made a lot of side activities in the past hours and one of these was to implement an internal sinkholing of the killswitch servers in case some clients where infected; with a working local sinkholing we where able to avoid the ransomware spreading in case of infection.

How? Let me explain.

Continue reading “The WannaCry journey from a SOC point of view – internal sinkholing of killswitch servers” →

The WannaCry journey from a SOC point of view

In the past hours a new ransomware called WannaCry (or WCry or WannaCrypt0) spread very fast on Internet and targeted a lot of public and private organizations. The ransomware make use of public exploits related to the last Shadow Brokers leak, in particular MS17-010 vulnerability that was fixed by Microsoft on March 14 (2 months ago). You can read very good tech posts here, here, here and here and I suggest you also to follow on twitter Hacker Fantastic and Malware Tech.

Here I try to summarize my approach to the news, mainly highlighting what we did in my company in the past months and how we monitored WCry from our SOC (Security Operation Center).

There was (and there is also now) a lot of hysteria, but for people like me that work in a SOC this is not an acceptable mood; you need to relax, really understand what’s happening and verify that what you did before is enough and, if not, apply emergency countermeasures. Continue reading “The WannaCry journey from a SOC point of view” →