ThreatLink
- Jonas Gonzalez
About ThreatLink
Devo ThreatLink is a centralized, automated case management solution that empowers organizations to efficiently navigate the complexities of incident response by leveraging integrations to hundreds of security and IT tools.
ThreatLink consists in an alert triage playbook that intelligently correlates and enriches alerts to generate high-fidelity cases, dramatically reducing analyst workload. This simplified case correlation algorithm enables automatic prioritization of investigations based on risk, severity, and business impact, while also helping to reduce alert fatigue.
How it Works
ThreatLink works by conducting the following steps:
Gather Alerts: ThreatLink starts by reading all of your organization’s Devo alerts into the playbook every 15 minutes or less, based on stream parameters.
Extract Alert Entity Data: If an alert does match with an existing case, its entities are extracted from the alert. If it does not match, a new case is created.
Link with Existing Cases: Once the alerts from the last 15 minutes are retrieved, the alerts are cross-referenced with the existing cases from the last 7 days. If a match is found, the alert is added to the existing case.
Build New Case: With all of the alert data parsed and normalized, the alerts are then correlated with each other through the explicit matching of the alert entities. All of the data from each of the alerts is organized into a human-readable format that is displayed within the case template.
Explicit entity matching between alerts is achieved by hashing all entities within an alert and comparing this hash to those of alerts currently tracked by the playbook, as well as newly fetched alerts. If there is a complete match across all entity values for a set of alerts, a case is created for that group. If no matching set is found and no prior cases exist, a case with just that single alert is created.
Note:
In order for the correlation to work, the alerts in Devo must have the entities mapped in the alert definition. Entity mapping is defined by adding lines like the following to each alert:
select sourceIPAddress as entity_sourceIP
The full list of entity mappings is shown below:
Users | Device | Domain |
|---|---|---|
entity_sourceName | entity_sourceIP | entity_sourceDomain |
entity_destinationName | entity_destinationIP | entity_destinationDomain |
entity_sourceAccount | entity_sourceHostname | entity_sourceUrl |
entity_destinationAccount | entity_destinationHostname | entity_destinationUrl |
entity_sourceEmail |
|
|
entity_destinationEmail |
|
|
ThreatLink can also support additional custom entities, refer to Customizing ThreatLink section below for additional detail.
What is a ThreatLink case?
A ThreatLink case represents the output of the ThreatLink playbook and the work unit of the SOC. The information from the alerts that have been correlated is taken into a single case. Within each case, all the relevant information is included to investigate and take further action.
An example case can be seen in the image below:
The case template includes the following information:
Summary: All of the details of the alerts that have been added to the case include the tactic, technique, alert context, entities, etc.
History: All of the actions taken on a case, including the user that completed the action, change that was made, and time of completion.
Alert Queries: The Devo SIEM alert query definitions that created the case.
Case Details: The basic fields to manage the case such as ‘Status’, ‘Priority’, or ‘Assigned To’.
Workflow: Additional fields to track the status and manage the case, all customizable by the team.
Tasks: The actions available for the analyst to take when managing a case, all customizable by the team including manual tasks, automated forms, and integrations.
Linked Alerts: All of the correlated alerts and the detailed information about each alert in a list format for user context.
Additional / Extract Fields: The entity correlation hash and the extracted entity fields.
Get started with ThreatLink
Prerequisites
Ensure the proper entities are mapped in your Devo alerts, as they must include at least one entity mapping value. A sample alert with entities mapped is shown below:
The Devo Support team has an entity validation script that can be run to support the updating of your Devo alerts to meet the prerequisites.
Installation
Please contact Devo Support or your Customer Success Team and place a request for ThreatLink installation.
Provide us with a Query API Authentication token and an Alert API Authentication token from the Devo SIEM to initiate the installation process.
Customizing ThreatLink
Case Types and Settings
ThreatLink has a large number of templates that can be used as the basis for customizing workflows and tasks for different use cases. In addition to the default case template, ThreatLink can be cloned to create additional templates for Phishing, Password Reset, User Account Lockout, Firewall Block, Endpoint Isolation, and more.
It is important to note that only one case template is included in the initial ThreatLink installation, so it is recommended that your team configures their tasks and workflows accordingly.
Custom Lists
ThreatLink can be customized to optimize its performance for specific environments without requiring any changes to the playbook. This can be accomplished out of the box by selecting the option ‘Custom Lists’ under the ‘My Library’ menu.
Case Correlation Variables
The tuning parameters for the case correlation playbook are located in the Devo_Case_Creator_Variables custom list with the following parameters:
Lookback_Days- Defines the time window for related alerts to be grouped under the same case.
Once a new time period begins, ThreatLink will create a new case and start looking for matches within that time period’s timeframe.
Alert Routing to Case Types
In addition, customers that require customized case types assigned to specific alerts can edit the custom list ThreatLink_CaseTemplateAssigner to link an alert name to a specific type.
Here is a simple example of how to link the SecOpsVpcNetworkScan AlertName to the case type VPCCaseTemplate.
High-Value Target Custom List
A custom list called High_Value_Targets can be used to add additional risk information to cases. An example of the scheme is below. This list can include users, IP addresses, or hostnames.
Type,Entity,Enabled,Risk_Score
User,carlos@devo.com,True,7
IP,192.168.10.150,True,2
Host,MachineName,True,50Add Additional Tasks To a Case Template
Take advantage of hundreds of Devo ThreatLink’s integrations to Security and IT tools, and add additional tasks to your cases for automated incident response by navigating to ‘Case Settings’, opening up the ThreatLink Case Type, and selecting the Tasks tab.
To learn how to create Tasks, User Input forms, and integrations to other tools, please check additional documentation in this page.
Troubleshooting
One potential issue is that a case may become misformatted (see screenshot below). This typically occurs when fired alerts are not correctly matched to their alert definitions. Several factors can contribute to this, including but not limited to:
For MSSPs: Ensure that all child domains with active alerts are properly configured in the Domain Connection List.
Alert Naming: If unusual characters are used in alert names, this may cause correlation issues. In such cases, review the blocks responsible for normalizing and matching alerts.
For Non-MSSPs: Verify that the main Alert Definition Connection is properly configured and functioning as expected when the playbook runs.
The following image shows an example of a misformatted case.
Release Notes