When I look at enabling you to deploy these blue team
tools in your enterprise environments,
the first thing that I need to give you is how to relate that to management,
to get by in,
and so that's the framework that we just covered and
the kind of thought behind that.
Then you also need to worry about things like,
am I fulfilling my audit requirements, am I checking the boxes for compliance,
and that's also covered.
And now it's something to focus on you doing the technical
implementation and the actual hands‑on keyboard action,
though for this to be truly effective,
there needs to be a single narrative that combines the need,
not just for management at a strategic level and not just for compliance,
but also down to your technical implementation level.
In that way, we're all talking about the same thing.
But how do we do that in the most effective way possible?
That's right, by TTPs.
And thankfully, MITRE ATT&CK is our source for TTPs based on groups.
Looking at this from the blue team perspective is a bit different.
Each of these tools may have overlapping capabilities,
but especially for teams looking to fill gaps in current operations,
the best way to build is based on data sources,
which is what this map represents.
It's a mine map of TTP's map to data sources that
you need to use to detect them.
Depending on the kind of data that you have available,
you can look at the categorization of these tools based
on what type analysis they perform.
And this way,
you can match your capabilities with the information that you
currently have available to make you effective today.
Then you can map those data sources to the MITRE ATT&CK
techniques that this tool and the courses associated with
the tool will focus on detecting.
In the case of operating system analysis,
this describes an EDR‑like capability, processes,
OS‑based logs, memory, that sort of thing.
And, of course, say on Hunt ELK, or HELK,
the tools capable of using Windows logs to detect malicious use of BITS Jobs,
Kerberoasting, and the clearing of Windows event logs,
and so that alignment looks like this.
Though in the case of a tool like Arkime, formerly Moloch,
you have network data to analyze,
and you can detect TTPs like External Remote Services,
the scanning of IP blocks, or protocol knocking.
And as you look at different tools,
they'll be TTPs that aligned to the data source
explained in each of these courses.
Application analysis would relate to a tool like Mod Security that is
analyzing Apache or NGINX logs for web attack signatures.
Infrastructure Analysis is looking for syslogs from routers and switches or
even considering cloud‑based infrastructure as supporting infrastructure
that needs to be monitored and analyzed as well.
Threat intel tools will use their own various resources of
information such as MISP and TAXII feeds,
and incident management really leverages the data output from the
other types of analysis to identify trends,
and events, and incidents with tools like TheHive Project.
And just to really round out the ability to align these blue
team tools with your business use cases and the specific
niche they fill in your defense, there is now a resource called MITRE Shield.
MITRE Shield is the antithesis to MITRE ATT&CK and
focuses on defensive capabilities.
Now, in some rooms, the theory of implementation is called active defense,
and that's what you're going to find on their website.
But I don't want that to be confused with hacking back or anything that would
violate any laws or expose an organization to further risk.
Active in this instance and the instances in which we're going to
teach you to use these tools is just used to describe the culmination
of the process I just walked you through,
to leverage a defensive capability to actively meet the adversary's
capabilities with a response before you encounter it.
And just like MITRE ATT&CK, it has its own matrix,
but much of this is still in development,
and they're working on how best to organize the dataset.
Feel free to explore the resource here at shield.mitre.org/matrix.
My focus is instead on meeting the technique,
or TTPs,
with the defensive capability and giving you the capability to
match blue team tools to defensive use cases.
What is the use case for these tools as it maps to a
mitigation to a MITRE ATT&CK TTP?
You get there in this website by looking at Mappings and then,
for instance, under Reconnaissance,
a technique like Gather Victim Network Information is matched by
the defensive technique of Network Monitoring.
At the Shield technique level, it's still pretty vague,
but I see real value from the use case information within the technique.
Different tools monitor different aspects of the network,
so there are different use cases for different kinds of network
monitoring capabilities that need to be explained.
The defense of use cases, or DUCs, as I call them,
clearly explain how different implementations relate to
actively countering adversary TTPs.
And this way,
each tool course is going to explain to you the use cases for how it
will counter each of the MITRE ATT&CK techniques,
fully covering every angle of a kill chain you may be looking to interrupt
or a specific adversary that you're looking to counter,
and most importantly, being very clear about what gap that tool can fill,
not to waste your time and to enable you to be as
educated as possible before employing open‑source tools
as part of your enterprise defense.