So we just learned about what it's like to be a SOC analyst in the daily life of.
Today we're going to actually go into the specific tools in ACM and some of the different tools that
you might see in a security operations center.
Richard.
Take it away.
What are we going to see?
We're going to see a few different tools that you will definitely see in a security operation center.
Um, again, as I mentioned when we talked before, every SOC is going to be slightly different, but
there are some staples that you generally will see across most SoC environments.
So we're going to take a look at some of those today.
All right.
So you should now see on your screen our SOC landing page.
Um, the SoC landing page is really kind of a directory of the different tools that we have in our environment.
And I'm not going to go through every single tool that we have.
We don't have that kind of time.
I don't want to bore you to death completely, but I do want to highlight some of the tools that we
use in our environment.
And some of the first tools that I think are very important are what we what are known as steam tools
are security event managers.
Basically, what they're doing is they're creating alerts or detections for us to look at.
And what they do is they actually give us one single location that an analyst can view and monitor the
alerts that are happening in the environment, and you're going to see many different types of alerts
here.
You're going to see alerts from your email security tool.
You're going to see alerts from your endpoint detection response tools.
You're going to see network, uh, alerts that are demonstrating different attacks that are being carried
out on your environment.
The the end of the day, this is kind of a single pane of glass that an analyst can investigate on and
basically just work through one at a time.
And we teach two different Siem tools, IBM Qradar and Splunk Enterprise Security.
Both of these are top tier enterprise grade security event managers.
And you will absolutely see these on job descriptions out there in the world.
So these are as a matter of fact, these are two of the top three tools in the industry right now.
Email security I would say 75% of most successful attacks are successful because of a phishing email
that comes into an environment and somebody's clicking on a link or downloading a file from an email
that they should not necessarily be clicking on or downloading.
So being able to understand what happens with an email and knowing how to investigate it is a very important
component of being a security operations center analyst.
And Proofpoint is by far one of the number one email security tools.
So we teach our analysts how to investigate that.
They go through.
They understand who the email came from or who it's pretending to come from, what the email was attempting
to do, what the threat is, and then if there's any steps that need to be taken, then they can make
those recommendations to our security teams, whether it's blocking URLs or blocking email senders or
maybe even removing an email from an inbox because it did get successfully delivered to a user, and
we want to avoid them clicking on that link.
If we can.
So very important component of being a security Operations Center analyst now endpoints every single
computer that we have in our environment is pretty much known as an endpoint.
Our laptops or desktops, the servers those devices have what's known as an agent on them.
And the agent, in essence, is watching what that computer is doing, websites.
It's going to files that it's downloading, processes that are running on that computer.
And like the Siem tool, there's a rule set.
And those rule sets are looking for different activities that break those rules.
And when those happen, what it will do is generate a detection.
It says, hey, this user on this machine downloaded this file and we've identified this file as malicious.
We have killed and quarantined that file.
However, you probably need to investigate it and find out why were they getting that file?
Where did it come from?
How did that file come to land on that device?
And depending on what kind of device it's on, that's really going to determine what needs to be done
at that point.
Is it a critical device like a server, or is it just an endpoint of maybe a laptop from somebody in
the HR department?
Right.
But all of that comes together and as you're investigating these, you get to better understand exactly
how and why those different activities occurred.
Now we teach CrowdStrike as well as Sentinel one, both of them top tier tools.
As a matter of fact, both of these are in the top three in the Gartner Magic Quadrant as well too,
for EDR tools.
So they're very high end.
And again, you'll see these in SOC, uh, all over the globe.
Now we talked earlier in the previous episode about documenting and ticketing.
Right.
So we teach two different ticketing tools in our environment.
The first one is being able to actually write a ticket explaining the incident, explaining the security
event with the who, the what, the when, the where, the why.
Um, that's very important to paint the picture as to what happened.
And this is kind of, kind of goes along with being able to provide the most amount of details so that
your higher, higher levels up your your SOC manager, your CISO, can make appropriate decisions on
improving the security of the environment Um, being able to write that ticket is a skill and it takes
practice.
So our analysts are writing those tickets when they're doing investigations, so that gives them that
skill as well to another ticketing aspect is being able to communicate with other departments interdepartmental
communications, specifically action items like resetting passwords, blocking URLs, adding an IP to
the watch list so that we can make sure that if any activity comes from that external IP address, we
can monitor that activity and make sure that nothing is allowed to enter our environment from that IP
address.
Um, even even corrections or fixes to rules.
We can communicate with the engineering team.
Right.
So there's a lot of different things that we can do in JIRA ticketing, which allows us to communicate
with those other departments, the help desk networking team, the vulnerability team, um, engineering
so that they can take those items and fix them, adjust them, modify them, do whatever we need to
do to ensure our environment is as secure as possible.
Another component is being able to understand exactly what is in your environment.
So, um, attack surface management.
What devices are connected to our network?
Is it a laptop?
Is it a desktop?
Is it a switch?
Is it a car?
If you see on this screen there's actually a car that's been connected to our network.
That car was actually connected to our guest network.
And if I've actually investigated if you investigate it, it's a Tesla model three.
If you've done investigations and you know about vulnerabilities, you know that Tesla model three is
actually have a vulnerability that can be exploited.
Now it's pretty rare, but this would be a decision that maybe somebody in your higher ups might want
to make.
Do we want to allow this device to connect to our network?
Should that be something that we take some sort of action against to eliminate a possible exploit?
Being able to be utilized in our environment.
And most corporations have some sort of public facing web presence websites and so forth.
So being able to do web scans to ensure that there's no exploits that can be carried out on those websites,
databases, um, Cross-site scripting.
SQL injections.
Things of that nature.
Different types of attacks like that.
So our analysts get the opportunity to not only carry out those activities on test sites, but also
our own websites as well, to be able to help learn how to do that and also monitor our environment
and make sure that they understand exactly what can happen and what to do in those circumstances.
Well, thank you, Richard, for taking the time to spend with us today and to go over some of the tools
that we can expect to see in a security operations center.
Any last thoughts before we let you go for the day?
I would say that getting into cyber security or working in cyber security is an amazing opportunity.
I absolutely love it.
Um, it's a lot of fun.
It's kind of like being a cyber cop.
I guess that's kind of an easy way to say it.
So if you're studying for Cisa plus, I'm assuming you're you're building your knowledge and experience
in cyber and, uh, keep keep focusing, keep working hard.
Get as much practice as you possibly can and continue to push forward.
All right.
Well, thank you very much for your time.
And we will see you next time.