Instructor: SOAR! 2 2
Now, when I talk about SOAR, 3 3
I'm not talking about soaring like a bird. 4 4
No, SOAR is an acronym, and it stands 5 5
for the Security Orchestration Automation and Response, 6 6
also known as SOAR. 7 7
This is a class of security tools 8 8
that helps facilitate incident response, 9 9
threat hunting and security configurations 10 10
by orchestrating and automating runbooks 11 11
and delivering data enrichment. 12 12
Basically, think about this as a SIEM version 2.0. 13 13
Now, when you're dealing with SOAR, 14 14
SOAR is primarily used for incident response, 15 15
but there is a large part of it 16 16
that's used for threat hunting as well. 17 17
But really the number one place you're going to see SOAR used 18 18
is incident response because it can automate 19 19
so many of your actions. 20 20
Now, as I said, I like to think about this as SIEM 2.0. 21 21
Essentially, it's a next-generation SIEM. 22 22
This takes a security information 23 23
and event monitoring system and integrates it in with SOAR. 24 24
And when you put those two together, 25 25
this really does become your next-generation SIEM. 26 26
Just like when you deal with next-generation firewalls, 27 27
they took you from dealing with layer three and layer four 28 28
and brought you all the way up to layer seven. 29 29
It made it just so much better and so much more capable. 30 30
Same thing here, when you integrate a SOAR in with a SIEM, 31 31
you get this really awesome product. 32 32
It's going to give you the ability to scan security 33 33
and threat data to be able to identify different things. 34 34
You can then analyze it using machine learning, 35 35
and then you can also automate the process 36 36
of doing data enrichment to make that data 37 37
inside that SIEM even more powerful 38 38
for you as an analyst to use. 39 39
And, finally, you can do incident response. 40 40
So you can provision new resources. 41 41
That means you can create new accounts. 42 42
You can create new VMs. 43 43
If you're using VDI, you can actually delete 44 44
somebody's infected box and then create 45 45
a new virtual machine for them to use. 46 46
And all this can be done using automated playbooks 47 47
if you use the SOAR capability. 48 48
Now, when we talk about this, 49 49
I just mentioned the word playbook. 50 50
What exactly is that? 51 51
Well, a playbook is essentially a checklist 52 52
of actions that you're going to perform 53 53
to detect and respond to a specific type of incident. 54 54
So if you said, "Hey, if I have an alert that says 55 55
there is a phishing campaign 56 56
and somebody clicked a link on this machine," 57 57
we're going to do steps one through 10. 58 58
And then we're going to re-image their machine, 59 59
and we're going to give them a new computer. 60 60
That might be your steps. 61 61
So, for example, if you have somebody who clicked 62 62
on a link in this phishing campaign, 63 63
you might have steps one through five which says, 64 64
"Go to the machine. Isolate it from the network. 65 65
Do a virus scan to make sure they haven't infected themself. 66 66
Check the registry to make sure there's nothing in there 67 67
for persistency, and then back up all the user data, 68 68
reformat the computer, and then reinstall the computer 69 69
and put their data back on." 70 70
These might be the actions you're going to do. 71 71
Now, these could be manual or automated, 72 72
but in the case of a playbook, 73 73
usually you're talking about just the steps involved. 74 74
Now, if I can automate a lot of that, 75 75
that becomes a runbook. 76 76
Now a runbook is an automated version of a playbook, 77 77
and it leaves clearly defined interaction points 78 78
for human analysis. 79 79
For example, my SOAR might say, 80 80
"If somebody clicks a link in a phishing email, 81 81
do these steps, one through five. 82 82
When you get to step two, pause, send it to an analyst, 83 83
who will then say, re-image the machine 84 84
or don't re-image the machine." 85 85
These are the ways that we can use these things, 86 86
and they all work together to create a better environment 87 87
and to help reduce the workload of our analysts, 88 88
because again, we only have 89 89
so many cybersecurity professionals, 90 90
and if we're having them waste their time 91 91
on very minor things that we can automate, 92 92
that's not very helpful to us. 93 93
So, instead, we want to automate what we can 94 94
and SOAR allows us to do a lot of that automation.