Instructor: In this lesson,
we will learn about detection and threat-hunting enablers.
Detection and threat-hunting enablers are the tools
and infrastructure that facilitate the discovery
and investigation of threats within a network.
Detection and threat-hunting enabler concepts
include sensor placement, continuous monitoring,
alerting, and centralized logging.
Sensor placement involves strategically positioning
monitoring devices across the network
to capture critical data.
Continuous monitoring ensures
that all network activities are consistently tracked
for any signs of malicious behavior.
Next, alerting is used to trigger notifications
based on predefined criteria.
And finally, centralized logging aggregates logs
from various sources into a single platform
for easier and more efficient analysis.
Let's learn more about sensor placement,
continuous monitoring, alerting, and centralized logging.
First, we have sensor placement.
Sensor placement refers to the strategic deployment
of monitoring devices, such as intrusion detection systems
or intrusion prevention systems.
These sensors act as digital eyes,
continuously collecting data
from various segments of the network,
such as endpoints, firewalls, and data centers,
and analyzing them for malicious activity.
By positioning these sensors at key locations,
such as on the network perimeter
or within internal segments, security teams can ensure
that no suspicious traffic or activity goes unnoticed.
The importance of sensor placement lies in its ability
to provide visibility into different network layers,
allowing for faster detection of potential threats.
Without properly placed sensors,
attackers can slip through undetected,
leading to security breaches.
In an enterprise environment,
tools like Zeek, which was formerly named Bro,
can be placed at critical network junctions
to monitor traffic.
For instance, a sensor might be installed
between the corporate network and the internet
to monitor inbound and outbound traffic.
Similarly, internal network segments, like server zones,
may have sensors that capture east-west traffic,
which is communication between devices inside the network.
You might think about this
like setting up surveillance cameras
at entry points along hallways in a building,
where each camera, which is a sensor,
is capturing valuable data from different perspectives.
In all cases, the effectiveness of monitoring
relies on strategically placing sensors
to capture critical traffic flows,
giving security teams the ability
to detect suspicious patterns early.
Second, we have continuous monitoring.
Continuous monitoring is the practice
of maintaining a constant watch over the network,
systems, and endpoints
to detect abnormal activities in real-time.
Instead of relying on periodic reviews,
continuous monitoring ensures that any unauthorized access
or changes to the environment are flagged instantly.
This is important for threat-hunting
because cyber threats evolve quickly,
and real-time insight allows for immediate investigation
and response, limiting potential damage.
Continuous monitoring also provides the capability
to spot deviations from normal behavior,
which could indicate the early stages of an attack.
In an enterprise environment,
continuous monitoring may be implemented
using tools like Splunk
or security information and event management
or SIEM systems.
These platforms gather data from various sources
such as firewalls, antivirus software,
and network traffic logs,
and they apply rules to detect suspicious behavior.
For example, continuous monitoring may detect a sudden surge
in outbound traffic from an internal database server,
potentially indicating data exfiltration.
In a physical security example, in a security control room
where guards are constantly watching surveillance feeds,
continuous monitoring allows the security team to spot
and react to threats immediately as they happen.
Third, we have alerting.
Alerting involves setting up predefined rules or thresholds
that trigger notifications
when suspicious events are detected.
For instance, when something out of the ordinary happens,
like multiple failed login attempts,
unusual outbound traffic,
or access to sensitive files from an unusual location,
the system sends an alert to the security team.
Alerting allows the team to prioritize incidents
and investigate them before a threat escalates.
So, without timely alerts,
suspicious activities might go unnoticed
until significant damage has been done.
In the real world, tools like Splunk
or Palo Alto Networks can be configured to generate alerts
when certain conditions are met.
For example, an alert might be set to trigger
if there are multiple failed login attempts
within a short timeframe,
indicating a potential brute force attack.
In a physical implementation,
this is similar to a fire alarm in a building.
It won't put out the fire,
but it will sound the alarm when smoke is detected,
giving people time to react before the fire spreads.
In the same way,
alerting gives security teams the heads up they need
to investigate and respond to potential threats
before they cause significant harm.
Fourth and last, we have centralized logging.
Centralized logging refers to the aggregation of log data
from various network devices, servers,
applications, and security tools in one location.
This consolidated log data then allows for easier
and more efficient analysis
as it provides a complete view of the network's activity.
Centralized logging enables threat detection and hunting
because it helps identify patterns and correlations
across different parts of the network.
So, by having all logs in one place,
security teams can more easily spot anomalies
that might indicate an attack in progress
or an ongoing compromise.
An example of centralized logging in an enterprise
could involve a SIEM tool like ELK Stack,
which stands for Elastic Search,
Log Stash in Kibana, where logs from firewalls,
intrusion detection systems,
intrusion prevention systems, web servers,
and endpoint protection systems are all funneled
into a central location and platform.
In a physical example, this is like having a central hub
for security camera footage
across an entire building or campus.
So, rather than having to check
each camera's individual feed,
the footage can be pulled to one location.
In the same way, the enterprise network security team
has a unified place to perform threat-hunting activities,
searching through logs for evidence of suspicious patterns,
like repeated access attempts to restricted files
across different systems.
So, centralized logging makes threat detection faster
and more effective by simplifying the process
of analyzing diverse logs in a unified way.
So, remember, detection and threat-hunting enablers
provide the necessary tools and infrastructure to identify
and investigate potential threats within a network.
These include sensor placement, continuous monitoring,
alerting, and centralized logging.
Sensor placement involves strategically positioning devices
to capture critical network data for analysis.
Next, continuous monitoring keeps a constant watch
over network activities,
detecting suspicious behavior in real-time.
Then, alerting uses predefined criteria
to notify security teams when unusual activities occur,
allowing for quick responses.
And finally, centralized logging consolidates data
from various sources into one location,
making it easier for security teams to analyze
and detect potential threats.