A carregar...
Publicação
Orquestração e automação da resposta a incidentes de segurança detetados pela plataforma XDR/EDR da Altice Portugal
| Nome: | Descrição: | Tamanho: | Formato: | |
|---|---|---|---|---|
| 2.31 MB | Adobe PDF |
Autores
Orientador(es)
Resumo(s)
A gestão eficiente de incidentes de segurança é vital para a robustez dos sistemas de segurança
e, neste contexto, a plataforma Cortex XSOAR (Extended Security Orchestration, Automation and
Response) desempenha um papel crucial.
O trabalho de projeto subjacente a esta tese teve como objetivo explorar as deteções identificadas pela plataforma CrowdStrike Falcon XDR (Extended Detection and Response), publicadas
no XSOAR. Para tal, desenvolveu-se um playbook no XSOAR, com o intuito de maximizar o
uso da automação na gestão dos incidentes. A capacidade do XSOAR de orquestrar e automatizar respostas a incidentes e destacada pela sua integração com diversas ferramentas, playbooks
personalizáveis e automação de processos, fornecendo aos analistas do SOC ( Security Operation
Center) da Altice Portugal uma ferramenta poderosa para lidar com ameaças complexas. O foco
deste projeto esta na eficácia da reação a incidentes críticos, salientando a importância de uma
integração eficiente, utilizando API ( Application Programming Interface). Através da realização
de múltiplas chamadas API ao Falcon XDR, os analistas podem obter uma visão abrangente das
propriedades dos endpoints.
A utilização do XSOAR permite enriquecer o contexto dos incidentes. Com base na sua
integração com outras ferramentas, é possível classificar devidamente o tipo de incidente e automatizar processos, melhorando não só a eficiência como também reduzindo significativamente
o tempo de resposta a incidentes de segurança. Desta forma, assegura-se que potenciais ameaças
sejam identificadas e neutralizadas de forma eficaz.
The efficient management of security incidents is vital for the robustness of security systems and, in this context, the Cortex XSOAR (Extended Security Orchestration, Automation and Response) platform plays a crucial role. The project work underlying this thesis aimed to explore the detections identified by the CrowdStrike Falcon XDR (Extended Detection and Response) platform, published on XSOAR. To this end, a playbook was developed in XSOAR in order to maximize the use of automation in incident management. XSOAR’s ability to orchestrate and automate incident responses is highlighted by its integration with various tools, customizable playbooks and process automation, providing Altice Portugal’s SOC (Security Operation Center) analysts with a powerful tool for dealing with complex threats. The focus of this project is on the effectiveness of critical incident response, highlighting the importance of efficient integration using API (Application Programming Interface). By making multiple API calls to Falcon XDR, analysts can obtain a comprehensive view of the properties of endpoints. The use of XSOAR makes it possible to enrich the context of incidents. Based on its integration with other tools, it is possible to properly classify the type of incident and automate processes, not only improving efficiency but also significantly reducing the response time to security incidents. This ensures that potential threats are identified and neutralized effectively
The efficient management of security incidents is vital for the robustness of security systems and, in this context, the Cortex XSOAR (Extended Security Orchestration, Automation and Response) platform plays a crucial role. The project work underlying this thesis aimed to explore the detections identified by the CrowdStrike Falcon XDR (Extended Detection and Response) platform, published on XSOAR. To this end, a playbook was developed in XSOAR in order to maximize the use of automation in incident management. XSOAR’s ability to orchestrate and automate incident responses is highlighted by its integration with various tools, customizable playbooks and process automation, providing Altice Portugal’s SOC (Security Operation Center) analysts with a powerful tool for dealing with complex threats. The focus of this project is on the effectiveness of critical incident response, highlighting the importance of efficient integration using API (Application Programming Interface). By making multiple API calls to Falcon XDR, analysts can obtain a comprehensive view of the properties of endpoints. The use of XSOAR makes it possible to enrich the context of incidents. Based on its integration with other tools, it is possible to properly classify the type of incident and automate processes, not only improving efficiency but also significantly reducing the response time to security incidents. This ensures that potential threats are identified and neutralized effectively
Descrição
Trabalho de projeto de mestrado, Informática , 2024, Universidade de Lisboa, Faculdade de Ciências
Palavras-chave
Falcon XDR Cortex XSOAR Deteção Incidente Playbook Trabalhos de projeto de mestrado - 2024