So we just learned about what it's like to be a
sock analyst in the day of the life of today.
We're going to actually go into the specific tools in a seam and some
of the different tools that you might see in a security operations center,
Richard, take it away.
What are we gonna see?
We're gonna see a few different tools that
you will definitely see in a security operations center.
Um Again, as I mentioned, when we talked before,
every sock is going to be slightly different,
but there are some staples that you
generally will see across most sock environments.
So
we're gonna take a look at some of those today.
All right. So you should now see on your screen, our sock landing page.
Um
The sock landing page is really kind of a directory
of the different tools that we have in our environment.
And I'm not going to go through every single tool that we have.
We don't have that kind of time.
I don't want to bore you to death completely,
but I do want to highlight some of the tools that we use in our environment
and some of the first tools that I think are very important are what we,
what are known as STM tools.
They're security event managers.
Basically,
what they're doing is they're creating alerts or detections for us to look at.
And what they do is they actually give us one single location that an
analyst can view and monitor the alerts that are happening in the environment.
And you're gonna see many different types of alerts here.
You're gonna see alerts from your email security tool.
You're gonna see alerts from your endpoint detection response tools.
You're gonna see network uh alerts that are demonstrating different
attacks that are being carried out on your environment.
The the end of the day,
this is kind of a single pane of glass that an analyst can investigate on
and basically just work through one at a time.
And we teach two different seam tools, IBM Qradar and Splunk enterprise security.
Both of these are top tier enterprise grade security event managers and you
will absolutely see these on job descriptions out there in the world.
So these are, as a matter of fact,
these are two of the top three tools in the industry right now.
Email security.
I would say 75% of most successful attacks are successful because
of a phishing email that comes into an environment and somebody
clicking on a link or downloading a file from an email
that they should not necessarily be clicking on or downloading.
So being able to understand what happens with an email and knowing how to
investigate it is a very important component
of being a security operations center analyst.
And proofpoint is by far one of the number one email security tools.
So we teach our analysts how to investigate that
they go through,
they understand who the email came from or who it's pretending to come
from what the email was attempting to do what the thread is.
And then if there's any steps that need to be taken,
then they can make those recommendations to our security teams,
whether it's blocking URL S or blocking email senders or maybe even removing an
email from an inbox because it did get successfully delivered to a user.
And we want to avoid them clicking on that link if we can.
So very important component of being a security operations center analyst.
Now endpoints every single computer that we have in
our environment is pretty much known as an endpoint,
our laptops or desktops, the servers,
those devices have what's known as an agent on them.
And the agent in essence is watching what that computers doing.
Websites is going to
files that it's downloading
processes that are running on that computer.
And like the same tool,
there's a rule set and those rule sets are
looking for different activities that break those rules.
And when those happen, what
we will do is generate a detection.
It says, hey,
this user on this machine downloaded this file
and we've identified this file as malicious.
We have killed and quarantine that file.
However,
you probably need to investigate it and find out why were they getting that file?
Where did it come from? How did that file come to land on that device?
And depending on what kind of device it's on,
that's really going to determine what needs to be done at that point.
Is it a critical device like a server or is it just an endpoint
maybe a laptop from somebody in the hr department? Right.
But all of that comes together and as you're investigating these,
you get to better understand exactly how
and why those different activities occurred.
Now we teach crowdstrike as well as Sentinel one, both of them top tier tools.
As a matter of, matter of fact,
both of these are in the top three in the
Gartner magic quadrant as well too for EDR tools.
So they're very high end. And again, you'll see these in a sock uh
all over the globe.
Now we talked earlier
in the previous episode about documenting and ticketing, right?
So we teach two different t
ticketing tools in our environment.
The first one is being able to actually write a ticket, explaining the incident,
explaining the security event with the who the what the, when the, where the why
um
that's very important to paint the picture as to what happened.
And this is kind of kind of goes along with being able
to provide the most amount of details so that your higher,
higher levels up your your SOC manager,
your co can make appropriate decisions on
improving the security of the environment.
Being able to write that ticket is a skill and it takes practice.
So our analysts are writing those tickets when they're doing investigations.
So that gives them that skill as well too.
Another ticketing aspect is being able to communicate with other departments,
interdepartmental communications,
specifically action items like resetting passwords,
blocking URL S adding an IP to the watch list so that we
can make sure that if any activity comes from that external IP address,
we can monitor that activity and make sure that nothing
is allowed to enter our environment from that IP address,
even even corrections or fixes to rules,
we can communicate with the engineering team, right?
So there's a lot of different things that we can do
in JIRA ticketing which allows us to communicate with those other departments,
the help desk networking team, the vulnerability team,
um engineering so that they can take those items and fix them, adjust them,
modify them,
do whatever we need to need to do to ensure our environment is as secure as possible.
Another component is being able to understand exactly what is in your environment.
So um attack surface management, what devices are connected to our network?
Is it a laptop? Is it a desktop? Is it a switch? Is it a car.
If you see on the screen,
there's actually a car that's been connected to our network.
Um, that car was actually connected to our guest network.
And if I've actually investigated, if you investigate it, it's a Tesla Model three.
If you've done investigations and you know about vulnerabilities, you know,
that Tesla Model three is actually have a vulnerability that can be exploited.
Now, it's pretty rare, but
this would be a decision that maybe somebody in your higher ups might wanna make.
Do we want to allow this device to connect to our network?
Should that be something that we take some sort of action against,
to eliminate a possible exploit, being able to be utilized in our environment
and
most corporations have some sort of public facing web presence,
websites and so forth.
So being able to do web scans to ensure that there's
no exploits that can be carried out on those websites,
databases, um
cross-site scripting SQL injections, things of that nature,
different types of attacks like that.
So
our analysts get the opportunity to not only we carry out those activities
on test sites but also our own websites as well to be able
to help learn how to do that and also monitor our our environment
and make sure that they understand exactly what can happen and what to do
in those circumstances.
Well,
thank you Richard for taking the time to spend with us today and to go over
some of the tools that we can expect to see in a security operations center.
Uh Any last thoughts before we let you go for the day,
I would say that
getting into cybersecurity or working in
cybersecurity is an amazing opportunity.
I absolutely love it.
Um It's a lot of fun. It's kind of like being a cyber cop.
I guess that's kind of an easy way to say it.
So if you're studying for
a
plus, I'm assuming you're,
you're building your knowledge and experience in cyber and, uh,
keep, keep focusing, keep working hard, get as much practice as you possibly can
and continue to push forward.
All right. Well, thank you very much for your time and we will see you next time.