[Music]
all right good morning I'm Christine
kapka I'm a cortex systems engineer
within Palo Alto networks and today
we're going to talk about automation so
how can we take busy work out of your
day and introduce more security
so some of the challenges that we hear
um you know it takes up a lot of time to
communicate with my end users I'm when I
need to respond to incidents I'm going
between multiple different interfaces
and different consoles I'm doing a lot
of repetitive tasks how can I get time
back be more efficient in our day and
allow my team to do the tasks that they
want to
do this is where exor can come in now
while automation is not the not the end
all be all it can really help with with
um remediating a lot of those tasks that
are repetitive um so some of the things
that we can do in exor and that we'll
touch on today include reducing the
number of alerts you have to touch we'll
do this with automated
response including indicator um
enrichment we'll capture all of the
actions taken on an incident so that's
going to be that case management
component within exor so as we're um
doing an indicator lookup as we're
reaching out to an end user we'll
capture all of that information and take
care of that documentation you've got
that in one
spot we're tackling all of those
repetitive tasks so extracting all of
that data out of that fishing email
putting it into one spot doing the
lookups Gathering is something malicious
or benign we'll put that all within
exor another great one um is dealing
with simple service requests uh so I had
a a customer that said you know it is
very time consuming during our server
build process when the server team
reaches out to me asks for me to kick
off a vulnerability man management scan
um we've gone ahead and automated that
for them that's a very simple task that
just takes time out of their day and
introduces that task switching which
breaks up their workflow on other items
and then finally notifying end users so
if we get a fishing email and you want
to know let them know you're looking
into it if you want to gather more
information from them we can automate
all of that Within exor by sending that
email so let's get into some some
scenarios uh first and foremost we're
going to dive into indicator ioc
enrichment this is a great one to start
with with any alerts that you bring in
especially if you start with you know
case management as your first use case
so ingesting alerts from the different
tools that you have and beginning that
workflow
process most alerts require uh some sort
of ioc enrichment so we can start to
automate this it's timec consuming it
involves a lot of clicks a lot of window
switching we can automate that bring
that data into that case that we've
created when that alert comes in and
includes those
verdicts this is an example of what that
workflow looks like so we when we start
to think about automating different
alerts and those workflows within exor
we want to break that that process down
and think about those individual steps
anything into exor is going to be
triggered by you know an alert or an
email for example so down there on the
bottom left you see those different
alert sources so it could be an email it
could be an alert from your EDR tool for
example
comes into exor and we're going to
assign a Playbook to that in this case
this Playbook is going to have a step
then to extract indicators so it's going
to extract the IPS URLs domains hashes
Etc from there we'll have a step to
enrich those indicators so you know we
could be looking up um URLs against a a
rep um a threat a URL reputation tool IP
address against DNS or who is for
example we'll pull all that information
in documents it and then within XR we
can look and see are any of these
malicious here we've got a conditional
task so if they are malicious we're
going to follow that work stream up do
we need to update different watch lists
do we need to update in uh a block list
on our firewall for example do we need
to um you know do further investigation
we can do that if nothing's malicious we
can go ahead and close that Playbook and
move on to the next alert so when we
think about automating different alerts
and workflows we can break it down into
these three big steps of extract enrich
and update when we look at ioc
enrichment I do have a a short video
here um so what we're looking at here is
an uh entity enrichment Playbook So
within exor we've got pre-built content
here's an example of an entity
enrichment Playbook so you can use this
Playbook within other
playbooks so we've got file enrichment
IP
enrichment uh email address enrichment
and then within each of these we've got
additional playbooks um so when we open
up the IP enrichment uh Playbook we've
got two more sub playbooks we've got one
looking for at internal IP addresses and
one looking at external so this is going
to look and see are their IP addresses
if they are we'll continue down and
determine if the IP address is internal
or external if it's internal let's go
ahead and resolve that IP
address and then at the end we even have
a step if we want to then you know once
we resolve that IP address if we Det
it's an endpoint let's do some endpoint
enrichment so the Playbook is following
those steps that you're logically doing
as part of your process and we're
automating those um those steps that
decision and Gathering that information
into exor this Playbook is looking at
external IP addresses a similar workflow
but then you'll notice as we get down
towards the end of that Playbook we are
then looking up that external IP address
against different threat feeds and
Integrations that we have set up
including virus
total so these playbooks you know they
can be involved in other playbooks as
well um so this is looking at entity
enrichment so let's look at fishing
incident response now the reason we you
know bring up fishing it continues to be
a great a great alert to go ahead and
automate their response to you know
everyone is familiar with um with
fishing incidents um they seem to be a
challenge in most organizations um and
they continue to get more
sophisticated there's a high volume of
fish attacks and alerts that teams have
to respond to um it follows a repetitive
process and there's a lot of manual
steps and tools
involved so once again let's look at
that workflow uh for a fishing email so
we're going to have that email or an
alert come into to exor that's going to
trigger our fishing Playbook so maybe
our first step uh within this fishing
Playbook we can automatically send an
email back to that end user let them
know we receive that email and that
we're we're investing instigating it
next we'll go ahead and extract and
check those indicators so we can extract
the uh the address the URLs the IPS the
subject document all of that within exor
we can detonate any attachments and pull
in that verdict from there we'll once
again go ahead and check if any of these
indicators are malicious if they are we
might want to go and for example P
search other inboxes for this email pull
it out we might want to block these
malicious
indicators if nothing's malicious we can
go ahead and close the playbook in
either case we can also follow up with
an email to that end
user here's an example that we have of a
a fishing Playbook within our our demo
environment uh so those oblong oval
headers indicate the different section
headers um so from there we'll go ahead
and we triggered the Playbook from that
fishing alert we'll move on to that
triage and engage so we're going to
store the sending account information
we're going to process the email we can
even look up that user and get their
active directory information we can
rasterize that email so put an image of
that email within the case as the
analyst goes back to look at it after we
extract those indicators we'll go ahead
and check those indicators um for um you
know looking them up against different
uh threaten T feeds seeing if they're
malicious they are so in this case we're
going to continue down the right side of
this Playbook and we'll move into our
response phase so we found a malicious
indicators within this email we're going
to go ahead and search for that email
against other users inboxes within the
environment if there's an attachment
we'll extract that we can detonate that
file we'll go ahead and change the
severity of this alert to critical and
we can even automate the hunting of
these ioc's against other
tools over here on the investigation tab
we're looking at everything that exor
extracted automatically from this
fishing email to present to the analyst
so the analyst can see all of the
information that you would manually have
to to extract look up and document
you've got this all in one spot so for
this example of a Playbook we've
included a manual step for the you uh
the analyst to come in and confirm
whether or not it is
fishing instead of spending 30 to 40
minutes uh working through the
documentation looking up these different
indicators determining if something's
malicious or not we've automated that
process with an exor and we have the uh
analyst be able to come in and select
confirmed
fishing the reason I wanted to focus on
both fishing and the indicator
enrichment to start is you know a lot of
times we're having automation
conversations with different clients
they immediately go to you're going to
lock my CEO out on Friday afternoon does
not no we're not going to lock your CEO
out of their laptop on a Friday
afternoon we can do a lot with
automation to help you as you respond to
alerts and take a lot of those uh
remedial tasks off your
plate uh so here's an example from one
of our customers it's a financial
services customer they were receiving
about 730 fishing alerts per week with
exor we were able to autoc close 430
either because they were duplicates or
spam and by utilizing exor just to
respond to fishing alerts they were able
to save four analyst days per
month final final use case we'll go over
today is our malware investigation and
response so our uh our product
management team
as you know part of gathering feedback
from customers they went and looked and
said what are some of the common use
cases that our customers are utilizing
exor for and how can we help them get
better with that one of those was with
malware investigation and response we
found a lot of a lot of customers wanted
to automate that Mal uh malware response
partly because of the increasing number
of attacks limited visibility as you
have to search and utilize multiple
tools because we've got those silid
alerts so so our product team said how
can we help them and we did that by
introducing a malor investigation and
response pack so
streamlining the deployment of the
playbooks as well as already building in
a lot of the different uh investigation
and validation steps so for malware
investigation we're going to ingest that
alert from an EDR tool for example and
then we're going to automate that
investigation phase so once again
enriching those different ioc's
analyzing the data that we pull back and
even querying for additional
information from there we can validate
or confirm what we found and then in the
response we can work through the
containment we can isolate that endpoint
for example and then work through the
remediation this is one of my favorite
packs because we've built a lot in there
including different response actions um
if you want to go ahead and automate the
isolation or as you're working through
the Playbook um if the analyst chooses
that they need to isolate that end point
you once again don't have to go into
that separate interface that separate
tool to work through the
investigation a lot of the investigation
that we've done as well is based on
pulling back that information that you
need mapped back to the miter attack
framework this works right now with
paloalto Network's xdr tool it works
with crowdstrike and Microsoft as
well so thanks for joining us today for
an overview of automation uh from exor
uh some great resources we've got a
virtual tour of the paloalto sack so at
Palo Alto networks within our own sack
we utilize exor and you can see our our
metrics that we're uh we've worked hard
to achieve but you know over 90 days um
we take down um 100 or 1.5 trillion
events and Whittle that down to 800
manual investigations over the course of
90 days uh we do have um folks
throughout the the world in our sock but
in the US we've got about um nine folks
folks that work uh 8 to 5 we work a
regular Work Week um so you can find
that uh virtual tour of our paloalto Sak
on our website uh you can also stop by
our booth we'd love to share more
information about that and then for
those that want to learn more and get
more hands-on experience we've got
Hands-On workshops from there we can get
Hands-On within a lab environment uh
walk you through a fishing response a
malware investigation response and you
can get more familiarity with that any
questions
I believe so
that's two or years ago I think
number
10
yeah we yeah we would we were drown I
don't know how how we would keep up if
we didn't have the the automation to
help respond to the large number of
events and I'm sure you can all imagine
being a a large security company we are
a large Target um and just with our our
own internal uh employee count we've got
a lot of employees so we are we are a
big
Target well thanks for coming we would
love to to chat more you can find us uh
downstairs in our
booth
[Music]