[Music]
so good afternoon thanks for coming I
appreciate your time um got a little bit
of slides I I actually have a demo that
I'll pull up here in a little bit um
just to let you know a little bit about
secure Works a peer of mine is here in
the back we happy to take any questions
afterward or downstairs back at the
booth we'll be here for a while um
little bit about secure Works
secureworks has been doing security
monitoring for about 20 years now right
it was um about four years ago we
actually oh sorry I can step a little
bit closer as
well um about four or five years ago we
came out with a new software program
it's Cloud native software to do the
security monitoring it's very much
um Sim like that's Sim like um but it
resides in the AWS Cloud where we send a
lot of telemetry into it um taking
advantage of a lot of different things
we've got a large counter threat unit
that does a lot of uh research so we
provide our thread Intel our own thread
Intel you don't have to necessarily
bring it into the tool um that thread
Intel is there and helps the tool work
to find thread actors working find that
needle in a Hy stack as well as it's in
a publisher format so you can read
through it you know like to use an
example of Sunburst which was one of the
ones that came out for the exchange hack
a couple of years ago it's a little bit
old but anybody who really wants to geek
out and understand what the threat
actors were doing with sunburst all the
detail that you could want is in there U
if you have trouble sleeping and you
just want something to read you could
read that too um marketing slide
definitely being recognized for what the
tool is capability of it's marketed as
an xdr tool you see that on the slide
there um it it absolutely has an xdr I
really like to use the term NextGen Sim
though because we're we're taking
Telemetry in from that many different
resources um analizing it and then we
have um automation capabilities built
right in so we can respond very quickly
to the threats that we're seeing and
that's really what it's all about not
only just finding the threats quickly
but then also being able to respond to
those threats um in in a meaningful way
to help an
organization so uh I'll show you we have
a lot of built-in playbooks we're
building out more playbooks all the time
for the different Integrations I'll hit
that briefly when I get to the demo
portion of it um what I have here is
just a highlevel architecture um you you
see some partner products of ours there
because from getting Telemetry into the
tool you know we're very much an open
technology the idea behind this tool is
use the tools that you have in place
today we'll bring the data from all
those different tools into this single
platform do that monitoring and then
allow you to respond to it so while we
provide an EDR that can be deployed on
any of your desktop laptop servers so if
you're not using one of our partner
tools we do provide one at no cost it
comes with the subscription to the cloud
native software but if you're using you
know crowdstrike Carbon black Microsoft
Defender Sentinel one on your endpoint
already there's no reason to deploy
another tool to your endpoints um we get
the Telemetry directly from those
partner tools through an API integration
um it gets sent into that cloud native
software the secureworks xdr cloud from
those end points that way and then you
see on the right the cloud environments
right we really believe it's critical to
get data from the cloud native providers
um in in fact last year when we were
analyzing where all of our alerts were
coming from only 40% of our alerts were
actually coming from the endpoint
anymore because so much data is coming
from the different Cloud providers that
are out there it's really important to
be looking at that 0365 the AWS aour
OCTA cyber AR right there's a a lot of
intelligence com from a lot of those
different sources being able to analyze
that in conjunction with everything else
that's going on within your environment
and again those Cloud pieces it's all an
API integration so it's directly Cloud
you go in you authorize them to send
that data to us you let them know which
domain you're coming from and that goes
directly into the the cloud native
software then the final way that we get
it's a little bit more of that Sim like
U way to get data into the the tool is
with our on-prem data collector so your
firewalls your switches your routers um
active directory servers that might be
on Prem or any other critical servers on
Prem um we have a data collector that's
listening on CIS log forwards that data
into the environment it's going to um
compress it and securely upload it in
the cloud again so it can be analyzed by
what's going on there so that's how we
get data into the tool then what do we
do with it in there right and so there's
um an example I I like to use you know
I've heard people say Tesla is not a car
company it's a tech company that happens
to make cars um sometimes when I look at
at crowd strike in Sentinel one I think
these are endpoint companies but they're
really a tech company that provides
endpoint protection I think if you think
about our tool more of a tech company
that so happens to provide a nextg Sim
type service it's a good way of looking
at it because what we're really doing
with the tech behind it is how are we
analyzing all of that log information
that we're receiving how are we bubbling
up the two threats the true threats
getting rid of the noise so that what
you're spending your time on is a real
threat that needs to be looked at and
the way we're doing that and the where
that Tech is at is in what we call our
detectors um the the first one I'll
highlight is the Hands-On keyboard one
this one actually has only been around
for about a year and a half now we
received a whole bunch of data um back
when the Cass ransomware incident
happened in July 4th about a year and a
half ago we had some of our customers
got hit by that and so we got a lot of
intelligence helped them through through
that um learned a lot from that but when
our data scientists started analyzing
the data that we had we realized that
threat actors were working on um
computers you know typing in a command
for whether it was Powershell or or from
command prompt analyzing the the data
that they received and then typing in
another command analyzing that data
typing in another command there was a
pattern that we could see and so from
that they developed this Hands-On
keyboard that again we just look at all
that data is coming in over time right
it's not like the old SIM where you get
the data in you look at it one time and
then you're done with it we actually you
know hold on to it and look at it over
time so we can analyze with other data
that's coming in so that we can begin to
see that pattern and bubble it
up another one that I like to call out
is the stolen credentials one you know
credit cards have been doing a long time
the impossible travel look well we can
apply that same type of technology and
really minimize how many times we're
looking at failed login attempts if you
talk to somebody that's B doing a lot of
security monitoring they just get tired
of looking at all the U false positives
right it looked a little bit funny some
bad loging attempts what do I do with it
well this tool is taking in you know the
ASN information the IP address
information looking for impossible
travel where did the person log in from
is it from their work computer is it
from an odd Source where do they
normally log in from what does that
pattern look like analyzing that so when
we're bubbling up and saying look we
some of these credentials are stolen
it's a much more efficacious view right
very few false positives are coming into
that and so you see some of the other
ones on here some of the more recent um
detectors that were coming out are very
specific towards aour or AWS you know
some of the new threats are you know
people getting access to a virtual
machines into your AWS environment and
then trying to exfiltrate you know
copies of entire machines or things like
that and so again analyzing all that
data looking at it in a unique way um
taking DNS information where DNS is
important taking authentication
information where authentication is
important looking at that analyzing it
running it through and then bubbling up
the event so that somebody can take a
look at it and so the way this works too
is the Tes platform is a cloud native
platform we do offer 24x7 stock
monitoring on top of that but it's not
required so if you have an organization
that that wants the software to help
their their sock do it or their smaller
organization they can't afford the 24x7
monitoring the to has capabilities to
send an alert anytime a critical uh
event happens or a high event happens we
actually have capability to
automatically isolate a host on a
critical event so if you if it sees a
critical event it'll shut off all
connectivity to the machine where that
critical event happen until somebody has
a chance to take a look at it if you
don't want it to happen automatically
that's all right we can add tags to it
we can have our sock service do it you
can do it from the panel you don't have
to Pivot to Sentinel one you don't have
to Pivot to Caron black or crowd strike
to do that host isolation you can do it
from a couple of clicks of the mouse
within this tool itself again it's how
can we respond quicker to what's going
on um adding IPS to Blacklist right
still happen still something we want to
do do that from the tool itself you need
to add an IP to a blacklist we have a
template for that right a lot of
playbooks that are out there being
created to analyze and then respond to
what's going
on um this next slide I have I don't
have tons of slides here but just to
highlight again all the different
sources that we're taking data in from
um we actually have the ability so if if
there is a specific unique tool or a
homegrown tool that you would like to
get data sent into this from we've got a
custom parer now where you can write it
out so your homegrown stuff can send the
data into the format that the Tes
platform needs to be analyzed so that we
can analyze that and again run that data
through our
detectors um here I'm going to build
this out a little bit but again it's
just talking about the options right we
we've got the software itself just take
that and and you do all the sock
services on top of it um the standard
tagis manage xdr service where our sock
team is taking advantage of that looking
at it taking action on our customers
behalf where they're authorized to and
where it's wanted um we also have the
tagis enhanced xdr so the enhanced this
tool is doing um threat hunting on a
24x7 bases but we also recognize that
you know when new threats arise while we
have a large group that's you know
building um ways to find those new
threats that takes a little bit of time
and there's information that's coming
into the tool so our if you're using our
man and services we're performing a
threat hunt in your environment on a
monthly basis we have some customers
that say hey we really like that but we
want you to be constantly doing those
threat hunts and so when you get to our
enh handed service we actually have a
threat Hunter that's assigned that's on
a regular you know weekly basis going
through that analyzing it looking for
specific information we'll coordinate
with those customers
as to you know what are we looking for
you know what what are the threat hunts
going to be at from our regular service
you know we kind of defined that when
log 4J came out the group the threat
Hunters were looking for different
threats that might be trying to take
advantage of log 4J when there's a new
threat or some new technique that we
find threat actors using that's what
those threat hunts are going to be
looking at um so just different ways
that we offer our service this next
slide there there's a lot of words on
here what it's really is what do we do
different right so some of the things
I'd like to call out is we're one of the
fewel tools out there that doesn't
require you to deploy our agent to every
one of your endpoints so if you're using
one of our partner products you don't
even have to deploy it to the endp point
because we take that data in um you can
go between our sock service or just
using the tool and back and forth so if
you have a small group or you want to I
I have a customer that used our man and
service that first year they said look
we don't need your man in service
anymore we got this we've been using the
tool we know how it works so they they
cut off the 24x7 sock monitoring service
but they still have full access to the
tool all the data that's been brought
into the tool over the last year is
still there they can analiz it and use
it but now they're taking advantage of
that the price is a little bit lower but
they're still using the software for the
monitoring side encourage customers to
do that um if you're using this tool our
sock team and our customers have the
exact same access to the data there's no
special secret sauce that our internal
sock monitoring teams that that that our
customers don't see you have full access
to all of the data um we keep 12 months
of data active within the tool it's
native and there's no additional cost
for it so data for the last 12 months is
in there it can be reported on it can be
analyzed um and we do go back it's not
just again that one time where data
comes in and we just look at it once you
know there can be multiple times where
we'll be analyzing that data over
especially over that first month with
some of the different detectors that are
out there um wide range of of of
telemetry and ways to bring it in and
then of course we do have that thread
intelligence that's coming from our kind
of threat unit so you don't have to go
out and buy another tool to get that
thread intelligence brought in and then
apply it that's built into the tool and
available right away and then finally um
the the automation capabilities is again
no additional cost build in the ability
to automate use the templates that we
have out there um my last slide I won't
leave it up very long but it's just we
cover a plethora there wide range
manufacturing is one of our big
customers right now certainly in the
education space in the financial space
so just some of those areas that we're
helping out with people today and I'm
going to Pivot now here we go came right
up on the screen this is our
dashboard um you'll see right now this
is a demo environment so there's lots of
critical and high alerts in there just
to provide some data for us and my peers
when we're providing demos um but right
here on the front page the thread
intelligence and you can search back the
tools only been out for about 4 years
but I've seen data again in here that
you can search back going back to 2014
or 2012 so it's not just the more recent
data that's in there I type the Sunburst
one in but I won't necessarily take a
full time to analyze that but the data
is in there're
unavailable
um I like going to this alerts Tab and
I'm just going to show the triage alerts
but what what we see here if I scroll
down to the detector name in this case
there's eight different detectors that
are hit you'll see the top one is the
detector watch list that's actually a
more traditional way of looking at data
where most of your Sims are at but when
you start getting into some of the the
specific data um the detectors aren't
going to hit as frequently but it's
going to almost always be a true
positive when they do hit just because
the nature of how they're looking
analyzing that data um for those of our
customers where we're providing the sock
service if I actually click on it the
investigations is going to show they'll
create an inv
investigation let me pivot actually
to when you go into the investigation
right if we're notifying you what our
sock has done is they created it where
it's got the incident summary um the
assets that were being used U the
description of what's going on all the
detail there but then if I tip over to
the evidence tab right the different
alerts that were involved any different
events now this one doesn't have a lot
of events in it um any searches that
might have been completed by our sock
Team all that data is going to be in
there and available one of the newer
features that we have is the timeline
feature where not only do we have that
data but we'll put it in a timeline
format so you can see all right great I
found all this data that was added to it
but we we can Tim stamp it and and look
at it see once how the thread actor
worked through it how they walked
through that when different pieces hit
so you can understand and really what
you're trying to defend against right
advanced search capability you know if
our sock team is doing the service you
might not use the advanced search as
much but you can go in analyze the data
um you can create your own special rules
so if your organization has some unique
data that you might have we give you the
ability to create your own rule to
analyze the data that's coming in bubble
up those alerts that you want to have
hit endpoint agents is just where we're
kind of keeping track of all the agents
um I I'll pop one of these open here
real quick and just show you how easy it
is um to isolate a machine really if
you're looking at a particular machine
you click on the actions and the isolate
host is there you'll see restore host is
is gray out because it's not available
right now but again it's literally that
easy from within the tool to start
isolating machine to actually responding
to a threat um depending upon how you
have it built out in which pieces you're
using the Integrations tab is just where
we're keeping track of all the different
Integrations the data sources this is
where anything that's going through a
data collector will show up we have a
full list of them so you can see what's
going on the custom parsers and the API
again very simple to add API
Integrations to get data from some of
these partner tools you come in here you
add an API integration um the 0365 one I
authorize it right just come in there
provide the domain name the credentials
for it and within five minutes we're
going to have data flowing from
Microsoft or some of the other providers
with into the tool so it can be
analyzed on the automations tab I really
just from a a demo perspective I like to
show the different templates that we
have out there just to show again the
bread of what we have now these are
templates so there's going to have to be
specific information from your
organization that'll be added into this
but the documentation is very clear and
precise to explain this is what data you
need to provide um a lot of ticking
systems in here so while we create the
investigation and notify you if you want
to track that on your particular uh
ticketing tool all that data can be in
there uh from a service now perspective
you know you can there it's not just a
oneway integration we can send it uh
service now and service now we can
receive information coming back um not
all the Integrations are both ways but
those are some of the features that new
features that are being added to the
tool on a regular
basis um cybera if you really wanted to
get deep and analyze it the the
downloads is where you can extract data
from the tool so if you want to look at
some of the data in your own way you can
download it there we also offer you a
copy um of the Phil filters that we run
from an IDs perspective so if you're
running Syra cotta or another type of
device and you wanted to use our filters
within your IDs platform again they're
fully available to you reporting you
come in here you can create a report
we've got canned reports that are coming
out with it and you can create other
reports so if you need an analyze
activity for all your domain admins for
the last month and somebody needs to
look at that on the first or the second
every month you can schedule a report
gives you all the data so you can very
quickly accomplish the different pieces
that are there and then finally in the
tenant settings which is where new users
are added again this is where you can
come in you can put suppression rules to
get rid of some data or you can create
your own custom rules so I'll pause
there it looks like I got about five
minutes left did anybody have any
questions or anything you might like a
little bit more information
on all right well we've got Flyers if
you want more information if you'd like
to just have have a more one-on-one talk
we can talk that downstairs you can be
happy to reach out to us in the future
we can talk a little bit more about it
but thank you for your
[Applause]
time