Cyber Threat Investigations Challenges

The world of cyber security has many technologies across the entire attack surface. There is a web of complexity to be managed. This becomes frighteningly obvious when trying to investigate threats, both historical and in real time. How do you translate event logs from a myriad of systems into a story of what happened and what is happening? How do you operate at a great scale and at the same time paint a simple picture? How do you allow the analyst to unpack and unpeel the story the logs are telling quickly and intuitively. This is amongst the greatest cyber-specific challenges facing the SOCs & CSIRTs.

Siren in Cyber Threat Hunting & Intelligence

Siren is built on Elasticsearch, a system popular in the Cyber Security world for streaming, storing, and searching system logs. Siren holds a rich set of integrated capabilities that can seamlessly integrate into any organizations’ framework.

Some of the Siren’s key capabilities include:

• Big data correlations across multiple logging data sets
• Knowledge graph visualizations with advanced usability capabilities
• Web Services connections to integrate outside data to the graph
• Dataspaces for collaboration across teams
• Integrated JIRA based ticket management
• Detailed business readable audit for investigation lookback 
• Entity resolution & Natural Language Processing (NLP)
• Dissemination reports for investigation escalation
• Advanced alerting capabilities with push notifications
• Cyber aware ontology pre-integrated with Mitre Att&ck framework
• Integrated OSINT data to correlate investigation with a broad range of social and dark web information