Automating Security Operations Using Phantom
A
u
t
o
m
a
t
i
n
g
S
e
c
u
r
i
t
y
O
p
e
r
a
t
i
o
n
s
u
s
i
n
g
P
h
a
n
t
o
m
About Me
Agenda
Our goals
Security Alerts
How much data?
Log example
How the log
looks like in
the SIEM
Alert example
How the
alert looks
like in the
SIEM
Manual triage
Example
Workflow for handling the alert
Example (cont)
What is Phantom?
What is
Phantom?(cont.)
Main Components
Apps
Playbooks
Assets
Events
Asset
Polling
Events
Phantom
server
Why Phantom?
Why Phantom?(cont.)
Event
Playbook
Why Phantom?(cont)
APP
PLAYBOOK
Asset 1
Asset 2
Examples of useful
integrations
Demo
Let’s create a Playbook!
Demo
Achievements
•
Alerts for Weak Network Security
Group in Azure
Achievements(cont.)
•
Alerts for Publicly Exposed Azure
Containers
Achievements(cont.)
•
Follow-up work on Jira tickets for
AWS Weak Security Groups
Next steps
What is on
for the
future?
Q & A
Isabella Minca, an intern for 4 months in the Security Team at Adobe, presents an overview of automating security operations using Phantom. The presentation covers goals, security alerts, Phantom playbooks, handling security data, and the capabilities of Phantom in orchestrating security responses. Learn how automation can enhance analyst efficiency and enrich knowledge on potential security threats.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Automating Security Operations using Phantom
About Me Isabella Minca Intern for 4 months in the Security Team @ Adobe 4th year student @ Univ. Politehnica of Bucharest
Agenda Our goals Security Alerts Phantom overview Phantom Playbooks What's next
Our goals Automate repetitive manual work of analysts Enrich existing knowledge on Security Alerts In the future: Discovering new potentially malicious behavior
Security Alerts Logs SIEM Alerts Triage
How much data? 30 TB logs/day 150 alerts/day > 100 different types of alerts
Log example How the log looks like in the SIEM
Alert example How the alert looks like in the SIEM
Manual triage Manually handling the alerts includes a lot of repetitive work Example: Azure Weak Network Security Group
Example Workflow for handling the alert NSG still exists? NSG still weak? Create Jira ticket
Example (cont) All of these steps can be automated So here it comes Phantom
What is Phantom? Security Orchestration Response capabilities Automation
What is Phantom?(cont.) Aims to help scaling security operations efforts Recently acquired by Splunk
Main Components Apps Events Playbooks Assets
Apps Third party technologies Used similarly to an API
Playbooks Codification of the security operations plan Written in Python
Assets Specific instances of physical or virtual devices Examples: servers, endpoints, firewalls
Events Phantom server Asset Events Polling
Why Phantom? Phantom playbook Plain Python script vs.
Why Phantom?(cont.) Artifact Artifact Artifact Playbook Event Event
Why Phantom?(cont) Asset 1 ACTION 1 ACTION 2 APP PLAYBOOK ACTION 3 ACTION 4 Asset 2
Examples of useful integrations Virus Total Splunk Jira Slack SMTP
Demo Let s create a Playbook! Demo
Achievements Alerts for Weak Network Security Group in Azure
Achievements(cont.) Alerts for Publicly Exposed Azure Containers Container still exists? Container still exposed? Create Jira ticket
Achievements(cont.) Follow-up work on Jira tickets for AWS Weak Security Groups SG All SGs crossed out? Close ticket restricted/ deleted? Cross out
Next steps Automate repetitive manual work What is on for the future? Enrich alert data Use ML to detect security issues
