Welcome to Module two, mapping from
Raw Data, and
one, Adam talks about the process of
mapping from narrative reporting to
attack.
Now Module two will be talking about
leveraging that same process when
mapping from raw data or data
from incident response.
So our objectives for this module
are learning how to identify and
research behaviors and raw data.
Next, we'll be talking about
translating those behaviors into
tactics, techniques and subject
makes final practice,
mapping the raw data with an
exercise. And then we'll review a
couple of best practices for
displaying the attack map data and
reports.
Moving on to our first lesson, two
point one, the process of mapping
from raw data.
So our objectives for less than two
point one are talking through the
mapping process for raw data.
We're going to be discussing some of
the challenges and advantages of
mapping from our data versus
narrative reporting and then
reviewing the pros and cons of
mapping from the two different data
sources.
So far in this attack
training, we've been focusing on
reporting and intelligence that has
already been developed and is
outlining what occurred around the
adversary behaviors when
mapping from raw data.
We're going to be performing the
analysis of behaviors directly
from the source data that informs
those type of reports.
And there are some specific
challenges and advantages of mapping
from raw data.
So a key challenge with raw data is
that there can be a lot more
knowledge necessary to
actually come to a point where you
can map mapping to attack.
So this might include reviewing many
more data sources and it may require
just diverse levels of experience.
Another challenge is that there can
be a wide set of potential data that
might contain behaviors, and
this can be data from forensic disk
images or from SQL commands.
It can be our from our own analysis,
from sandbox detonation or from
a number of other data sources
coming from instant responders.
And finally, you might have to be
looking at a lot more data overall
in order to figure out what the
intent and tactics are for the
actual behavior.
Moving on to the advantages.
So a key advantage is that there's
probably more information available
at a procedure level and more detail
on the actual data.
You're also not reinterpreting
someone else's analysis.
You're deciding yourself how to
assess the adversary activities.
Finally in Raw Data.
It really enables you to increase
your understanding of different data
sources and potentially using
different kinds of tools to gain
additional information on adversary
behaviors.
So throughout the rest of this
module, we're going to be following
the same mapping process that was
covered in Module one,
we're going to be walking through
each of these steps to identify
research and translate those
behaviors into the relevant tactic,
technique or some technique.
So with each of the steps and the
attack mapping process, there can be
a lot of variance between the two
types of information to attack.
And so we're going to be walking
through some of the pros and cons of
mappings into two sources,
starting with step one, finding the
behavior for raw data.
If you're actually looking at data
and the information coming from a
activity.
A lot of it can be a behavior.
Now, that's not to say that
everything in attack is an attack
technique is Adam discussed
a major one attack doesn't include
every possible behavior
and narrative reporting.
The behaviors might be buried in a
lot of content and hidden among
IONSYS or distributed
throughout the report for step
to research and behavior.
With raw data, you might have to
work across multiple domains and
sources to actually understand the
behaviors, or you might
have to review multiple data types
simultaneously in
a village that the activity might
be a recognized procedure, as we
discussed.
And this can help us map
directly to a technique or some
technique and narrative reporting.
There might be enough intelligence
and related context to really
understand their behavior,
but there also might be some lost
detail that wasn't included in the
report.
For step three is to translate the
behavior into a tactic.
It might take a significant level
domain knowledge and expertize to
understand adversary activity
and intent and raw data,
whereas in narrative reporting,
this might already be outlined by
the report author where they
speculated about what the intent is
for the behaviors
for step four and raw data.
If we've already found a procedure
that goes straight to a technique or
some technique, as we mentioned,
this could be relatively simple.
This might also require a really
deep understanding of the specific
data type in order to understand
how that activity was accomplished.
In the case of narrative reporting,
it might be as simple as a text
match with something we previously
mapped to attack or procedures
already in attack.
But there also might be a lack of
necessary detail to indicate
what the technique is.
Finally, let's step five, comparing
your results to other analysts.
So collaboration with other analysts
is really important with raw data to
ensure that all the different data
sources you're pulling in
are covered with the appropriate
expertize and narrative
reporting. This collaboration is
key to helping us recognize and
mitigate those user biases.
So in less than one two point one,
we just talked about mapping raw
data to attack and discuss some of
the challenges, some of the
advantages of mapping from raw data
compared to reporting,
and that includes a more advanced
and diverse skill set might be
required for raw data.
But there's likely more information
at the procedure level and you won't
be reinterpreting someone else's
analysis.
We also walk through some pros and
cons of mapping from each source
based on the attack mapping process.
And less than two point two, we're
going to be diving into identifying
and researching the behaviors.