Five strategies for detecting threats more effectively and efficiently

“We want more alerts” are words rarely heard from security teams. That is because most security teams see more alerts as more work and more opportunity to miss something. After all, they’re busy dealing with…more alerts!

However, more alerts are exactly what security teams need to be more effective in their mission. Have you ever heard a police inspector asking for less evidence for their case? No. They want to quickly and efficiently narrow in on the evidence that matters most.

Here are five strategies that will have your threat detection program running like a well-oiled machine.

1. Alert tagging

The goal of alert tagging is to set the foundation for increased effectiveness and efficiency by appending relevant data to the alerts we get from our security technology.

We tag articles, tweets, videos. Why not alerts?! Tagging allows us to append an essential piece of metadata regarding the alert for later use. Some examples of tags I’ve used in the past include:

MITRE ATT&CK techniques and tactics — by classifying alerts according to the technique and tactic they detect opens the door for grouping, dynamic prioritization, and provides vital context for the threat analyst
Threat intelligence — alerts contain data that can be automatically matched against threat intelligence to identify known threats. Tagging alerts for the presence of known threats opens the door for dynamic prioritization and automation
Critical assets and users — when critical users and assets generate alerts, they should automatically be considered a higher priority. Tagging alerts from critical sources is required for dynamic prioritization and facilitates automation
Confidence — all alerts aren’t created equal. Some are very high fidelity, and others have a high false-positive rate. Applying a confidence rating to an alert is a requirement for dynamic prioritization. I typically recommend a 0–3 rating where 3 is the highest confidence

The easiest way to set up this kind of tagging is through your SIEM. Some technology generates alerts and can automatically add custom tags, however, having a single hub and logic for applying tags will greatly simplify management in the future.

2. Alert grouping

The goal of alert grouping is to increase the effectiveness and efficiency of threat detection by combining related alerts to reduce the overall number of alerts to action.

Alert grouping is nothing more than taking related alerts and grouping them into a single event to investigate. This simple change will reduce the number of actionable alerts by up to 50% (or more!). Consider that threats and breaches never occur in a vacuum. Instead, they generate several hundred of events and alerts throughout the attack life cycle. When we group the related alerts, the analyst no longer sees a never-ending list of alerts, but instead can quickly hone in on alerts with the highest groupings or the groupings with the highest priority (which is strategy two).

Some examples of grouping could include:

Target system — where we are grouping all alerts generated about or on a specific system over a small time period (an hour at the most)
Source — where we are consolidating all alerts generated from one particular system, IP address, or other sources of a threat or breach over a more extensive time period (24 hours at the most)
User account — attackers target user accounts and will use them for access. Grouping alerts by source or target user account over a small time period (an hour at the most) can help identify malwareless attacks
Tags — depending on your tagging strategy, you can now group alerts based on tags, or use the tag as an additional filtering parameter for the above groupings

The easiest way to set up this kind of grouping is through your SIEM. While the specifics are dependent on your specific technology, your SIEM should allow you to import all alerts from technology and group them with queries.

3. Dynamic prioritization

The goal of dynamic prioritization is to increase the effectiveness of threat detection by ensuring that the most important alerts are reviewed first.

If the goal of the security team is to prevent a threat or breach from causing material damage to the organization it serves, why are we relying on the severity of a threat to guide workflows? Instead, we need to focus on the impact of a threat to the organization. The concept of dynamic prioritization is quite simple:

Take a 3 point scale where: 0–1 represents LOW priority, 1–2 represents MEDIUM priority, 2–3 represents HIGH
Average the weighted priorities together making sure to factor in the confidence rating established during the alert tagging phase as a multiplier
Apply the surrounding context priority average described below
Use the average priority as the priority for the group of alerts from strategy number two

If you’ve followed the guidance thus far, your alerts are grouped based on relevance, prioritized based on the impact to the organization, and the average urgency of the alerts. (This article assumes your security technology already assigns some kind of scale rating to the alerts it generates)

Dynamic prioritization also needs to make allowances for the surrounding context of the alert (in other words, should the priority of this group of alerts increase based on other surrounding events?). Here are a few examples of using surrounding context to increase the priority of a group of alerts:

The group of alerts describes three or more different MITRE Tactics adds a 2x multiplier
The group of alerts describes two or more techniques in a single tactic adds a 2x multiplier
The group of alerts includes three or more HIGH alerts on a unique critical asset adds a 3x multiplier

The easiest way to set up this kind of prioritization is in your SIEM dashboard with your grouping logic. You will require some custom SIEM engineering to get right, but the investment means that you are as efficient as the business wants you to be, with the methodology to prove it.

4. Alert and group suppressions

The goal of suppressions is to increase efficiency by providing a way for analysts to tell the alert queue “I want to see this, except when”

When we open up the floodgates of alerts, we need a method for removing alerts and groups of alerts we know to be benign. The best alert suppression systems simply overlay a rules engine on top of the alert ingestion and grouping engine. The most straightforward alert suppression systems integrate suppressions into the queries they use to build the SIEM alert lists and dashboards.

Simple suppression engines should focus on using the tagging capabilities from strategy number one. By adding metadata about data known to not represent a threat, simple suppression engines can quickly identify alerts and groups to remove. However, user beware for this approach, the simpler a suppression engine, the more likely it is to suppress alerts that are true positives.

Suppressions are a critical component of reaching efficiency in threat and breach detection. The level of investment you make in engineering the solution directly impacts the efficiency of your people.

5. Intelligence

The goal of intelligence is to increase effectiveness and efficiency by providing relevant identity and context to alert data to speed analyst decision making.

In our first strategy, we tagged alerts that contain threat intelligence indicating known malicious threats. But threat intelligence is so much more than the indicators of compromise for known threats.

Intelligence gives the analysts identity and meaning to the data on their screens. Intelligence gives the analyst informs the analyst of attacker techniques and tactics and their relevance in the threat landscape. Intelligence gives the analyst the business relevance of the data they are looking at.

Here are some ideas on how to better use intelligence for alerts:

Automatically lookup simple indicators like IP addresses, domain names, file hashes, email addresses, and URLs and provide the result within the analyst view of the alert
Automatically lookup LDAP information for internal systems and users and provide the result within the analyst view of the alert
Automatically lookup the results of the last vulnerability audit of internal systems and provide the result within the analyst view of the alert
Automatically lookup the historical confirmed alerts for the simple indicators in the alert grouping and provide the result within the analyst view of the alert

Many SIEMs allow you to configure threat intelligence sources to perform the matching and to append data automatically. However, in many situations, custom engineering will be required to integrate the appropriate intelligence within the analyst view. The more information an analyst has within the view of the alerts they’re validating, the more efficient they will be at reaching a final determination as to the presence of a threat.

Bonus. Automation

The goal of automation is to increase the efficiency and effectiveness of our people by letting technology do what technology does best: run repeatable processes with a high degree of accuracy at high speeds.

Now that you’ve provided some structure, standardization, and context for your alerting pipeline, you have a unique opportunity to further increase the effectiveness and efficiency of your threat detection program through automation. Automation tools allow you to take a predefined action based on several different inputs. The issue that most organizations face when implementing automation for threat detection is the disruption of business operations caused by the absence of reliable inputs and a high degree of false-positive events that trigger automation. With the work done above, you’ve not only reduced the number of potential false positives but also increased the number of reliable inputs. Here are some examples of automation that could be triggered:

Automatically block domains, file hashes, and IP addresses that appear in HIGH priority alert affecting ten or more distinct hosts in 15 minutes
Automatically disable the network port for desktop systems that appear in 10 or more distinct HIGH priority alert groupings
Automatically disable user accounts that appear in 10 or more distinct HIGH priority alert groupings

Automation is typically implemented in technology outside of your SIEM. However, many vendors are starting to merge the two capabilities in single platforms. If they see the value, then you should certainly give it a try.

A quick note about showing the improvements in effectiveness and efficiency

The key will be tracking these metrics before and after implementing each of the strategies above. Here are some key metrics that can be proxies for effectiveness and efficiency:

Time to determination — this measures how long it takes from when the alert is generated to when an analyst has decided as to whether a threat is present. For each of the strategies above, you should see a net improvement in this metric. This metric speaks to efficiency
False-positive rate (for alert groups) — this metric should explicitly apply to alert groups vs. specific alerts. The grouping of alerts helps mitigate the impact of false positives on the productivity of the analysts, which is what is important. This metric should improve with grouping and suppressions. This metric speaks to both efficiency and effectiveness
Error rate (missed threat events) — all teams should be tracking their error rates. What gets measured gets improved. The error rate is simply when either the technology or people missed a threat that was later detected. I typically recommend that organizations classify a threat as missed if it has been present in the environment for more than 24 hours. By that, I mean that if a threat analyst detects a threat that breached the environment outside of the prior 24 hours, it counts as a missed threat. By implementing the strategies above, you should see this error rate go down