You're reading from Aligning Security Operations with the MITRE ATT&CK Framework Level up your security operations center for better security

Product type Paperback

Published in May 2023

Publisher Packt

ISBN-13 9781804614266

Length 192 pages

Edition 1st Edition

Concepts

Cybersecurity

Author (1):

Rebecca Blair

View More author details

Table of Contents (18) Chapters

Preface

1. Part 1 – The Basics: SOC and ATT&CK, Two Worlds in a Delicate Balance

2. Chapter 1: SOC Basics – Structure, Personnel, Coverage, and Tools FREE CHAPTER

3. Chapter 2: Analyzing Your Environment for Potential Pitfalls

4. Chapter 3: Reviewing Different Threat Models

5. Chapter 4: What Is the ATT&CK Framework?

6. Part 2 – Detection Improvements and Alignment with ATT&CK

7. Chapter 5: A Deep Dive into the ATT&CK Framework

8. Chapter 6: Strategies to Map to ATT&CK

9. Chapter 7: Common Mistakes with Implementation

10. Chapter 8: Return on Investment Detections

11. Part 3 – Continuous Improvement and Innovation

12. Chapter 9: What Happens After an Alert is Triggered?

13. Chapter 10: Validating Any Mappings and Detections

14. Chapter 11: Implementing ATT&CK in All Parts of Your SOC

15. Chapter 12: What’s Next? Areas for Innovation in Your SOC

16. Index

Why subscribe?

17. Other Books You May Enjoy

Summary

Feedback on all aspects of projects is important, and feedback on the value and ratings of alerts is no different. If we aren’t capturing that information, then we’ll never be able to properly understand our risks when it comes to detection, and could have a false sense of security. Just as with responses, we want to continue down the path of automating as much as possible in an effort to get a core understanding of our successful detections and of ones that might need a little bit of help. Understanding that will allow us to have a more operational team and help assist you in becoming more scalable. From this chapter, you should be able to critically look at your triage process and identify additional actions, such as steps that can be automated to assist with your triage process, and you should be able to add other fields to capture data during triage that can be used to drive actions.

In the next chapter, we’ll discuss how to narrow down which alerts...