You're reading from Aligning Security Operations with the MITRE ATT&CK Framework Level up your security operations center for better security

Product type Paperback

Published in May 2023

Publisher Packt

ISBN-13 9781804614266

Length 192 pages

Edition 1st Edition

Concepts

Cybersecurity

Author (1):

Rebecca Blair

View More author details

Table of Contents (18) Chapters

Preface

1. Part 1 – The Basics: SOC and ATT&CK, Two Worlds in a Delicate Balance

2. Chapter 1: SOC Basics – Structure, Personnel, Coverage, and Tools FREE CHAPTER

3. Chapter 2: Analyzing Your Environment for Potential Pitfalls

4. Chapter 3: Reviewing Different Threat Models

5. Chapter 4: What Is the ATT&CK Framework?

6. Part 2 – Detection Improvements and Alignment with ATT&CK

7. Chapter 5: A Deep Dive into the ATT&CK Framework

8. Chapter 6: Strategies to Map to ATT&CK

9. Chapter 7: Common Mistakes with Implementation

10. Chapter 8: Return on Investment Detections

11. Part 3 – Continuous Improvement and Innovation

12. Chapter 9: What Happens After an Alert is Triggered?

13. Chapter 10: Validating Any Mappings and Detections

14. Chapter 11: Implementing ATT&CK in All Parts of Your SOC

15. Chapter 12: What’s Next? Areas for Innovation in Your SOC

16. Index

Why subscribe?

17. Other Books You May Enjoy

Turning alert triage feedback into something actionable

There is no point in collecting feedback unless you plan to drive action from it or are using it to gauge a response for a current action that has already been implemented. I recommend using Value Added, Closed State, and other fields such as Labels to both provide insight and try to drive/prioritize actions. One way to do that is to create dashboards within Jira, such as in the following example:

Figure 10.4 – Jira dashboard

As you can see from this screenshot, we have a very basic dashboard that has been created for a Jira project. This shows all activity on the board in the upper-right section, a pie chart based on Value Added for alerts in the upper-left section, and all current tickets in the bottom-left corner. To create a dashboard, you would start by creating a filter, like so:

Figure 10.5 – Jira filter

You would first click the Filter tab up top...

The rest of the chapter is locked

You're reading from Aligning Security Operations with the MITRE ATT&CK Framework Level up your security operations center for better security

Table of Contents (18) Chapters

Turning alert triage feedback into something actionable

Authors (1)

Personalised recommendations for you

You're reading from Aligning Security Operations with the MITRE ATT&CK Framework Level up your security operations center for better security

Table of Contents (18) Chapters

Turning alert triage feedback into something actionable

Unlock this book and the full library FREE for 7 days

Authors (1)

Personalised recommendations for you