Use Case: Network Threat Detection & Response

[ShaunaV]

Benefits: Reduce mean time to detection or investigation, identify known malicious activity monitored by Armis SPAN 

  

Note: To minimize the false-positive and number of alerts, make sure to whitelist your vulnerability scanner from your policy using one of these two methods:  

1. Whitelist the device directly from the policy configuration by adding it to the policy query. For example, you could add the following condition: !device:(tag:Managed deviceId:12345 ), you can also use the IP addresses of these vulnerability scanners. 

1.  Exclude Vulnerability scanner type from your policy 

 For example,in:activity timeFrame:"7 Days" device:(!type:"Vulnerability Scanners") 

  

Some ASQs for Threat Hunting 

• Activities of infected devices 

in:activity timeFrame:"7 Days" type:"Threat Detected" content:(infected device) 

• Threat Detected 

in:activity timeFrame:"7 Days" type:"Threat Detected" decisionData:(threatProperty:"Attack Attempt") 

• Remote Code Execution Detected 

in:activity type:"Threat Detected" decisionData:(threatProperty:"Remote Code Execution") timeFrame:"30 Days" 

• Communication to a suspicious URLs 

1. in:activity timeFrame:"30 Days" type:"Suspicious URL" 

1. in:activity type:"Risk Factor Updated" riskFactors:(type:"Malicious Domain") timeFrame:"30 Days" 

1. in:activity timeFrame:"7 Days" type:"Suspicious Host" content:(malicious web sites) 

1. in:activity timeFrame:"30 Days" type:"Suspicious Host" content:(phishing) 

• Communication to a suspicious host  

• Traffic Anomaly Detected 

  

Note: The current Traffic Anomaly detection design is to alert on anomalies in the traffic volume between the mentioned source and destination and compared to their baseline, meaning Armis check anomaly on IPs but not on ports. 

 
  

Sub Use Case: Signature Based Detection 

Detect known attacks by continuously analyzing the network traffic and identifying specific patterns, such as byte sequences in network traffic, or known malicious instruction sequences used by malware, such as “log4j” and “SQL Injection”. 

  

Definitions: 

1. What known threats (signature based) were identified in the network and in what time period? 

      Armis Suggestion: Any known threats in the last 14 days. 

2. For which known threats alert should be triggered? 

      Armis Suggestion: Generate an alert for any known threat. 

3. In which part of the network should the known threats detection be activated (SPAN based)? 

      Armis Suggestion: Perimeter (N/S), Access Layer (N/S and E/W), Any site/branch 

  

Policies & Alerts:To be done after SPAN and collectors are deployed. 

1. Activate policy that will generate alert for any known threat detection 

      a. Policy condition type: Activity 

      b. Condition: type:"Threat Detected" device:(!type:"Vulnerability Scanners" ) 

2. Activate policy that will generate alert for specific known threat detection 

      a. Select the policy rule from the policy library and activate it 

  

Dashboards and Queries: 

Work with your TAM or CSM to create and operationalize the appropriate dashboards and queries. Here are some suggestions: 

1. Threats Detected Big Number: 

There is a big number shortcut on the main dashboard “Threat Activities.” It presents the number of detected threats (IDS based) in the last 14 days. It will redirect to the relevant activities table (in:activity timeFrame:"14 Days" type:"Threat Detected" !device:(type:"Vulnerability Scanners")) 

  

  

  

 

2. Customized Threat Activities Dashboard: 
3.  Dashlet Title: Malicious Activity (IDS-based) by Site 
4.  Dashlet Query: in:activity type:"Threat Detected" !device:(type:"Vulnerability Scanners") 
5. Chart: Bars 
6. Summarize: Activities 
7. By: Site 

 

  

  

  

  

  

  

  

3. Threat Detected Alerts Dashboard: 
4.  Dashlet Title: Threats Detected Alerts 
5.  Dashlet Query: in:alerts activity:(type:"Threat Detected" ) 
6. Chart: Bars 
7. Summarize: Alerts 
8. By: Alert Title 

 

  

  

  

Sub Use Case: Behavioral Analytics Threat Detection 

Detect attacks and malicious activity by continuously analyzing the network traffic and identifying heuristic and behavioral patterns, such as “Brute Force”, “Port Scan” and “Malicious Host Connection”. 

  

Definitions: 

1. What behavioral malicious or suspicious activity were identified in the network and inwhat time period? 

Possible activity types: ARP Poisoning, Brute Force, BSSID Spoof, SuspiciousHost, Abnormal Behavior, Port Scan, Authentication Failure 

      Armis Suggestion: Look for all behavioral threat types in the last 14 days. 

2. For which behavioral threats alert should be triggered? 

      Armis Suggestion: Generate alert for any behavioral threat 

3. In which part of the network should the known threats detection be activated (SPAN based)? 

      Armis Suggestion: Perimeter (N/S), Access Layer (N/S and E/W), Any site/branch 

  

Policies & Alerts:To be done after SPAN and collectors are deployed. 

1. Activate policy that will generate alert for any behavioral threat detection 

      a. Policy condition type: Activity 

      b. Condition: type: ”Abnormal Behavior","ARP Poisoning","Authentication Failure","Brute Force","BSSID Spoof","Port Scan Detected","Suspicious Host" 

2. Activate policy that will generate alert for specific threat detection 

      a. Select the policy rule from the policy library and activate it 

  

Dashboards and Queries: 

Work with your TAM or CSM to create and operationalize the appropriate dashboards and queries. Here are some suggestions: 

1. Customized Threat Activities Dashboard: 

1.  Dashlet Title: All Treat Activity by Site 
2.  Dashlet Query: in:activity type:"Abnormal Behavior","ARP Poisoning","Authentication Failure","Brute Force","BSSID Spoof","Port Scan Detected","Suspicious Host","Threat Detected" !device:(type:"Vulnerability Scanners") 
3. Chart: Bars 
4. Summarize: Activities 
5. By: Activity Type 

  

2. Threat Alerts Dashboard: 
3.  Dashlet Title: Threats Detected Alerts 
4.  Dashlet Query: in:alerts activity:(type:"Abnormal Behavior","ARP Poisoning","Authentication Failure","Brute Force","BSSID Spoof","Malicious Behavior","Port Scan Detected","Suspicious Host","Suspicious SMB Connection","Threat Detected","Suspicious URL" ) 
5. Chart: Bars 
6. Summarize: Alerts 
7. By: Alert Title 

3. Specific Threat Dashboard / Example: Suspicious Host Communication 
4.  Dashlet Title: Suspicious Host Communication 
5.  Dashlet Query: in:activity type:"Suspicious Host" 
6. Chart: Bars 
7. Summarize: Alerts 
8. By: IPv4 Address 

  

Sub Use Case: Rule/Policy based detection implementation 

Detect attacks and malicious activity by identifying and analyzing specific IP Connections and communication patterns. 

Definitions: 

1. What threat or malicious activity were identified based on IP Connections and communication patterns analysis and in what time period? 

      Threat Examples: Coinminer DNS query, DNS query to Tor domain, DNS queryto Cobalt Strike beacon                 domain, NAT Slipstreaming v2 exploit attempt detected,PwnedPiper - Potential remote code execution 

      Armis Suggestion: Activate policies (alerts) suitable for environment type in the last 14 days. 

2. In which part of the network should the known threats detection be activated (SPAN based)? 

      Armis Suggestion: Perimeter (N/S), Access Layer (N/S and E/W), Any site/branch 

  

Policies & Alerts:To be done after SPAN and collectors are deployed. 

1. Activate policy that will generate alert for specific threat detection 

      a. Select the policy rule from the policy library and activate it 

  

Dashboards and Queries: 

You can use alerts dashboard to view the triggered alerts (after activating the policies) 

Example: pwnedPiper - Potential Remote Code Execution 

1. Go to Alerts page 
2. Look for the relevant alert 
3. Go into the alert details 

  

Sub Use Case: Threat Investigation 

Use Armis to investigate a threat event that was triggered in the Armis system or in another system. Aggregate and correlate forensic data, asset context and network traffic mapping to understand what triggered an alert, view and analyze the event stream, the entry points and the security gaps. 

Definitions: 

1. What Armis policies are activated (generating alerts)? 
2. What other detection systems are in use? 

Alert Investigation: 

1. Navigate to the Alerts page. 
2. Look for the relevant alert. 
3. Review the alert details. 

  

4. Follow investigation tabs to collect forensic data, including “Activities” and “Devices”.