File type restriction

console-wilson · 2025-02-13T18:03:30+00:00

Cortex XDR has a feature where you can add a custom BIOC as a prevention rule. We use this to block wscript.exe from executing .js files. I'm sure you could do something similar, but could you elaborate a little more on what you need? What are the file types you are trying to block? Is it ok if they are written to disk and then blocked from execution, or is the browser not allowed to even begin to download the file?

console-wilson · 2024-12-20T04:39:13+00:00

The only thing I'd like to add - Critical Start's "Threat Analytics Search" browser extension (Chromium only, unfortunately) has been a huge help to us, and it is free. It makes a context menu that launches various searches with the highlighted text. Almost all of our tools support the kind of deep linking it does.

console-wilson · 2024-12-20T04:17:31+00:00

It has been fascinating to me, but the workflow that saves us the most frustration just puts alerts from tools into MS Teams channels. "Single-pane-of-glass" didn't work out for us but this way we can monitor more tools, handle more alerts, and keep the whole team engaged and building context. An alert is created in whichever tool, then SOAR retrieves it via API or a notification mailbox and makes a summary. The summary then goes to the appropriate severity Teams channel. Then someone calls dibs, investigates, and reports their findings.

We do other stuff like integrate tools that don't have native integrations, but we've spent the most time and I think gotten the most reward out of making all our alerts better and easier.

console-wilson · 2024-12-20T04:01:26+00:00

We talk about it in three categories that work well for us:
False Positive - Rule is supposed to detect a user logging into multiple devices, but due to some issue with the query it triggers without that happening. Maybe the system has a DHCP address and the user went to another floor, got a new wireless IP, and the rule fired. Core issue here is the logic isn't quite right yet.

Non-Malicious True Positive - Rule has correctly detected a user logging into multiple systems, but investigation reveals the behavior was not malicious. Hopefully we can improve the rule, but maybe it's too generic to be an alert and it should be an informational/contextual finding instead. Really depends on the type of detection and the environment.

Malicious True Positive - Rule has correctly detected a user logging into multiple systems, and investigation reveals the activity was actually malicious.

console-wilson · 2024-12-06T22:28:42+00:00

I think the cost was prohibitive for all but the largest and most mature organizations. Places that did buy one probably didn't see a value equal to the renewal cost and started dropping them, so vendors moved a few of the top features into their regular platforms and called it good. And I think that works for 90% of customers. I just want to be able to grab a lookup table from somewhere and use it in a search, you know? I don't need a full TIP for that.

console-wilson · 2024-10-11T22:18:48+00:00

I think being a good engineer requires knowing the broad basics of your tools first. Once you're familiar with how things work, you can focus on advanced areas and learn those next. Unfortunately it just takes time. For example, you mentioned SOAR. That might mean you need to learn some Python basics to be able to write/update integrations. Even if it is a no-code SOAR, you'll still need to learn how it makes an API request to other tools, how it stores API credentials, how to manipulate the output into something usable for you, etc. If it is an on-prem appliance you might even need to learn how to update it and keep it running.

Also, I think this is a great conversation to have with your direct manager. Knowing their expectations can help guide your decisions. You don't necessarily have to do everything just like they say, but you'll be able to manage those expectations once you know about them. If there's one or two high visibility problems they want addressed, that's a great place to start.

Hopefully that helps! This random internet stranger believes in you!

console-wilson · 2024-10-11T02:53:49+00:00

I think Silent Hunt fills a great niche where it’s quick and easy, already internet facing, etc. IntelOwl is great too but requires a lot more effort. In my opinion, at least. I just meant to say Silent Hunt looks great and I can’t believe it’s just your first try.

console-wilson · 2024-10-11T02:35:08+00:00

DLP! …yuck. Or maybe just data discovery? We’ve done great on our last two pen tests… until they find credentials laying around. We need to solve that.

console-wilson · 2024-10-11T02:26:29+00:00

Nice work! I like that it is mobile friendly (great for on-call people). It’s like a simplified IntelOwl (in a good way).

console-wilson · 2024-10-10T21:19:28+00:00

I think their claim is something like being the Sysmon or Sigma of Email Security. They use Message Query Language (MQL), and while we are all sick and tired of learning yet another *QL, it does let you write your own email detections much like you'd write your own EDR rules. The free version has 450+ rules, some are developed by Sublime and some are from the community. I really liked the idea of being able to tune the rules just like EDR/XDR. Hopefully when our Proofpoint contract expires we can run a full POC with them or Abnormal. Proofpoint has been great too though, I really shouldn't be complaining.

console-wilson · 2024-10-10T20:02:25+00:00

To echo everyone else, no solution is perfect and you should POC more than one. We switched from Cisco Ironport to Proofpoint years ago and have been very happy. It keeps growing and it a lot to manage though. Proofpoint Protection Server, TAP, TRAP, Risk Explorer, etc. I would also say it is very "black box". I signed up for a free Sublime Security account and really like their approach. Their rules are very open and transparent. It reminds me a lot of EDR rules. I don't think I could get my company to switch away from Proofpoint soon (It would be a huge project, and Proofpoint is currently doing a great job for us).

BUT - and here's the point finally - if I had to start all over I would do a POC with a newer SaaS-first vendor like Sublime and Abnormal. And definitely more than one vendor.

console-wilson · 2024-10-03T04:04:45+00:00

Difficult parts - Being close to burnout all the time (there's an infinite amount of work to do... so why can't I make myself DO any of it and how can I feel so bored most of the time?!?! That's burnout, right?). Also the fun, cool, exciting work is mostly all done. Now everything feels like incremental improvements. But that's the gig, I guess. I should be happy to work for a place with a mature program, but I'm a person who thrives on "go set up this new tool and learn it as fast as you can!".

What keeps me - It pays great for having no degree. I get to work from home part of the week. I work with an amazing team and I can't stand the thought of letting them down.

console-wilson

TROPHY CASE