Research Paper
Improve your SOC: SOAR or Threat Hunting or both?
Evaluating SOC operations to define the role of SOAR and Threat Hunting.
Resources
Research Paper
Cyber Threat Modelling by leveraging an open source attack graph and activity thread graph tool
Many SOC organizations lack the expertise to analyze complex cyber event chains, leaving them vulnerable to threats. The CTI-STIX-Diamond-Activity-Attack-Graph tool helps prepare for risks by providing detailed insights into attackers' tactics, enabling effective defense measures across prevention and detection controls.
Abstract
Ineffective approaches in incident preparation and security operations (detection, intrusion analysis and response) exist in many SOC organizations today. They further lack knowledge and expertise to comprehend and analyze a large cyber event chain consisting of multiple related events. Therefore, organizations fall short of defending against the risk cyber attackers pose to them.
Leverage our tool (cti-stix-diamond-activity-attack-graph) to properly prepare for the current and future risks cyber attackers are posing against a client's organization. Upon detailed understanding of the threats by using attack graphs and attack trees, put the right defensive measures onto the client's prevention and detection security controls. These insights are consumed by various stakeholders to get an understanding of the attacker's complete modus operandi and how they would target a client's assets in a few glances.
To use the tool online, visit https://yukh1402.github.io/cti-stix-diamond-activity-attack-graph/. Alternatively, you can access the GitHub repository or download the image from Docker Hub. Run the Docker image using the following command: docker run -d -p 80:80 1402/cti-stix-diamond-activity-attack-graph:latest
Contact
Operationalise Cyber Threat Intelligence.
Turn the reports and feeds you already receive into a governed Cyber Threat Model that your SOC and risk and management teams can act on. Tell us where you want to start.