foreign
to hear all the different talks and to
see things that are mentioned in the
previous talks you know that I was also
going to mention as well so I'm going to
try to tie things together as much as I
can and um
yeah so we've talked um I remember
Sherman Chu gave an awesome talk where
he was talking about people technology
and processes I'm really going to be
telling my story through the lens of the
technology
specifically this thing called synapse
which is
which is pretty cool I'm going to talk a
little bit about it
um
and so yeah let's move on
the
the first thing I want to mention and
hopefully this will uh
um give me some credibility is that I've
been working with synapse since about
2017
um so definitely a big fan I think uh
some of the teams I've been on have been
some of the first users I worked for a
company called extra hop which does
network security and we um
we're setting up a new intelligence team
and so from my perspective when you're
doing intelligence
uh the one of the first things you need
to think about is your database
um the job of intelligence oftentimes is
relating the old to the new
um if you have something that's entirely
new you've never seen before
um oftentimes the
um the intelligence binding is hey this
is brand new we haven't seen it before
or if you find something that you've
seen a million times
um that also isn't particularly
interesting
um but
we're kind of at that edge of expanding
the knowledge taking something that
maybe wasn't known before
um discovering it and then eventually
what we've what we found is that uh is
pretty well known so
when you're going to do this you want to
have the best database possible
um and really I was trying to think if I
was forced to do intelligence without
this database to back me could I do it
anymore because I've Incorporated the
the thoughts and the data scheme of so
much into my my thinking that it might
be challenging for me to to back out and
not use this um
and so I'm going to do a little bit of
introduction about the platform for
those of you who aren't familiar with it
um I'm going to talk about the database
considerations again
um when you are doing threat
intelligence um what you know as a
company is very important
um and I'm going to talk about maybe how
many databases you're going to set up
how they're going to relate to each
other and where your synapse fits into
that whole process I'm going to talk
about the data schema
um which again is something that we've
we've touched on in several talks um I'm
actually a big fan of jira as well I've
used jira for storing intelligence
um for
uh for this but you know the
the synapse database is going to be at
the more technical level you're going to
be keeping track of ioc's
um domains IPS files file hashes strings
things like that
um we're also going to talk about
analyst workflows so when you're talking
about the people processes and
Technology you have to think about how
the people processes and Technology all
work together and I'm going to show how
that works with synapse
and then I'm going to show
uh basically how you document this and
this is the idea of
um making sure that everybody's on the
same page I'm actually a huge
performance proponent of documentation
and how it can help you and then finally
what the outputs look like from a
technical system like this
I I think that um I want to be very
clear like I'm a I'm a sample of one I
can share my six years of experience
using this tool other teams are going to
have different uses for it and so
um at the same time I think that six
years of experience
um
is going to give me some insights that
maybe you can all benefit from because I
know this is a tool that's growing a lot
and so I really want to
um help the new the new generation
excuse me the new generation who is
adopting this tool because I know it's
actually growing in popularity quite a
bit
um so when you're thinking about your
database for your Intel team
um most of us work for companies that
are a hundred if not a thousand you know
or more people how do you all stay on
the same page right
um one of your analysts do you spend
them a lot of time to be smart and they
come up with a finding and you want to
say you know across your company you
want to take advantage of of that
insight and that analysis and that
knowledge so if you have 100 people in
your company how do you or a thousand or
more how do you keep everybody on the
same page
um and something like synapse a
technical database is great
um you can say pick an IPA address that
might be of interest maybe it's an IP
address that just came out in a
prominence uh blog or or something and
you have questions across the company
you can make this your single source of
Truth everybody across your company can
have the same visibility and the same
understanding as your smartest
intelligence analyst and I think that's
huge I think um especially when you have
multi multi multi-function teams you
might have some stock analysts you might
have some incident responders you really
want to have the same the same view of
the world right and again taking
advantage of the smart analysis that
you've done this is a way that you can
again keep keep everybody on the same
page
um another another thing I really like
about this particular technology is that
the the data model matches the real
world
um I think I think sometimes computers
are so complicated and you know we have
a lot of things that we need to keep
track of but they do have a physics to
them certain things talk to each other
in a certain way
um you know certain
certain things happen repeatedly you can
think of how how DNS IPS
uh and domains all relate to each other
that stays kind of the same and it's
really nice to have a data model that
you can just go to that matches that
real world because then if you know how
computers work you kind of know how the
data model works as well because they go
so closely together
um also something that maybe we don't
um
think about but we definitely should is
the idea that you have evidence and you
have analysis and those are not the same
thing and so when you're keeping track
of them you want to keep track of them
um in different ways and and make sure
that it's very clear and
allow it so that you could revisit your
assessment maybe you do make a mistake
um I think a lot of us don't like to
think about that if we make a mistake
but what if you make a mistake and you
want to back back out and redo your
analysis can you separate the two can
you separate what you know from what you
assessed
um in a very clear way
also um
one thing that I really enjoyed was The
Bletchley Park talk where they were
talking about the index files that you
have these index files that keep track
of everything and allow them to do
lookups I mean I think that you can
almost draw a line from The Bletchley
Park index files to this technology
because
it's the same thing like they had a
technology like maybe there was a weapon
system that they wanted to look up in
their files and so they had these
indexes that would allow them to do that
this is the same kind of thing like we
have
complicated questions that we're going
to ask of our databases and we
um computers are complicated right so
that makes our questions complicated
it's not always going to be
straightforward it's not always going to
be a keyword search I think most
platforms support a keyword search but
um can you do pivots and filters and a
whole bunch of complicated stuff along
the way to get answers to your most
complicated questions
I'm going to show an example in the next
slide um just to give people an idea of
what that can look like
um made by analysts for analysts you
just feel kind of in your happy place
when you're an analyst working with this
technology because you can tell that
they were really thinking of you and I
really appreciate that and I I think it
really comes through with the technology
um performant and scalable a lot of
Technologies when you're trying to keep
track of indicators do one-to-one
relationships
and has anybody ever run into the
127.0.0.1 problem when you're dealing
with database like that
um you can you can really start to have
to make what I would say are our
compromises when you when you model
things
um in certain Technologies but synapse
again I don't want to get too much under
the under the hood but the hypergraph
technology allows you to
um
allows you to what I would say is again
model things in a real world way that
makes sense that allows you to Pivot in
amazing ways
um also I think a lot of people
um have a lot of different vendors right
you might have
um call it five vendors and
when you're doing that analysis you know
you don't first of all you don't want to
go to five different uh platforms to
look up the same IP address or the same
domain you want to
um
really like if I if I'm asking about an
IP address I just want to ask about that
IP address I don't have to ask the same
question five different times
um
and
and also because
um you can integrate your vendor tools
with with this technology
um things like metrics become really
awesome you can actually see how often
am I using the data from the different
vendors and then you can search to do a
vendor assessment
um as far as how often you're actually
going to use that data to create
intelligence products which is a big fan
which I'm a big fan of
I like metrics
um and so this is just one example
um
I don't know about anybody in here but
if you've used the technology where you
have to like right click on something on
an indicator to look up more information
and you can you have to do that for
maybe 10 different indicators
um I love the fact that you can do many
to many pivots meaning show me all the
IP addresses that I've attributed to a
particular group
um then I want to Pivot across all those
DNX records to perhaps a different you
know a set of domains
um also you can do
what what are called subquery filters
which is something where you can
basically say I want to look for nodes
that are connected via some sort of an
edge to to other nodes or I want to
remove things or connected via an edge
to other nodes so you could say I'm
looking for DNS records but I just don't
want to see the ones that are connected
to to trivial indicators like
127.0.1 or maybe um eight that eight
that eight that eight so I just put one
example up here I don't want to go over
it too much but
um
you know let's say I want to start with
this domain that might be in a domain of
interest and then I want to Pivot to all
the DNS records
um specifically the dnsra records but
then
I'm I'm coming in in the morning I only
want to look at one day's worth of data
so I'm going to filter that down to just
the previous day between one day ago and
now go to the IP addresses and then
remove all the ones that I've already
found are associated with the threat
group that I'm researching which in this
case is apd28
because I already know about those I'm
looking for something new and then
basically I want to go to passive total
and pull in new records
um the syntax may look a little scary
but
um number one if you use it a lot it
becomes very second nature also
um you can create macros so for common
tasks and you don't want to have to keep
typing things repeatedly you can shorten
it and also that helps the uh
the new users to get over the learning
curve
and so again
um
because uh
I think I have some unique experiences
as far as setting up this technology I
just want to share some lessons learned
as far as like what it actually looks
like to deploy this technology at your
company
um and again also feel free to hang up
with uh more detailed questions because
I think probably a lot of people are
going to be in similar situations if
you're trying to set up a technology
like this and um also I'm just very
happy you know to to help
and it's also worth mentioning which um
Katie also mentioned the beginning
there's there's two versions there's an
open source version which is available
on GitHub and there's a Enterprise
version you can buy
um if you buy the Enterprise version it
will save you development time
um and it will also help smooth that
user experience
um but for the talk I'm going to be
talking about the open source
okay so you're all set you're going to
you've made the commitment and you've
decided you're going to move forward
with synapse
um
one of the first things to think about
is where is your data
um it's going to be somewhere right now
and um if you're like a lot of people
it's going to be an S3 it might be in a
postgres it might be in Dynamo it might
be in Snowflake
um
one of the first questions is what do
you bring into synapse um I like to
think of synapse the technology as it's
like the surface of your desk it is not
like the filing cabinet that you have
next to your deck
um when you are an analyst you're
looking at specific things
um in the course of your day and you're
not going to be looking at everything in
your filing cabinet you're going to be
having an active workspace in front of
you
um that you're working with and so
you know one of the questions is what do
you bring in
um
and one of the first questions is how
much data do you have
um I realize that that's a vague
question and and depending on your
organization
um you might view big differently but
um one one data source I've used in the
past is the virustotal feed which is
massive we're talking a million or two
million rows a day of data
um do you actually want to bring that
into your active workspace and again
keep in mind that you have your filing
cabinet and you have your desk in front
of you
um
throughout the course of the day you're
only going to be looking at a finite
number of ips or domains or or other
other indicators
um
and so really the question is can you
leave it where it is maybe it's going to
be a lot easier for you to set up an
integration between whatever your
intelligence platform is
um whether it's synapse or another
platform and and perhaps if you can
create an integration you can
um leave it where it is and then only
bring in information that's related to
what you're actively working on or your
active investigation
um
something to keep in mind there though
is you know again
um how quickly are you going to need it
um I kind of like
have a uh a thought with with certain
Technologies
um
where if you knew what you needed
yesterday like if you know what you're
gonna need today and you knew that
yesterday maybe you could use a certain
technology to store the data but if
you're analysts are going to be forming
real-time enrichments from another
database they need
um something that's going to return you
know I would say 30 seconds to a minute
right they can't be waiting there for 30
minutes for their query to return so how
quickly are they going to need it is it
something that's going to be blocking
their active investigation blocking
their workflow
um if it is then maybe you need it in
something like snowflake that's going to
respond much more much more quickly than
something like Athena
and like I said if you did know
yesterday what your analyst might be
working on today then maybe you can do
some pre-enrichments along the way you
can do some pre-lookups I'm essentially
bringing the data from uh yesterday's
alerts and have it all ready to go in
the morning that's kind of how we do it
at our company as we know that we're
going to be looking at the alerts from
the previous day so you can actually say
okay I'm just going to bring in all of
the the relevant enrichments for the set
of data that I know I'm going to be
working on tomorrow
um for those of you who have ever looked
at the synapse documentation um there's
something like 400 different node types
which is awesome in the sense that
whatever type of intelligence work
you're going to be doing the data model
is probably going to support it but I
think that gets really overwhelming and
if you're like me and you go to The
Cheesecake Factory and you see that menu
and you're leafing through the and
you're leafing through the entire menu
like
I love a restaurant that has like 10
items you know give me like your 10 best
items I'm gonna pick one of those
um and I think with with synapse you
have to think of the same thing like on
the screen here I have an organization
node a log event which is essentially
think of as like an alert or a detection
um some IPS some domains and then
um some outside enrichment information I
mean that's really not that overwhelming
right and so you can start there all the
other options are still available to you
they're not you're not closing up any
paths by simplifying you're just really
going to focus on your use case and
what's most important for you at that
time
um and that's that's kind of how I tell
people to
to get introduced to the platform is to
start start simple and and like I said
um
whatever you end up doing whether it's
going to be host analysis or whether
you're going to be doing more network
analysis they've got you covered um
within the data model so you can you can
then at that point
um you know decide where you're gonna go
um and actually I'm going to call do a
call back to Chris Sanders talk at the
very beginning
um because he was talking about the most
efficient investigative paths and that
was really cool because at the end of
the day you're trying to save your
analyst time there's so much data to
look at every day and you really um
you really don't want them to have to do
anything
um manually twice you can do something
manually once and say okay you know that
like that happens if you have to do
something manually two times at that
point you want to start thinking about
how do we automate this how do we speed
this up how do we make it so that our
analysts can can move really fast I
mentioned macros sometimes you have a
workflow that you do repeatedly and it
might be fairly complicated
I I take a lot of those and I make them
into a short macro it reduces a command
down to maybe 20 characters and then I
don't have to you know repeat repeat
that every single time
um
and really you want your analysts to
have all the obstacles and hurdles
cleared out of their way
um so that they can just focus on what
their value-added aspect is which is
going to be that that analyst component
um
and so
this this tool is not just a database it
also has essentially an automation
engine built in so you can say
I'm going to set up some crons person
think that I need to happen at certain
times if you're like me and you have a
fairly limited virus total quota I'm
going to at the end of the day set up a
Cron job to use up all my code at the
end of the day
um so that I get the most value from my
uh my spend
also you have things like
indicator specific enrichments when an
IP address is added maybe you want to do
a passive lookup or a passive DNS lookup
or maybe when a domain is added you want
to try to pull in uh you know what files
might be connecting to that domain
there's there's the sky is the limit and
it's really going to come down to your
use cases but again
if because of the platform and and also
if you think about the difference
between your developers time and your
analyst time A lot of times your
analysts don't want to have to fill out
requests for development time if they
can just create an Automation in the
system themselves that's gonna that's
gonna be very efficient for them so
the things on the screen are things
where analysts can kind of take the
control into their own hands and not
have to fill out a development request
you know the jira ticket with
justifications things like that you you
you really empower the analysts by
giving them these these automation
engine capabilities uh themselves
um
when you when you think about the
knowledge of your organization and all
staying on the same page you have to
essentially
um make sure that when one person in
your organization says something and
another person in the organization says
something that they're speaking the same
language
um if your company attributes a specific
indicator to a threat group or a
specific malware family making sure that
it's going to be very clear
um through everybody working on the
system what exactly that means what the
confidence level might be what
what the language used is so
um I mentioned that there's a data model
within synapse and it's very
um
it's very robust but it actually does
not come with a tagging structure you
have to make that your own so you have
to come up with a taking structure you
can borrow the one that um the company
the vertex project uses who writes the
software or you can come up with your
own tagging structure and this is where
as an intelligence team and we've talked
about this throughout the past couple
days is you have requirements you have
outputs you have people who are asking
you for answers to specific questions
that's going to drive what your tagging
structure looks like
um data mappings this is like one of the
absolute best things about Synapse
um I think a lot of the best CTI
analysts that I've known are very very
um focused on normalizing
the different data sources and so if you
have
um an IP address in one database and
another database in another database
normalizing that so that they all look
the same when you bring them into your
your platform your your database and so
every single time we bring in a new data
source into synapse we do a data mapping
it's on a Wiki internally so we can make
sure that everything is mapped
appropriately and normalized
appropriately
and duplicates get merged and this is
how you get to that one node
um for one indicator concept where again
if I'm asking a question about a
specific IP address I want to see my
answer in one place not in 10 different
entries
um and then also another thing we do
um is just we we use
um get for keeping track of all the
different automations that we've created
within the within the tool they're
self-documented within the tool and you
can have them there but also just for
um Version Control and for communication
amongst different people on the team we
find it useful to have the code just
laid out there and tracking tracking
changes and things like that
and then finally output this is going to
be driven by your use case
um like I mentioned before I'm going
through a day's worth of alerts and
looking and seeing what I can find I
find it's useful to output a lot of the
relevant data to a CSV and then once I
find something of Interest I go back
into the platform to perform further
investigation
but you know your use case might vary
also again if you if you buy the
Enterprise version you can smooth your
experience because of their user
interface and some of the the
tools they have for outputting the data
also if you're supporting some sort of
stock or IR function you could think
about a chat bot we can essentially plug
into your synapse instance and respond
back with a really smart answer on
whatever's being asked
um and again I love this picture it's
one of my favorite pictures and I really
view you know
um synapse as being right in the middle
of the
of this data information intelligence
process you're
you're normalizing it you're processing
it and you're going to make it very
exploitable
um
I feel like once you do a lot of this
prep work to get the system modeled or
to get your data modeled in the system
um then it allows you as an analyst to
move really fast like I said
um so in summary uh I've covered a lot
of ground and I really want to
emphasize that please do come up and ask
questions because I think
um different organizations that find
themselves in the position where they're
trying to get going for the first time
um you might have a lot of questions
about how do you consider setting up
your databases and and Integrations
ingestions
um how would you set up your schema how
do you set up those analyst workflows
what does that actually look like
um and then I talked about documentation
which um if you know me that's just
something I'd love to talk about but I
don't know if everyone wants to hear me
talk about it and then thinking about
what your outputs from the system are
going to be
um I want to thank again everybody for
listening thank you for the other
speakers who have provided some really
awesome uh relate you know related
information to what I talked about I
love how this field ties together and we
keep talking about related things
hopefully um you found this this
technology piece interesting and uh yeah
thanks a ton
[Applause]
[Music]
thank you