Supercharge your SOC: 3 security playbook ideas with the Perch API

Security automation is all the rage these days, and for good reason. Repetitive, time-consuming tasks are not only a resource drain, but they can cause rather significant security gaps as well. These manual and repetitive tasks are prone to analyst error and carelessness but are also monotonous drudgery that can leave quality talent looking for more interesting jobs.

For most CISOs, turning to security automation and orchestration through the use of playbooks is becoming a step in the right direction. Automation is a powerful strategy to not only eliminate repetitive tasks, but can uncover threats and other issues that no human would have the time to discover manually.

In conversations with our customers, we’re seeing some innovative ideas being discussed. We’re really excited to see our customers leveraging the new Perch API into their automation and orchestration playbooks, due to the depth of community intel we have available. In this article, I wanted to highlight a few ideas to spark your imagination.

Backtesting IoC’s for Deeper Threat Correlation

Security shouldn’t operate in silos any longer. Unfortunately for many organizations, making decisions about threats based upon what others in their threat community are seeing is difficult if not impossible.

However with the power of Perch’s community data, the opportunities are boundless for integration of Perch into a security playbook. Let me illustrate just one single example. Imagine your organization receives an email from an unknown sender. You could build out a playbook that integrates Perch (among other tools!) into a set of actions.

Using the Perch API, a simple query could be made to determine the reputation of the sending IP in the email header. Data can quickly be extracted into metrics such as:

• Has this IP been reported by other security sharing communities before?
• How recently has this IP been reported as potentially malicious?
• Who else has seen this IP? Does it appear to be targeting a specific industry?
• How many different indicators have been published that contain this IP?

Hopefully by now I have you salivating at the mouth at the potential opportunities afforded by leveraging the Perch API into your playbooks. The results of this deep community data can be used to build out risk scores, response thresholds, and automated actions such as rule blocks and spam tags.

Automate the SOC Workflow

Any CISO worth their salt will tell you they prefer to leverage best of breed security tools as part of an overall security posture. Typically, however, this advantage comes with an agonizing tradeoff. Multiple tools must be individually managed and correlation and integration of data and alerts between tools is a complex challenge.

Perch was created by former security practitioners. We know firsthand that these are challenges Perch should help solve, not contribute to making worse. The Perch API can easily integrate into incident response (IR) systems to enrich its data and fill in gaps with Perch’s threat intelligence. It can help IR be orchestrated from a single unified platform, reducing analyst workload and correlation time.

Indicator Sharing: From Consumer to Producer

At any ISAC or ISAO conference, you’ll hear pleas for organizations of all sizes to begin the process of going from simply consuming threat intel to producing it. We are all in this fight together. When one organization shares intel about a threat they are seeing, countless other organizations may benefit from that intel as well.

While the philosophy is easy to explain, we’ve noticed the most significant challenge to being a producer of threat intel is committing to the time required. This is an element that can easily be automated by the Perch API.

Imagine an end user at your organization visits a compromised website that redirects web traffic to a known malicious host. However, because the website was recently compromised, there is no threat intel about the website itself, but only from the malware redirection. A security playbook could easily be written that uses the Perch API to publish a new indicator to your trusted threat sharing community (ISAC or ISAO) at nearly the same time the attack was detected or blocked. Being able to shut down an attack higher up the kill chain can be an effective way to shift pain back onto the bad guy by disrupting his attack infrastructure and give others an early warning against the threat.

Conclusion

These three ideas are just a few of many new and innovative ideas we’re having in discussions with our customers. To be sure, many more ideas will continue to flow out of these playbooks. What about you? What ideas do you have about leveraging Perch among your other tools and playbooks for security automation and orchestration? I want to hear from you!

We'd love to hear your thoughts. Find us on Twitter, LinkedIn or write in to hello@perchsecurity.com

Next: Customer Insights: John Nelson reacts to the HITRUST and American Medical Association Cyber Risk Announcement