💬 Join our first AMA on Threat detection and response

We’re excited to announce our upcoming Ask Me Anything (AMA) session on Threat Detection and Response, taking place on October 30th at 1.15pm.

During this live session, our panel of Advania experts will answer your questions on the topic directly.

This the dedicated thread to get involved early.

How to take part:

Post your questions for our experts in the comments below.
Feel free to upvote questions from others that you’d like to see answered.
We’ll collect the questions and address those live during the AMA, as well as any live questions we get.

Whether you’re looking to refine your organisation’s detection capabilities, overcome a specific challenge, or hear how others are building resilience, this is your chance to ask directly and learn from our experts.

🗓️ Haven’t RSVP’d yet? Click below to save your spot and get reminders before the event.

https://community.advania.co.uk/events/21

Thanks!!

Find more posts tagged with

AMA

Sign in to participate and unlock exclusive content 🔓

It looks like you're new here! Sign in or register to be able to comment, access member-only content and follow the spaces relevant to you.

Comments

RossKirk_Advania

When designing MSFT cloud services, embedding security from the start is essential to protect data, ensure compliance, and build resilient systems. What secure-by-design principles should be applied when architecting new MSFT cloud services?

RossKirk_Advania

As MSFT cloud environments evolve rapidly, maintaining a strong security posture requires continuous validation to ensure new changes do not introduce vulnerabilities. How should we continuously validate that our cloud architecture remains secure as it evolves?

Lorena Seco de Herrera Ortega

There's still time to join us tomorrow!

RSVP below if you haven't done it yet and come prepared with your questions - it should be a great discussion 😊

Advania Community - Threat detection and response AMA

Lorena Seco de Herrera Ortega

Our recent AMA on Threat Detection & Response sparked some excellent questions and our Cyber Security experts shared some great insights in return.

You’ll find all the Q&As below 👇

If there’s something you’d like to dive deeper into, or a question that came to mind after reading, add it in the comments. Let’s keep the conversation going - our experts are keeping an eye on the thread! 👀

@darrenhall @Anthony @dadarlington @Kamran Khan @Wayne_Medhurst @PaulB @Ben_Spencer @BradleyH @gemma @nbparrish @DigitalDave @jake_rains @JMC

Q: Why is threat detection important?

A: (From Julie) Threats are constantly evolving. It’s not just about having tools, but about building resilience being able to quickly detect, contain, and recover from incidents. A dedicated threat detection and response team provides continuous monitoring and helps eliminate blind spots by analysing data from multiple sources around the clock.

Q: Why not just deploy the latest anti-malware technology on your endpoints and servers and let it do its thing? Why bother with doing the full threat detection response?

A: (From @Alexandru Putnoki) As much as we'd like to think that anything configured out-of-the-box would be very useful most of the time it's not. Just because you would have a piece of technology that's just deployed doesn't mean that you'll have the actual response that you need. The service itself provides more of a process-based response on exactly what the tools would output. And of course, the tools also need to be configured properly, but out-of-the-box experience doesn't necessarily mean that the tool is being used in their full capabilities.

Q: What are key considerations when designing a threat detection and response architecture?

A: (From @RossKirk_Advania) Design should be industry-specific, a financial or healthcare company may not necessarily need what a manufacturing company may need from a governance perspective. It's also important to get coverage across all the attack surfaces (endpoints, identity, cloud, etc.) and visibility is crucial, especially as cloud environments shift the control plane. When it comes to data integration, what has initially been configured may not be fit for purpose six months down the line. Advanced telemetry along with the orchestration and automation will help to tweak that initial baseline. We need to balance what telemetry equals into Sentinel versus what stays there to optimise costs and performance for the customer.

Q: In an ideal situation, you'd want to ingest as much security telemetry as you can get your hands on to get complete visibility. How do you balance the coverage, performance and cost when you're planning your overall detection? What does strategy look like?

A: (From @RossKirk_Advania) I would start off ensuring that the coverage is as optimised as possible and then utilising the default options that Microsoft have available. You can then tweak it slightly for critical assets depending on what that may be based on the industry and then you can broaden the telemetry. What generally happens is that customers would delve into different tweaks and sometimes it's better off to start with that baseline and then scale it up where required just to make sure that everything's covered. So that all the visibility and coverage is met. From a costing perspective, again, use the Microsoft's built-in analytics and hunting queries before creating those custom rules that can then increase ingestion costs.

Q: How do you align detection and response with GRC (Governance, Risk, Compliance) frameworks?

A: (From @Pravesh Kara) The key lies in understanding the “R” and “C” in GRC, risk and compliance. When you know your risks and your organisation’s risk tolerance, that drives how strong your controls need to be. Detection and response are part of those controls. From a compliance point of view, compliance frameworks, regulations, laws, set a minimum baseline of control strength, and you can lean on that fact as well. That way you've got some material justification to advise and guide what your threat detection and response process should look like. Good practise and best practise are used too much these days, your approach needs to be aligned to you as an organisation. All businesses operate under some level of risk. The goal isn’t to eliminate it entirely, but to define how much risk is acceptable and align your detection and response processes accordingly. This balance ensures that security supports business objectives instead of opposing them.

(From @Tristan Watkins): These frameworks raise important questions. Does that mean that you must do exactly what's prescribed by the authority? No, because in many cases they've made that prescription without any awareness about who you are and what you can do. There's lots of reasons, say compatibility, usability or cost why you might not be able to adopt everything that they suggest.

The value lies in using these frameworks as a reference point to build a set of practical, justifiable controls tailored to your environment. To achieve these compliance objectives, detection and response really comes after that for me. We shouldn't create detection and response rules where there's a control that can solve the problem, if we can block something instead of having to detect, let's block it. I think the most important answer here is that there's a layer in between, which is your control set.

(From @Pravesh Kara): Ultimately, aligning detection and response with GRC is about attack surface management, reducing your exposure as much as possible while protecting the parts of your organisation that must remain open to the world. To help prioritise and refine what your threat detection response process should be, work out which threat groups are likely to attack you most. What is it that you have of value? Every business has assets that hold value, whether that’s data, brand reputation, infrastructure, or intellectual property.

Q: What role does MITRE ATT&CK mapping play in shaping detection strategy?

A: (From @RossKirk_Advania) We would take those business requirements and business policies and align them to certain control frameworks or reference standards such as kind of NIST and CIS. Using the MITRE ATT&CK framework ensures that the coverage of adversary tactics and techniques are covered, and that then leads nicely into any gap analysis that might be missed as part of the configuration and deployment, so you can then identify missing detections and prioritise that based on risk. It gives you that telemetry and visibility to know what needs to be done to ensure the security posture and then it gives you that continuous improvement.

Q: How do you apply the MITRE ATT&CK framework in practice?

A: (From @Alexandru Putnoki) So let's say we take an emergent threat. We try to break it up into the different tactics that are part of the MITRE framework and map them to available data sources throughout the kill chain.

(From @Tristan Watkins) I think it's worth reflecting on before MITRE existed and all we could do is try to keep pace with the threat landscape through whatever method made sense to us. Or we could certainly take guidance from the authorities like CIS and CSC, but they all articulated things in different ways. What this has given us is a common language and a rationalisation of the threat landscape that is incredibly useful to everything that we do. It's also much more adaptable than a compliance framework like CIS.

Q: What strategies work best for mapping NIST or ISO27001 controls into operational detection and response workflows?

A: (From @RossKirk_Advania) You would take the mapping based on the governance framework controls in the operational detection and response workflows. So the first step to that would be a control to use case mapping, breaking down each control based on the framework into specific detection use cases. We then define what compliance looks like operationally based on the business requirements. So, whether that's law collection, alerting, unauthorised access, anomaly detection, and then we would then integrate those controls into the scene or defender, XDR or the SOAR workflows. So, you would tag those alerts and playbooks with the control ID's and then use the SOAR to enforce policy-based responses and document and control effectiveness. Then off the back of that would be the metrics and evidence collection, design the telemetry to produce audit ready evidence, and then align the internal KPIs with the particular control objectives that are useful to the business.

On top of that there’s governance overlay, maintain a control matrix that maps each detection rule and responsibly playbook to its corresponding kind of GRC requirement and then basically the last part is just a continuous valuation. Regularly test detection, logic against control objectives and then maybe sometimes a bit of purple teaming or breach simulations. That’s from a detection perspective but before we even get to that stage, from a control perspective, we would put in the block, so it stops the detection before it even gets there.

Q: How do you handle cross-border data transfer challenges during incident response?

A: (From @Pravesh Kara) I think this comes down to understanding the governance that you're working under. There's personal data that might be included in log data, incident tickets and so on, and then there's sensitive information that might be pertinent to a particular organisation or even export controls about information for a given country that might factor into it. Understanding your compliance environment first, you can then use the technology to tailor exactly what data you need to transfer in and out. Sometimes it might not be achievable as it starts to get a bit pricey in that you might need to set up regional threat detection and response capabilities and then have knowledge sharing where that sensitive data isn't transferring across regions. Other times you’ll most likely be able to find a way to share just enough information to allow a threat actor to be contained or an incident response to be had off the back of that.

Q: What metrics or KPIs could you use to measure the effectiveness of threat detection and response capability?

A: (From Julie) When we look at direct detection and response services, it's a case of looking at what they are achieving in terms of the service that you're getting through and being provided. So how many incidents are being recognised? What actions are being taken on those? It's all around the reporting and the consistent conversation between you and the threat detection and response service. Timings as well, how much time is that saving you as an organisation in terms of resource skills etcetera? They’re things we need to consider when looking at the effectiveness of the threat detection and response services.

Q: How do you keep detection content up to date with the rapidly evolving threat landscape?

A: (From @Alexandru Putnoki) When it comes to the actual deployment of our detections, we have an automated platform for that, so content delivery and updates towards content that live in either the SIEM or in the defender environment is fully automatically managed. WIth this in mind, we'll deploy major changes into client environments fairly quickly, so content delivery is fast and efficient from that perspective. When it comes to the actual content that we develop, we have an internal threat hunting team and internal threat intelligence team. We work together with both of them.

The Threat Intelligence team offers security briefs every day. And then we sometimes build detections off the back of it, or we sometimes follow up with a hunt, checking client environments to see if any IOCs are present.

If the threat description already has available IOCs, we build detection rules automatically, and because we have the automated deployment system, the content is deployed relatively fast that the rule should be in the environment before the afternoon. So, we would have a meeting in the morning and before the afternoon you already have the detection put in place.

Q: One of the more proactive elements of threat detection and response is threat hunting. Do you mind just briefly explaining what that is and how we go about it?

A: (From @Alexandru Putnoki) It would usually depend on the threat intelligence input. The threat Intelligence team would look at threat news and IOCs that are present and then the threat hunting team would try to define a hypothesis and a lot of different searches and correlation data that would basically discover if that threat is present inside of a client’s environment.