Secure Meter XD - SecureX Orchestrator Hackaton

Secure Meter XD (written SMXD) is an automated private security intelligence framework to help automate internal observable judgements to improve alert fidelity and automated response inside of SecureX Orchestrator.

Use cases :

Give the ability to security analyst to respond manually to a threat based on internal observable disposition. Per example, before disabling a user in Cisco Secure Access by Duo the security analyst want to make sure more than 3 frauds authentication events has been received. (User observable = Suspicious)
Let's Cisco SecureX Orchestration respond automatically to a threat based on internal observable disposition. Per example, before put Cisco Secure Enpoint in isolation mode only after 5 security events from any Security events sources like Meraki SM, Cisco Secure Enpoint, ISE, Duo, etc. (hostname observable = Malicious)
Follow statistics on the numbers of internal observables in with a security risk over the time using the indicators feature of Cisco SecureX.

Supported Observable types

ip (with validation for RFC 1918 for private IP)
hostname
username
email (with validation for email with email domain from the organization)
amp_computer_guid
mac_address

Required workflows

SMXD - Raise Observable judgement
SMXD - Lower Observable judgement
SMXD - Exclude Observable

Variables to be modify in each workflows

Increment / Decrement
Expiration_in_days
email_domain

Required atomic actions

SMXD - Raise Risk Score v2
SMXD - Lower Risk Score v2
SMXD - Validate Observable Type
SMXD - Get Judgement and Score
SMXD - Create Judgement
Threat Reponse v2 - Generate Access Token

Getting Started

To start using SMXD in your SecureX environment, here are the steps:

Import all the generic atomic actions (https://ciscosecurity.github.io/sxo-05-security-workflows/configuration)
Add this Github repository to your list of Git repository in SXO
Import all the workflows and atomic actions from this Git repository

how to use it

Secure Meter XD can be use manually by clicking on "Exclude", "Raise" or "lower" workflows on the contextuel menu of SecureX.

Secure Meter XD can also be added to any existing workflow where internal observables are collected or identified. The "Increment" variable can be modified from 1 to 5 to represent the criticality of the security events for the identified internal observable. The "Expiration_in_Days" set the expiration time frame for CTIA Judgement at the creation.

If your existing workflow output Observables JSON, here who you can integrate SMXD.

Testing SMXD workflows

*SMXD - Unit Testing Workflow can be use to test the SMXD framework.

Optional report workflow

SMXD - Email Report Workflow can be use to generate and send by email a daily report
SMXD - SMXD - Get informations from indicators Atomic Action is required

Optional response workflow

At the end of each SMXD worflows an optional response workflow can be add to response to threat based on the disposition of the internal observable.

SMXD - Response actions based on disposition v2

Examples of Threat Responses

"SMXD - Response actions based on disposition v2" workflow is a very flexible and will run even if you do not have a subscription for some of theses Cisco response action.

The workflow come with pre-configured response actions:

Cisco Secure Cloud Analytics, add "IP" to IP watchlist

Cisco Secure Endpoint, move device to another group - isolate a device

Cisco Secure Access by Duo, move user to a Duo local group - disable a user

Microsoft Azure AD, add / remove user from group - Block sing in

Email notification and Cisco SecureX casebook

And it include section to add your own response action from a Third-party per example.

Required atomic actions for "SMXD - Response actions based on disposition v2"

Theses atomic actions are available from the Cisco SecureX Orchestration Github repo at https://github.com/CiscoSecurity/sxo-05-security-workflows/tree/Main/Atomics

SWC - Add to watchlist
AMP - Get Connector GUID
AMP - Get Group by Name
AMP - Move Computer to Group
Duo Admin - Get User
Duo Admin - Remove User from Group
Duo Admin - Add User to Group
Duo Admin - Block User by UserID
Azure Graph - Get Access Token
Azure Graph - Get User

Video

https://www.youtube.com/watch?v=asXN3m9fV5U

Additional information on Cisco SecureX Orchestration

https://ciscosecurity.github.io/sxo-05-security-workflows/

Comments and suggestions

Please send your comments and suggestions to Kevin (kcouderc@cisco.com) and Alexandre (aargeris@cisco.com)

Use Case

Secure Meter XD (written SMXD)

Automated private security intelligence framework to help automate internal observable judgements to improve alert fidelity and automated response inside of SecureX Orchestrator.

Some highlights of the use case:

Give the ability to security analyst to respond manually to a threat based on internal observable disposition. Per example, before disabling a user in Cisco Secure Access by Duo the security analyst want to make sure more than 3 frauds authentication events has been received. (User observable = Suspicious)* Track Access Device and Auth Device IP and or country mismatch (find anomalies that could indicate compromises);
Let's Cisco SecureX Orchestration respond automatically to a threat based on internal observable disposition. Per example, before put Cisco Secure Enpoint in isolation mode only after 5 security events from any Security events sources like Meraki SM, Cisco Secure Enpoint, ISE, Duo, etc. (hostname observable = Malicious)

Duo DevNet Microsite

For more information about Cisco SecureX, you can check out this DevNet site.

Links to DevNet Learning Labs

Check out the Learning Labs on DevNet:

Cisco SecureX labs