Indicator wranglin’ – an approach to dynamically typing IOCs with poor data context

This presentation forms part of the CTA's Threat Intelligence Practitioners' Summit

Thursday 3 October 16:00 - 16:30, Small Talks room

Noah Dunn (Palo Alto Networks Unit 42)

The efficacy of an incident response organization relies on their ability to intake, process, and make use of swathes of data. When the key factor in these operations is speed, the indicators of compromise (IOCs) are the 'clues' that enable consultants to 'solve the mystery' of an incident or breach. By noticing patterns and determining a course of action to triage and remediate issues, incident response consultants provide answers and relief to an organization actively under attack. Due to the high-speed nature of this work, often IOCs that are recorded are done in a messy manner, laden with typos, errors, and mistypes. We propose a means to alleviate this issue which resolves data entry problems after the consultant’s work is finished.

Use of a dedicated Python pipeline for dynamic IOC ingestion and analysis constructed by our engineering team provides a two-fold solution that benefits both incident response and threat intelligence. Incident response avoids needing to perform data cleanup and can focus on taking notes. Threat intelligence can make use of accurate cleaned data in any follow-up investigations and research. Maximizing the amount of data we can intake and process accurately allows for a noticeable advantage in dealing with threat actors. The strategy provided here can operate outside of data-specific context, making it available to implement in any environment with raw text input.

Noah Dunn Noah Dunn is a software engineer turned cybersecurity professional turned cybersecurity engineer. He started his career working for GE Appliances building cloud security infrastructure and automation tooling for internal applications and resource management. From there, he moved into a cybersecurity research role for Northrop Grumman, performing code audits on large, distributed systems. He is employed currently by Palo Alto Networks, where he automates tooling for threat intelligence and consulting in order to make the jobs of his colleagues easier. He has earned several cybersecurity certifications including OSCP, GREM, and the DEF CON Offensive IoT Exploitation certification. In addition, he has several software certifications: AWS Developer Associate and Cloud Solutions Architect Associate. Noah is passionate about education around cybersecurity and software engineering, and he hopes to provide the same types of resources to the public that he has used as he has progressed so far in his career.

Back to VB2024 Programme page

Back to VB2024 conference page

Register for VB2024

Other VB2024 papers