From b1ef1c62130b72291bc967f1096599b3fe2aec7c Mon Sep 17 00:00:00 2001 From: anthrosepology <55689655+anthrosepology@users.noreply.github.com> Date: Wed, 4 Dec 2019 11:09:10 +0100 Subject: [PATCH] Update content.tex Moved some items to sub-bullets (nested bullets), fixed typos/grammar --- .../content.tex | 81 ++++++++++--------- 1 file changed, 43 insertions(+), 38 deletions(-) diff --git a/b.1-best-practices-in-threat-intelligence/content.tex b/b.1-best-practices-in-threat-intelligence/content.tex index fdc23f7..6c8ad04 100755 --- a/b.1-best-practices-in-threat-intelligence/content.tex +++ b/b.1-best-practices-in-threat-intelligence/content.tex @@ -8,21 +8,26 @@ \begin{frame} \frametitle{Objectives} \begin{itemize} - \item Learning how to use MISP to support common OSINT gathering use-cases as often used by SOC, CSIRTs and CERTs - \item By using a list of practical exercise\footnote{\url{https://gist.github.com/adulau/8c1de48060e259799d3397b83b0eec4f}} - \item The exercises are {\bf practical recent cases to model and structure intelligence} using the MISP standard - \item Improving the data models available in MISP by exchanging live improvements and ideas - \item Being able to share the results to the community at the end of this session + \item Learn how to use MISP to support common OSINT gathering use-cases often used by SOC, CSIRTs and CERTs + \begin{itemize} + \item Use practical exercise examples\footnote{\url{https://gist.github.com/adulau/8c1de48060e259799d3397b83b0eec4f}} + \item The exercises are based on {\bf practical recent cases to model and structure intelligence} using the MISP standard + \end{itemize} + \item Improve the data models available in MISP by exchanging live improvements and ideas + \item Be able to share the results to the community at the end of this session \end{itemize} \end{frame} \begin{frame} \frametitle{(Threat) Intelligence} \begin{itemize} - \item {\bf Cyber threat intelligence (CTI) is a vast concept} which includes different fields such as intelligence as defined in the military community or in the financial sector or the intelligence community - \item {\bf MISP project doesn't want to lock an organisation or an user into a specific model}. Each model is useful depending of the objectives from an organisation - \item A set of pre-defined knowledge base or data-models are available and organisation can select (or create) what they need - \item During this session, an overview of the most used taxonomies, galaxies and objects will be described + \item {\bf Cyber threat intelligence (CTI) is a vast concept} which includes different concepts, methods, and workflows + \begin{itemize} + \item Intelligence is defined differently in the military than in the financial sector than in the intelligence community + \end{itemize} + \item {\bf MISP project doesn't want to lock an organisation or a user into a specific model}. Each model is useful depending on the objectives of an organisation + \item A set of pre-defined knowledge base or data-models are available and organisations can select (or create) what they need + \item During this session, an overview of the most used taxonomies, galaxies, and objects will be described \end{itemize} \end{frame} @@ -35,37 +40,37 @@ \frametitle{Meta information and contextualisation 1/2} \begin{itemize} \item Quality of indicators/attributes are important but {\bf tagging and classification are also critical to ensure actionable information} - \item Tagging intelligence is done by using tags in MISP which are often originating from MISP taxonomy libraries - \item The scope can be classification ({\it tlp, PAP}), type ({\it osint, type, veris}), state ({\it workflow}), collaboration ({\it collaborative-intelligence}) and many other fields - \item MISP taxonomies documentation is available\footnote{\url{https://www.misp-project.org/taxonomies.html}} - \item {\bf Review existing practices of tagging in your sharing community, reuse practices and improve context} + \item Organizing intelligence is done in MISP by using tags, which often originate from MISP taxonomy libraries + \item The scope can be classification ({\it tlp, PAP}), type ({\it osint, type, veris}), state ({\it workflow}), collaboration ({\it collaborative-intelligence}), or many other fields + \item MISP taxonomy documentation is readily available\footnote{\url{https://www.misp-project.org/taxonomies.html}} + \item {\bf Review existing practices of tagging in your sharing community, reuse practices, and improve context} \end{itemize} \end{frame} \begin{frame} \frametitle{Meta information and contextualisation 2/2} \begin{itemize} - \item {\bf When information cannot be expressed in triple tags format} ({\it namespace:predicate=value}), MISP provides the galaxies - \item Galaxies contain a huge set of common libraries\footnote{\url{https://www.misp-project.org/galaxy.html}} such as threat actors, malicious tools, RAT, Ransomware, target information and many more - \item When tagging or adding a galaxy cluster, don't forget that tagging at event level is for the whole event (including attributes and objects). While tagging at attribute level, it's often a more specific context + \item {\bf When information cannot be expressed in triple tags format} ({\it namespace:predicate=value}), MISP use Galaxies + \item {\bf Galaxies} contain a huge set of common libraries\footnote{\url{https://www.misp-project.org/galaxy.html}} such as threat actors, malicious tools, tactics, target information, mitigations, and more + \item When tagging or adding a Galaxy cluster, tagging at the event level is for the whole event (including attributes and objects). Tagging at the attribute level is for a more specific context \end{itemize} \end{frame} \begin{frame} \frametitle{Estimative Probability} \begin{itemize} - \item {\bf Words of Estimative Probability}\footnote{\url{https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/books-and-monographs/sherman-kent-and-the-board-of-national-estimates-collected-essays/6words.html}} proposes clear wording while estimating probability of occurence from an event. - \item A MISP taxonomy called {\bf estimative-language}\footnote{\url{https://www.misp-project.org/taxonomies.html}} proposes an applied model to tag information. + \item {\bf Words of Estimative Probability}\footnote{\url{https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/books-and-monographs/sherman-kent-and-the-board-of-national-estimates-collected-essays/6words.html}} propose clear wording while estimating probability of occurence from an event + \item A MISP taxonomy called {\bf estimative-language}\footnote{\url{https://www.misp-project.org/taxonomies.html}} proposes an applied model to tag information in accordance with the concepts of Estimative Probability \end{itemize} \end{frame} \begin{frame} - \frametitle{Reliability, credibility and confidence} + \frametitle{Reliability, credibility, and confidence} \begin{itemize} - \item The {\bf Admiralty Scale}\footnote{\url{https://www.ijlter.org/index.php/ijlter/article/download/494/234}, {\it US Army Field Manual 2-22.3, 2006}} (also called the NATO System) is used to rank the reliability of a source and the credibility of an information - \item A MISP taxonomy called admiralty-scale\footnote{\url{https://www.misp-project.org/taxonomies.html}} - \item In {\bf JP 2-0, Joint Intelligence}\footnote{\url{http://www.jcs.mil/Portals/36/Documents/Doctrine/pubs/jp2\_0.pdf} page 114} (page 114) includes an appendix to express confidence in analytic judgments - \item A MISP predicate in estimative-language called confidence-in-analytic-judgment\footnote{\url{https://www.misp-project.org/taxonomies.html}} + \item The {\bf Admiralty Scale}\footnote{\url{https://www.ijlter.org/index.php/ijlter/article/download/494/234}, {\it US Army Field Manual 2-22.3, 2006}} (also called the {\bf NATO System}) is used to rank the reliability of a source and the credibility of information + \item A MISP taxonomy called admiralty-scale\footnote{\url{https://www.misp-project.org/taxonomies.html}} is available + \item US DoD {\bf JP 2-0, Joint Intelligence}\footnote{\url{http://www.jcs.mil/Portals/36/Documents/Doctrine/pubs/jp2\_0.pdf}, page 114} includes an appendix to express confidence in analytic judgments + \item A MISP predicate in estimative-language called confidence-in-analytic-judgment\footnote{\url{https://www.misp-project.org/taxonomies.html}} is available \end{itemize} \end{frame} @@ -75,17 +80,17 @@ \begin{itemize} \item If the information is a {\bf single atomic element}, using a single attribute is preferred \begin{itemize} - \item Choosing an attribute type is critical as this defines the automation/export rule (e.g. url versus link or ip-src/ip-dst?) - \item Enabling the IDS (automation) flag is also important. When you are in doubt, don't set the IDS flag + \item Choosing an attribute type is critical as this defines the automation/export rule (e.g. {\it url} versus {\it link} or ip-src/ip-dst?) + \item Enabling the IDS (automation) flag is also important, but {\it when you are in doubt}, don't set the IDS flag \end{itemize} - \item If the information is {\bf composite} (ip/port, filename/hash, bank account/BIC), using a object is strongly recommended + \item If the information is {\bf composite} (ip/port, filename/hash, bank account/BIC), using an object is strongly recommended \end{itemize} \end{frame} \begin{frame} \frametitle{How to select the right object?} - There are more than 150 MISP objects\footnote{\url{https://www.misp-project.org/objects.html}} templates.\\ + There are more than 150 MISP object\footnote{\url{https://www.misp-project.org/objects.html}} templates.\\ As an example, at CIRCL, we regularly use the following object templates {\it file}, {\it microblog}, {\it domain-ip}, {\it ip-port}, {\it coin-address}, {\it virustotal-report}, {\it paste}, {\it person}, {\it ail-leak}, {\it pe}, {\it pe-section}, {\it registry-key}.\\ \end{frame} @@ -93,12 +98,12 @@ \frametitle{microblog object} \begin{columns}[totalwidth=\textwidth] \column{0.49\textwidth}\underline{Use case}\\ -A serie of OSINT tweets from a security researcher. -To structure the thread, the information -and keep an history.\\ +A series of OSINT tweets from a security researcher. +To structure the thread, the information, +and keep a history.\\ \includegraphics[scale=0.15]{emotet.png} \column{0.49\textwidth}\underline{Object to use}\\ - The microblog object can be used for Tweet or any microblog post (e.g. Facebook). Then object can be linked using {\it followed-by} to describe a serie of post.\\ + The microblog object can be used for Tweets or any microblog post (e.g. Facebook). The object can be linked using {\it followed-by} to describe a series of post.\\ \includegraphics[scale=0.15]{microblog.png} \end{columns} \end{frame} @@ -109,9 +114,9 @@ and keep an history.\\ \begin{columns}[totalwidth=\textwidth] \column{0.49\textwidth}\underline{Use case}\\ \begin{itemize} - \item A file sample was received by email or extracted from VirusTotal. - \item A list of file hashes were included in a report. - \item A hash value was mentioned in a blog post. + \item A file sample was received by email or extracted from VirusTotal + \item A list of file hashes were included in a report + \item A hash value was mentioned in a blog post \end{itemize} \column{0.49\textwidth}\underline{Object to use}\\ The file object can be used to describe file. It's usual to have partial meta information such as a single hash and a filename.\\ @@ -122,10 +127,10 @@ and keep an history.\\ \begin{frame} \frametitle{References} \begin{itemize} - \item Graphical overview of OSINT collection using MISP \url{https://github.com/adulau/misp-osint-collection} - \item MISP objects documentation \url{https://www.misp-project.org/objects.html} - \item MISP taxonomies documentation \url{https://www.misp-project.org/taxonomies.html} - \item MISP galaxy documentation \url{https://www.misp-project.org/galaxy.html} + \item Graphical overview of OSINT collection using MISP \url{{\ithttps://github.com/adulau/misp-osint-collection}} + \item MISP objects documentation \url{{\ithttps://www.misp-project.org/objects.html}} + \item MISP taxonomies documentation \url{{\ithttps://www.misp-project.org/taxonomies.html}} + \item MISP galaxy documentation \url{{\ithttps://www.misp-project.org/galaxy.html}} \end{itemize} \end{frame}