diff --git a/x.15-subtitles/MISP General Usage Training - Part 1 of 2.srt b/x.15-subtitles/MISP General Usage Training - Part 1 of 2.srt
new file mode 100644
index 0000000..f6efa11
--- /dev/null
+++ b/x.15-subtitles/MISP General Usage Training - Part 1 of 2.srt	
@@ -0,0 +1,20701 @@
+1
+00:00:00,880 --> 00:00:04,719
+and I'll pass over the mic all right
+
+2
+00:00:02,638 --> 00:00:07,278
+thank you
+
+3
+00:00:04,719 --> 00:00:09,599
+yeah great, good morning good afternoon
+
+4
+00:00:07,278 --> 00:00:12,719
+and even good evening for some of you
+
+5
+00:00:09,599 --> 00:00:14,879
+um so um i'm really glad and uh
+
+6
+00:00:12,718 --> 00:00:16,480
+we are glad to present about MISP today
+
+7
+00:00:14,880 --> 00:00:18,719
+and so it's a
+
+8
+00:00:16,480 --> 00:00:20,240
+double series of workshops so we start
+
+9
+00:00:18,719 --> 00:00:20,799
+with a workshop of the introduction and
+
+10
+00:00:20,239 --> 00:00:22,799
+we go
+
+11
+00:00:20,800 --> 00:00:23,839
+more deeper tomorrow in that second
+
+12
+00:00:22,800 --> 00:00:26,160
+workshop
+
+13
+00:00:23,839 --> 00:00:27,359
+um i'm alexander noah i do work for
+
+14
+00:00:26,160 --> 00:00:30,640
+CIRCL and
+
+15
+00:00:27,359 --> 00:00:34,800
+i work in the MISP {inaudible}
+
+16
+00:00:30,640 --> 00:00:37,520
+so today uh the agenda is the following
+
+17
+00:00:34,799 --> 00:00:38,78
+uh we will do a quick introduction to
+
+18
+00:00:37,520 --> 00:00:41,920
+MISP
+
+19
+00:00:38,79 --> 00:00:43,679
+a kind of of one-hour sessions with
+
+20
+00:00:41,920 --> 00:00:46,239
+all the detail about MISP and then a
+
+21
+00:00:43,679 --> 00:00:49,359
+more like kind of usage deep dive
+
+22
+00:00:46,238 --> 00:00:52,558
+of one hour where we do hands-on together
+
+23
+00:00:49,359 --> 00:00:55,519
+um for the logistic aspect um
+
+24
+00:00:52,558 --> 00:00:55,839
+in the chat room we will share with you
+
+25
+00:00:55,520 --> 00:00:57,520
+uh
+
+26
+00:00:55,840 --> 00:00:59,520
+all the details how to access the MISP
+
+27
+00:00:57,520 --> 00:01:00,399
+instance so during the sessions in the
+
+28
+00:00:59,520 --> 00:01:02,239
+workshop
+
+29
+00:01:00,399 --> 00:01:03,840
+you can connect to a dedicated MISP
+
+30
+00:01:02,238 --> 00:01:05,840
+system that we set up for you
+
+31
+00:01:03,840 --> 00:01:07,680
+and this one will be used for all the
+
+32
+00:01:05,840 --> 00:01:10,79
+hands-on that we will
+
+33
+00:01:07,680 --> 00:01:12,240
+we do as i just mentioned we have a
+
+34
+00:01:10,79 --> 00:01:14,158
+small short break of 15 minutes
+
+35
+00:01:12,239 --> 00:01:15,679
+and then we will continue in the end
+
+36
+00:01:14,159 --> 00:01:18,960
+{inaudible}
+
+37
+00:01:15,680 --> 00:01:20,880
+depending of how far we are today uh
+
+38
+00:01:18,959 --> 00:01:22,959
+we will maybe talk about the community
+
+39
+00:01:20,879 --> 00:01:24,719
+building aspect but this is a topic for
+
+40
+00:01:22,959 --> 00:01:26,239
+tomorrow obviously
+
+41
+00:01:24,719 --> 00:01:28,640
+but if we have some time remaining we
+
+42
+00:01:26,239 --> 00:01:29,280
+might uh talk about this and then we
+
+43
+00:01:28,640 --> 00:01:31,920
+have a
+
+44
+00:01:29,280 --> 00:01:33,280
+q&a sessions uh to discuss about the
+
+45
+00:01:31,920 --> 00:01:35,359
+different {inaudible} and so on
+
+46
+00:01:33,280 --> 00:01:37,439
+so don't hesitate to to put your
+
+47
+00:01:35,359 --> 00:01:39,438
+question to zoom
+
+48
+00:01:37,438 --> 00:01:42,319
+uh directly and we will try to answer live
+
+50
+00:01:40,799 --> 00:01:45,600
+all those questions that you are asking  
+
+51
+00:01:42,319 --> 00:01:45,599
+during uh during this session
+
+52
+00:01:46,319 --> 00:01:50,239
+so first of all welcome all as well from
+
+53
+00:01:48,478 --> 00:01:53,519
+me so i'm Andras Iklody i'm
+
+54
+00:01:50,239 --> 00:01:56,798
+also working at CIRCL working on MISP
+
+55
+00:01:53,519 --> 00:01:57,280
+um to just kick things off um i think
+
+56
+00:01:56,799 --> 00:01:58,719
+it's a good
+
+57
+00:01:57,280 --> 00:02:00,79
+good moment to start a little bit about
+
+58
+00:01:58,718 --> 00:02:02,78
+the history of how this whole thing
+
+59
+00:02:00,78 --> 00:02:04,879
+started how MISP came about
+
+60
+00:02:02,78 --> 00:02:06,839
+so just a quick introduction of where we
+
+61
+00:02:04,879 --> 00:02:09,519
+came from and where where we are
+
+62
+00:02:06,840 --> 00:02:10,399
+nowadays uh initially this whole thing
+
+63
+00:02:09,520 --> 00:02:13,520
+for us with MISP
+
+64
+00:02:10,399 --> 00:02:14,959
+started as part of a of a series of
+
+65
+00:02:13,520 --> 00:02:17,360
+incidents that we had in
+
+66
+00:02:14,959 --> 00:02:19,759
+back in 2012 between national and
+
+67
+00:02:17,360 --> 00:02:22,480
+military CSIRTS at the time
+
+68
+00:02:19,759 --> 00:02:24,799
+where we were basically investigating umattacks
+
+70
+00:02:23,520 --> 00:02:27,120
+that were hitting several of the
+
+71
+00:02:24,800 --> 00:02:28,319
+institutions at the at the time
+
+72
+00:02:27,120 --> 00:02:30,400
+and one of the interesting things that
+
+73
+00:02:28,318 --> 00:02:31,759
+we found was that even though we had
+
+74
+00:02:30,400 --> 00:02:33,519
+something called the malware analysis
+
+75
+00:02:31,759 --> 00:02:35,120
+working group which was this which is a
+
+76
+00:02:33,519 --> 00:02:37,360
+group that was regularly meeting and
+
+77
+00:02:35,120 --> 00:02:39,680
+discussing ongoing incidents
+
+78
+00:02:37,360 --> 00:02:40,720
+we still had a massive gap in between
+
+79
+00:02:39,680 --> 00:02:42,80
+those meetings
+
+80
+00:02:40,719 --> 00:02:44,318
+where everyone was working in their own
+
+81
+00:02:42,80 --> 00:02:45,920
+silo on basically the same attack and
+
+82
+00:02:44,318 --> 00:02:47,759
+and doing reverse engineering of the
+
+83
+00:02:45,919 --> 00:02:50,0
+165.92 --> 170
+same attacks without
+
+84
+00:02:47,759 --> 00:02:53,439
+having the ways, the means or the processes
+
+86
+00:02:51,120 --> 00:02:55,39
+to directly share with our peers so we
+
+87
+00:02:53,439 --> 00:02:55,919
+ended up with a lot of duplication of
+
+88
+00:02:55,39 --> 00:02:57,759
+work which ended
+
+89
+00:02:55,919 --> 00:02:59,199
+which was obviously frustrating from uh
+
+90
+00:02:57,759 --> 00:03:01,439
+for many of us
+
+91
+00:02:59,199 --> 00:03:03,598
+so Christophe Vandeplas at the time he
+
+92
+00:03:01,439 --> 00:03:06,318
+was working at the belgian
+
+93
+00:03:03,598 --> 00:03:08,399  
+ministry of defense um in his free time
+
+94
+00:03:06,318 --> 00:03:10,318
+wrote a platform called {inaudible}
+
+95
+00:03:08,400 --> 00:03:11,519
+that later on ended up becoming MISP so
+
+96
+00:03:10,318 --> 00:03:13,280
+the initial idea was
+
+97
+00:03:11,519 --> 00:03:14,800
+really for reverse engineers to share
+
+98
+00:03:13,280 --> 00:03:15,439
+the output of their work directly with
+
+99
+00:03:14,800 --> 00:03:18,719
+their peers
+
+100
+00:03:15,439 --> 00:03:22,158
+in a hosted platform and since then
+
+101
+00:03:18,719 --> 00:03:24,158
+obviously MISP has evolved and changed
+
+102
+00:03:22,158 --> 00:03:25,840
+the scope of what we were nowadays doing
+
+103
+00:03:24,158 --> 00:03:26,798
+with MISP and what sort of information
+
+104
+00:03:25,840 --> 00:03:28,640
+we're sharing
+
+105
+00:03:26,799 --> 00:03:30,159
+but it all started with this and since
+
+106
+00:03:28,639 --> 00:03:30,878
+then it has been an ongoing effort
+
+107
+00:03:30,158 --> 00:03:33,199
+basically by
+
+108
+00:03:30,878 --> 00:03:35,199
+a large community of different
+
+109
+00:03:33,199 --> 00:03:37,359
+requirements and different needs
+
+110
+00:03:35,199 --> 00:03:39,359
+and that has been building both the
+
+111
+00:03:37,360 --> 00:03:42,159
+ideas that go into MISP as well as the
+
+112
+00:03:39,360 --> 00:03:42,159
+software itself
+
+113
+00:03:43,919 --> 00:03:47,839
+next slide please
+
+114
+00:03:48,479 --> 00:03:51,919
+yeah so what is the background and why
+
+115
+00:03:51,199 --> 00:03:53,839
+we are doing
+
+116
+00:03:51,919 --> 00:03:56,79
+MISP it uh i think like Andras
+
+117
+00:03:53,840 --> 00:03:56,640
+mentioned it started from a with a kind
+
+118
+00:03:56,80 --> 00:03:59,40
+of
+
+119
+00:03:56,639 --> 00:04:00,479
+{inaudible} project for a small set of
+
+120
+00:03:59,39 --> 00:04:03,598
+CIRCL
+
+121
+00:04:00,479 --> 00:04:04,959
+CIRCL is nowadays
+
+122
+00:04:03,598 --> 00:04:07,359
+the CERT for the private sector, the
+
+123
+00:04:04,959 --> 00:04:08,959
+community {inaudible} in luxembourg
+
+124
+00:04:07,360 --> 00:04:11,200
+and we basically deal with the
+
+125
+00:04:08,959 --> 00:04:12,158
+development of MISP not only for our use
+
+126
+00:04:11,199 --> 00:04:15,359
+case but for many
+
+127
+00:04:12,158 --> 00:04:18,319
+different users so we are called as
+
+128
+00:04:15,360 --> 00:04:19,439
+a CERT we basically operate the
+
+129
+00:04:18,319 --> 00:04:22,478
+development and we operate
+
+130
+00:04:19,439 --> 00:04:22,478
+{inaudible} communities
+
+131
+00:04:23,600 --> 00:04:26,960
+so a little bit about our involvement
+
+132
+00:04:26,639 --> 00:04:28,478
+and
+
+133
+00:04:26,959 --> 00:04:30,79
+why we're doing this in the first place
+
+134
+00:04:28,478 --> 00:04:32,560
+so we as CIRCL we're funded by the
+
+135
+00:04:30,79 --> 00:04:35,680
+Ministry of Economy to basically build
+
+136
+00:04:32,560 --> 00:04:37,600
+security for the private sector uh and a
+
+137
+00:04:35,680 --> 00:04:39,199
+lot of what we do involves uh open
+
+138
+00:04:37,600 --> 00:04:39,840
+source software development so we're
+
+139
+00:04:39,199 --> 00:04:42,160
+basically
+
+140
+00:04:39,839 --> 00:04:44,79
+the funding that we get for the uh for
+
+141
+00:04:42,160 --> 00:04:45,199
+activities also cover our development
+
+142
+00:04:44,79 --> 00:04:47,918
+focus
+
+143
+00:04:45,199 --> 00:04:49,360
+we're also uh besides just building the
+
+144
+00:04:47,918 --> 00:04:50,159
+tools like {inaudible} mentioned we're
+
+145
+00:04:49,360 --> 00:04:52,479
+also
+
+146
+00:04:50,160 --> 00:04:53,919
+basically involved in a lot of sharing
+
+147
+00:04:52,478 --> 00:04:55,839
+activities as well as our day-to-day
+
+148
+00:04:53,918 --> 00:04:58,399
+operations we're users of the
+
+149
+00:04:55,839 --> 00:05:00,478
+tool primarily as well we basically host
+
+150
+00:04:58,399 --> 00:05:02,719
+a bunch of different communities for the
+
+151
+00:05:00,478 --> 00:05:05,439
+uh national C-Certs for the
+
+152
+00:05:02,720 --> 00:05:07,919
+luxembourgish private sector community
+
+153
+00:05:05,439 --> 00:05:09,680
+for law enforcement uh organizations
+
+154
+00:05:07,918 --> 00:05:10,959
+financial institutions and so on and so
+
+155
+00:05:09,680 --> 00:05:14,319
+forth
+
+156
+00:05:10,959 --> 00:05:16,239
+so so we're kind of uh
+
+157
+00:05:14,319 --> 00:05:18,240
+in the game on both sides so to say that
+
+158
+00:05:16,240 --> 00:05:21,120
+both as a
+
+159
+00:05:18,240 --> 00:05:22,0
+318.24 --> 322
+producer and as a consumer, also and the
+
+160
+00:05:21,120 --> 00:05:24,79
+project was
+
+161
+00:05:22,0 --> 00:05:25,759
+322 --> 325.759
+co-financed by the European Union
+
+162
+00:05:24,79 --> 00:05:29,120
+under the CEF project
+
+163
+00:05:25,759 --> 00:05:30,400
+uh so this is also one of the sources of
+
+164
+00:05:29,120 --> 00:05:33,120
+the income that we got basically to
+
+165
+00:05:30,399 --> 00:05:34,560
+build the tool and as a FIRST member you
+
+166
+00:05:33,120 --> 00:05:36,79
+have access to a MISP instance that is
+
+167
+00:05:34,560 --> 00:05:38,478
+operated and
+
+168
+00:05:36,79 --> 00:05:40,0
+336.08 --> 340
+co-maintained by FIRST and CIRCL that
+
+169
+00:05:38,478 --> 00:05:41,680
+you can get access to
+
+170
+00:05:40,0 --> 00:05:43,519
+340 --> 343.52
+so you just need to to use your
+
+171
+00:05:41,680 --> 00:05:45,680
+traditional credential or
+
+172
+00:05:43,519 --> 00:05:47,359
+access at first and you get access to
+
+173
+00:05:45,680 --> 00:05:49,600
+this instance with information
+
+174
+00:05:47,360 --> 00:05:51,439
+that you can use and so on we will talk
+
+175
+00:05:49,600 --> 00:05:54,160
+about that later on
+
+176
+00:05:51,439 --> 00:05:55,600
+so the main question and i think it's
+
+177
+00:05:54,160 --> 00:05:58,80
+coming from this story uh
+
+178
+00:05:55,600 --> 00:05:59,600
+as Andras mentioned from the early days
+
+179
+00:05:58,79 --> 00:06:01,758
+MISP was
+
+180
+00:05:59,600 --> 00:06:03,840
+focusing from a very specific aspect
+
+181
+00:06:01,759 --> 00:06:07,120
+which was malware reversing and so on
+
+182
+00:06:03,839 --> 00:06:08,799
+nowadays it's a threat intelligence sharing platforms we
+
+183
+00:06:07,120 --> 00:06:11,38
+are basically sharing any kind of
+
+184
+00:06:08,800 --> 00:06:13,38
+intelligence through uh through MISP
+
+185
+00:06:11,38 --> 00:06:14,478
+um because we had an evolution of the
+
+186
+00:06:13,38 --> 00:06:16,399
+time for the different things so
+
+187
+00:06:14,478 --> 00:06:18,879
+and our main goals and that's very
+
+188
+00:06:16,399 --> 00:06:21,439
+important for us it's an open source
+
+189
+00:06:18,879 --> 00:06:23,120
+software so that means MISP will always
+
+190
+00:06:21,439 --> 00:06:23,519
+remain an open source project we even
+
+191
+00:06:23,120 --> 00:06:26,0
+383.12 --> 386
+take
+
+192
+00:06:23,519 --> 00:06:26,879
+some decisions within the project to
+
+193
+00:06:26,0 --> 00:06:29,120
+386 --> 389.12
+keep it as
+
+194
+00:06:26,879 --> 00:06:30,639
+open source and that's that's really a
+
+195
+00:06:29,120 --> 00:06:32,720
+key for us so it's really uh
+
+196
+00:06:30,639 --> 00:06:34,800
+something that you can download yourself
+
+197
+00:06:32,720 --> 00:06:37,39
+run on your infrastructure and so on
+
+198
+00:06:34,800 --> 00:06:38,240
+you can really have the full control on
+
+199
+00:06:37,38 --> 00:06:40,639
+the software stack
+
+200
+00:06:38,240 --> 00:06:42,0
+398.24 --> 402
+when you are using MISP and one of the
+
+201
+00:06:40,639 --> 00:06:43,38
+goals of the software itself is to
+
+202
+00:06:42,0 --> 00:06:46,240
+402 --> 406.24
+collect information
+
+203
+00:06:43,38 --> 00:06:48,159
+from other partners, from in the {inaudible}
+
+204
+00:06:46,240 --> 00:06:49,280
+from automatic tools from different
+
+205
+00:06:48,160 --> 00:06:50,800
+fields and so on
+
+206
+00:06:49,279 --> 00:06:53,198
+that was really one of the initial goal
+
+207
+00:06:50,800 --> 00:06:55,680
+of MISP is like being able to collect
+
+208
+00:06:53,199 --> 00:06:57,360
+to get all this information into
+
+209
+00:06:55,680 --> 00:06:59,38
+one place
+
+210
+00:06:57,360 --> 00:07:00,560
+and then afterwards what you can do with
+
+211
+00:06:59,38 --> 00:07:02,719
+it is to normalize
+
+212
+00:07:00,560 --> 00:07:03,839
+correlate this information, extend the
+
+213
+00:07:02,720 --> 00:07:06,560
+information and enrich
+
+214
+00:07:03,839 --> 00:07:08,879
+information with more information and then
+
+216
+00:07:07,199 --> 00:07:10,800
+really benefit from the sharing aspect
+
+217
+00:07:08,879 --> 00:07:13,120
+of MISP and you can allow
+
+218
+00:07:10,800 --> 00:07:13,840
+teams and community to collaborate
+
+219
+00:07:13,120 --> 00:07:16,478
+and we have
+
+220
+00:07:13,839 --> 00:07:18,318
+seen MISP for example use not only
+
+221
+00:07:16,478 --> 00:07:20,159
+within different organizations but even
+
+222
+00:07:18,319 --> 00:07:21,759
+within a single organization you can, for
+
+223
+00:07:20,160 --> 00:07:24,240
+example run multiple MISP
+
+224
+00:07:21,759 --> 00:07:25,120
+to collaborate directly on different
+
+225
+00:07:24,240 --> 00:07:28,79
+investigations
+
+226
+00:07:25,120 --> 00:07:29,519
+incidents and cases and obviously when
+
+227
+00:07:28,79 --> 00:07:31,279
+you have all this information and all
+
+228
+00:07:29,519 --> 00:07:33,758
+these analytic platform into MISP
+
+229
+00:07:31,279 --> 00:07:34,638
+you are ready to use this information to
+
+230
+00:07:33,759 --> 00:07:36,960
+for example
+
+231
+00:07:34,639 --> 00:07:39,840
+feed your automatic protective tools
+
+232
+00:07:36,959 --> 00:07:42,0
+456.96 --> 462
+like intrusion detection systems,
+
+233
+00:07:39,839 --> 00:07:43,279
+firewalls whatever and to feed
+
+234
+00:07:42,0 --> 00:07:45,598
+462 --> 465.599
+automatically those
+
+235
+00:07:43,279 --> 00:07:46,799
+information to basically make protective
+
+236
+00:07:45,598 --> 00:07:50,319
+measures
+
+237
+00:07:46,800 --> 00:07:50,319
+in your environment
+
+238
+00:07:51,199 --> 00:07:55,840
+so, start from the starting point that we
+
+239
+00:07:54,478 --> 00:07:57,680
+already mentioned basically how we
+
+240
+00:07:55,839 --> 00:08:00,638
+started out with MISP
+
+241
+00:07:57,680 --> 00:08:02,800
+let's have a quick look at how uh the
+
+242
+00:08:00,639 --> 00:08:04,400
+user base of MISP evolved in terms of
+
+243
+00:08:02,800 --> 00:08:06,0
+482.8 --> 486
+the different types of stakeholders
+
+244
+00:08:04,399 --> 00:08:08,560
+within our own organizations and other organizations
+
+246
+00:08:07,120 --> 00:08:10,319
+the reason for that is obviously that
+
+247
+00:08:08,560 --> 00:08:12,560
+this drives the development process as well
+
+249
+00:08:10,800 --> 00:08:14,400
+so the way MISP grows over time really
+
+250
+00:08:12,560 --> 00:08:14,800
+depends on the type of users that are using
+
+252
+00:08:16,478 --> 00:08:18,319
+the type of users that are requesting new
+
+253
+00:08:16,478 --> 00:08:20,159
+features or that are providing pull
+
+254
+00:08:18,319 --> 00:08:22,639
+requests on the project and providing code
+
+256
+00:08:20,720 --> 00:08:23,759
+for the project so i said before
+
+257
+00:08:22,639 --> 00:08:26,160
+initially
+
+258
+00:08:23,759 --> 00:08:27,759
+the scope of MISP was very limited it
+
+259
+00:08:26,160 --> 00:08:29,360
+was basically just the output of malware
+
+260
+00:08:27,759 --> 00:08:31,199
+reversers which meant
+
+261
+00:08:29,360 --> 00:08:32,479
+raw indicators that we were extracting
+
+262
+00:08:31,199 --> 00:08:34,560
+during the process and that we're
+
+263
+00:08:32,479 --> 00:08:36,639
+sharing directly
+
+264
+00:08:34,559 --> 00:08:38,79
+with our partners, this meant very little
+
+265
+00:08:36,639 --> 00:08:39,519
+analysis was done on each of these
+
+266
+00:08:38,80 --> 00:08:41,599
+individual indicators there was very
+
+267
+00:08:39,519 --> 00:08:43,440
+little information in terms of
+
+268
+00:08:41,599 --> 00:08:45,200
+of why those data points are relevant in
+
+269
+00:08:43,440 --> 00:08:47,360
+the long term how they are meant to be used
+
+271
+00:08:45,759 --> 00:08:49,519
+from detection perspective they were
+
+272
+00:08:47,360 --> 00:08:52,480
+really just the raw output
+
+273
+00:08:49,519 --> 00:08:54,0
+529.519 --> 534
+from the analysis process or the
+
+274
+00:08:52,480 --> 00:08:56,80
+reversing process
+
+275
+00:08:54,0 --> 00:08:57,519
+534 --> 537.519
+now one of the side effects of this when
+
+276
+00:08:56,80 --> 00:08:59,440
+you start building a collection within
+
+277
+00:08:57,519 --> 00:09:01,360
+your organization of this information
+
+278
+00:08:59,440 --> 00:09:02,880
+the security analysts are feeding your
+
+279
+00:09:01,360 --> 00:09:04,320
+various protective tools become
+
+280
+00:09:02,879 --> 00:09:05,838
+interested in that data set
+
+281
+00:09:04,320 --> 00:09:08,0
+544.32 --> 548
+because obviously whatever is targeting
+
+282
+00:09:05,839 --> 00:09:10,160
+your organization or your direct peers
+
+283
+00:09:08,0 --> 00:09:11,360
+548 --> 551.36
+are probably the most relevant piece of
+
+284
+00:09:10,159 --> 00:09:13,39
+information that you can use for
+
+285
+00:09:11,360 --> 00:09:16,159
+detection
+
+286
+00:09:13,39 --> 00:09:19,39
+so one of the first steps that we opened
+
+288
+00:09:16,958 --> 00:09:20,479
+up to was basically involving our own
+
+289
+00:09:19,39 --> 00:09:23,278
+security analyst with our
+
+290
+00:09:20,480 --> 00:09:24,320
+own organizations so they can hook
+
+291
+00:09:23,278 --> 00:09:27,360
+the output of
+
+292
+00:09:24,320 --> 00:09:30,80
+of the reverse engineering team
+
+293
+00:09:27,360 --> 00:09:31,360
+up to their SIEMs to their IDSs to
+
+294
+00:09:30,80 --> 00:09:33,360
+their firewalls
+
+295
+00:09:31,360 --> 00:09:35,440
+and to feed this data directly into
+
+296
+00:09:33,360 --> 00:09:36,720
+their protective measures
+
+297
+00:09:35,440 --> 00:09:38,720
+now one of the interesting things when
+
+298
+00:09:36,720 --> 00:09:40,800
+you start doing that though is that you
+
+299
+00:09:38,720 --> 00:09:42,560
+generate a new type of output which is
+
+300
+00:09:40,799 --> 00:09:44,559
+timeliness for the data, freshness for
+
+301
+00:09:42,559 --> 00:09:45,838
+the data as well as feedback on how
+
+302
+00:09:44,559 --> 00:09:47,838
+useful the data was
+
+303
+00:09:45,839 --> 00:09:50,240
+so we're very often when you're
+
+304
+00:09:47,839 --> 00:09:53,40
+extracting information
+
+305
+00:09:50,240 --> 00:09:55,360
+by sandboxing for example a lot of the
+
+306
+00:09:53,39 --> 00:09:57,679
+data generated will be noise in the end
+
+307
+00:09:55,360 --> 00:09:59,759
+and this noise will generate false
+
+308
+00:09:57,679 --> 00:10:02,159
+positive alerts for example
+
+309
+00:09:59,759 --> 00:10:04,319
+in your detection tools. Now feeding this
+
+310
+00:10:02,159 --> 00:10:06,559
+information back
+
+311
+00:10:04,320 --> 00:10:10,559
+to data gave it a whole new type of value
+
+313
+00:10:07,519 --> 00:10:12,159
+we had freshness so if an older
+
+314
+00:10:10,559 --> 00:10:14,159
+indicator was reused
+
+315
+00:10:12,159 --> 00:10:15,439
+over time we saw that that is still
+
+316
+00:10:14,159 --> 00:10:18,160
+something that is actively to be monitored
+
+318
+00:10:16,559 --> 00:10:19,838
+and if we saw that something turned out
+
+319
+00:10:18,159 --> 00:10:21,199
+to be a cleaned up host
+
+320
+00:10:19,839 --> 00:10:23,440
+in the meanwhile or something was a
+
+321
+00:10:21,200 --> 00:10:25,200
+false positive from the get-go
+
+322
+00:10:23,440 --> 00:10:28,399
+we could feed that information back as well
+
+324
+00:10:27,399 --> 00:10:31,759
+so suddenly once you have timeliness as
+
+325
+00:10:28,399 --> 00:10:33,759
+well as the the raw data itself
+
+326
+00:10:31,759 --> 00:10:35,278
+you get the intelligence analyst
+
+327
+00:10:33,759 --> 00:10:36,399
+interested that are tracking the
+
+328
+00:10:35,278 --> 00:10:42,0
+movements and the changes of how attackers operate
+
+330
+00:10:39,519 --> 00:10:42,639
+uh over time so that means that usually
+
+332
+00:10:45,360 --> 00:10:47,199
+back then especially in 2012 in most of our
+
+333
+00:10:45,360 --> 00:10:48,560
+organizations the people that are doing
+
+334
+00:10:47,200 --> 00:10:50,560
+intelligence and the people that were
+
+335
+00:10:48,559 --> 00:10:52,239
+doing operations and security for the
+
+336
+00:10:50,559 --> 00:10:55,680
+operations were usually working in their own silos
+
+338
+00:10:53,440 --> 00:10:57,40
+so while there was obviously interaction
+
+339
+00:10:55,679 --> 00:10:58,958
+between the teams, it was not as
+
+340
+00:10:57,39 --> 00:11:01,919
+ingrained to work together
+
+341
+00:10:58,958 --> 00:11:03,599
+between those type of roles but this
+
+342
+00:11:01,919 --> 00:11:04,0
+661.92 --> 664
+changed over time and one of the changes
+
+344
+00:11:04,0 --> 00:11:08,78
+664 --> 668.079
+that we saw happened was that the output
+
+345
+00:11:06,240 --> 00:11:10,240
+of what the security analysts
+
+346
+00:11:08,78 --> 00:11:12,159
+and the reversers and the analysts were
+
+347
+00:11:10,240 --> 00:11:14,480
+outputting basically from the operation side
+
+349
+00:11:12,879 --> 00:11:16,399
+became more and more interesting for the
+
+350
+00:11:14,480 --> 00:11:17,839
+intelligence analysts that meant that
+
+351
+00:11:16,399 --> 00:11:19,919
+if they were tracking a certain threat
+
+352
+00:11:17,839 --> 00:11:21,600
+actor and they could attribute certain
+
+353
+00:11:19,919 --> 00:11:23,439
+actions that they were seen in the
+
+354
+00:11:21,600 --> 00:11:25,519
+network of the organization
+
+355
+00:11:23,440 --> 00:11:26,959
+to the certain threat actor they could
+
+356
+00:11:25,519 --> 00:11:29,278
+monitor for example how
+
+357
+00:11:26,958 --> 00:11:30,879
+the given actor was changing how fast
+
+358
+00:11:29,278 --> 00:11:32,78
+they were changing infrastructure
+
+359
+00:11:30,879 --> 00:11:34,0
+690.88 --> 694
+whether they were switching up their
+
+360
+00:11:32,78 --> 00:11:36,78
+methodology and this
+
+361
+00:11:34,0 --> 00:11:37,519
+694 --> 697.519
+gave them a lot of idea of useful data
+
+362
+00:11:36,78 --> 00:11:39,199
+of improving their libraries of the
+
+363
+00:11:37,519 --> 00:11:40,799
+threat actors that they were tracking
+
+364
+00:11:39,200 --> 00:11:41,920
+so suddenly we got this group interests
+
+365
+00:11:40,799 --> 00:11:43,838
+as well and they were obviously
+
+366
+00:11:41,919 --> 00:11:44,879
+producing data as well so nowadays if
+
+367
+00:11:43,839 --> 00:11:47,279
+you look at MISP
+
+368
+00:11:44,879 --> 00:11:49,200
+going from a raw indicator sharing platform
+
+369
+00:11:47,278 --> 00:11:50,399
+that MISP was initially
+
+370
+00:11:49,200 --> 00:11:52,160
+nowadays you have a lot of the high
+
+371
+00:11:50,399 --> 00:11:53,759
+level threat intel information included
+
+372
+00:11:52,159 --> 00:11:56,720
+with the data as well so you will see threat reports
+
+374
+00:11:54,879 --> 00:11:58,720
+you will see interconnected information
+
+375
+00:11:56,720 --> 00:12:04,399
+about threat actors modus operandi
+
+377
+00:12:01,839 --> 00:12:06,79
+infrastructure impact and so on so forth
+
+378
+00:12:04,399 --> 00:12:07,360
+these extra layers of information that
+
+379
+00:12:06,78 --> 00:12:08,719
+we were missing initially
+
+380
+00:12:07,360 --> 00:12:10,0
+727.36 --> 730
+so this was the biggest change that we
+
+381
+00:12:08,720 --> 00:12:11,440
+had over time within our own
+
+382
+00:12:10,0 --> 00:12:13,919
+730 --> 733.92
+organizations but
+
+383
+00:12:11,440 --> 00:12:15,519
+obviously as a CSIRT that has
+
+384
+00:12:13,919 --> 00:12:17,199
+different constituencies
+
+385
+00:12:15,519 --> 00:12:18,799
+we're also interacting with the security
+
+386
+00:12:17,200 --> 00:12:20,720
+teams of other organizations and one of
+
+387
+00:12:18,799 --> 00:12:22,319
+the things we noticed early on was
+
+388
+00:12:20,720 --> 00:12:24,160
+there's a lot of the issues that other
+
+389
+00:12:22,320 --> 00:12:25,600
+types of organizations had internally
+
+390
+00:12:24,159 --> 00:12:28,800
+with information sharing are very similar to ours
+
+392
+00:12:26,879 --> 00:12:30,958
+so initially the first use case that we
+
+393
+00:12:28,799 --> 00:12:32,799
+got that was different and from our
+
+394
+00:12:30,958 --> 00:12:36,719
+normal security use case
+
+395
+00:12:32,799 --> 00:12:38,399
+was basically the various financial
+
+396
+00:12:36,720 --> 00:12:39,920
+organizations reaching out to us saying
+
+397
+00:12:38,399 --> 00:12:41,759
+that their fraud teams were
+
+398
+00:12:39,919 --> 00:12:43,599
+running into similar sort of issues with
+
+399
+00:12:41,759 --> 00:12:45,759
+sharing between their teams,
+
+400
+00:12:43,600 --> 00:12:47,839
+sharing with other partner teams,
+
+401
+00:12:45,759 --> 00:12:50,319
+information about mule accounts and
+
+402
+00:12:47,839 --> 00:12:51,519
+about other fraud related information
+
+403
+00:12:50,320 --> 00:12:53,680
+so they reached out to us and
+
+404
+00:12:51,519 --> 00:12:54,480
+basically their security teams reached
+
+405
+00:12:53,679 --> 00:12:57,199
+out to us and said
+
+406
+00:12:54,480 --> 00:12:58,639
+can't we just try to help them also
+
+407
+00:12:57,200 --> 00:13:00,0
+777.2 --> 780
+to share that sort of information
+
+408
+00:12:58,639 --> 00:13:01,759
+through MISP directly, I mean we already
+
+409
+00:13:00,0 --> 00:13:03,200
+780 --> 783.2
+had the tooling in place
+
+410
+00:13:01,759 --> 00:13:05,200
+it was just a question of changing the data model
+
+412
+00:13:05,200 --> 00:13:08,639
+so we we started doing that for uh together
+
+413
+00:13:07,120 --> 00:13:10,480
+with the financial sector initially
+
+414
+00:13:08,639 --> 00:13:12,0
+788.639 --> 792
+where we expanded the data model of MISP
+
+415
+00:13:10,480 --> 00:13:13,519
+when we allowed for modeling of new
+
+416
+00:13:12,0 --> 00:13:15,919
+792 --> 795.92
+custom data types
+
+417
+00:13:13,519 --> 00:13:17,679
+and it's even surprising to us at the
+
+418
+00:13:15,919 --> 00:13:20,319
+time turned into a success
+
+419
+00:13:17,679 --> 00:13:21,599
+very rapidly so nowadays we're involved
+
+420
+00:13:20,320 --> 00:13:22,959
+with quite a few different types of
+
+421
+00:13:21,600 --> 00:13:25,519
+organizations out there
+
+422
+00:13:22,958 --> 00:13:26,879
+replicating the same scenario where for
+
+423
+00:13:25,519 --> 00:13:30,320
+example law enforcement, where we initially had
+
+425
+00:13:28,320 --> 00:13:32,79
+mostly contact with their security teams
+
+426
+00:13:30,320 --> 00:13:36,240
+and helping them build data sets for bootstrapping their forensic
+
+429
+00:13:34,399 --> 00:13:38,480
+investigations nowadays we have all
+
+430
+00:13:36,240 --> 00:13:40,959
+sorts of information sharing involving
+
+431
+00:13:38,480 --> 00:13:45,278
+uh for example uh seized goods information sharing from
+
+433
+00:13:42,639 --> 00:13:48,799
+border control agencies uh law enforcement agencies
+
+435
+00:13:46,879 --> 00:13:51,120
+sharing information about passenger information
+
+436
+00:13:48,799 --> 00:13:53,359
+so a lot of the type of data
+
+437
+00:13:51,120 --> 00:13:55,360
+sharing that was very unusual for us as
+
+438
+00:13:53,360 --> 00:13:58,79
+a CSIRT initially
+
+439
+00:13:55,360 --> 00:13:58,879
+now once you get all this data in a
+
+440
+00:13:58,78 --> 00:14:01,39
+system and you
+
+441
+00:13:58,879 --> 00:14:04,399
+started building a data set from your community
+
+443
+00:14:02,480 --> 00:14:06,79
+you start to see trends in the data set
+
+444
+00:14:04,399 --> 00:14:07,839
+and this is what gets
+
+445
+00:14:06,78 --> 00:14:09,759
+for example our risk analysis team
+
+446
+00:14:07,839 --> 00:14:11,440
+interested in it the moment that you're
+
+447
+00:14:09,759 --> 00:14:12,639
+seeing how attackers are changing their
+
+448
+00:14:11,440 --> 00:14:15,199
+trends over time
+
+449
+00:14:12,639 --> 00:14:18,719
+you can better advise your constituency your customers and so on
+
+451
+00:14:17,360 --> 00:14:22,160
+about the different risks that they might be facing and the
+
+453
+00:14:20,958 --> 00:14:24,879
+different risks that they should be preparing for
+
+455
+00:14:23,278 --> 00:14:26,958
+and preparing the organizations for
+
+456
+00:14:24,879 --> 00:14:29,519
+based on what the same sector is facing
+
+457
+00:14:26,958 --> 00:14:31,359
+perhaps in the same geographic location
+
+458
+00:14:29,519 --> 00:14:33,120
+so suddenly you get a lot of knowledge
+
+459
+00:14:31,360 --> 00:14:35,120
+out of the collected data as long as
+
+460
+00:14:33,120 --> 00:14:36,720
+data is well contextualized and i think
+
+461
+00:14:35,120 --> 00:14:38,78
+this will be one of the main topics that
+
+462
+00:14:36,720 --> 00:14:41,519
+we're going to be talking about quite a bit today and tomorrow
+
+464
+00:14:39,679 --> 00:14:43,599
+is contextualizing the information and
+
+465
+00:14:41,519 --> 00:14:47,600
+making the information actually usable
+
+466
+00:14:43,600 --> 00:14:47,600
+and turning data really into knowledge
+
+467
+00:14:49,600 --> 00:14:55,40
+yeah so like Andras mentioned
+
+468
+00:14:52,639 --> 00:14:56,240
+we have a pretty large set of different
+
+469
+00:14:55,39 --> 00:15:00,0
+895.04 --> 900
+communities using MISP
+
+470
+00:14:56,240 --> 00:15:02,159
+and over the time it became i think more
+
+471
+00:15:00,0 --> 00:15:03,759
+900 --> 903.76
+complicated to handle all those requests
+
+472
+00:15:02,159 --> 00:15:07,120
+from different organizations
+
+473
+00:15:03,759 --> 00:15:10,0
+903.76 --> 910
+um so we came with a model of governance
+
+474
+00:15:07,120 --> 00:15:12,240
+even if it's a very lightweight one we
+
+475
+00:15:10,0 --> 00:15:13,839
+910 --> 913.839
+decided to have this kind of models to
+
+476
+00:15:12,240 --> 00:15:15,680
+still benefit from the open source
+
+477
+00:15:13,839 --> 00:15:17,199
+community model and then
+
+478
+00:15:15,679 --> 00:15:19,278
+bring all the experience from a
+
+479
+00:15:17,198 --> 00:15:21,198
+different community into systems where
+
+480
+00:15:19,278 --> 00:15:22,720
+it allows us to develop and extend the
+
+481
+00:15:21,198 --> 00:15:24,958
+software so we decided to
+
+482
+00:15:22,720 --> 00:15:26,240
+create this kind of models where we
+
+483
+00:15:24,958 --> 00:15:28,879
+basically
+
+484
+00:15:26,240 --> 00:15:30,320
+take care of all the features and
+
+485
+00:15:28,879 --> 00:15:33,679
+requests that we receive from different organizations
+
+487
+00:15:31,679 --> 00:15:36,599
+so we use this kind of priority list of different features
+
+489
+00:15:35,600 --> 00:15:38,720
+and we get that feedback from {inaudible}
+
+491
+00:15:38,720 --> 00:15:42,879
+one of the {inaudible} one i would say is
+
+492
+00:15:40,639 --> 00:15:44,480
+Github so we get the feed from
+
+493
+00:15:42,879 --> 00:15:46,399
+the different issue that we receive from
+
+494
+00:15:44,480 --> 00:15:48,639
+Github i mean on the if you look at on
+
+495
+00:15:46,399 --> 00:15:50,320
+Github you'll see that we have a
+
+496
+00:15:48,639 --> 00:15:52,320
+significant number of issues and those
+
+497
+00:15:50,320 --> 00:15:54,800
+issue are usually for us a way to track down
+
+499
+00:15:52,799 --> 00:15:56,879
+all the different requests of features
+
+500
+00:15:54,639 --> 00:15:59,120
+in MISP and that's one way to get it.
+
+501
+00:15:56,879 --> 00:16:02,639
+Another way and this one is a quite a common one
+
+503
+00:16:00,639 --> 00:16:05,39
+is basically a training or session like
+
+504
+00:16:02,399 --> 00:16:06,799
+this where people are providing feedback,
+
+505
+00:16:05,39 --> 00:16:09,39
+bug reports, future requests and so on
+
+506
+00:16:06,799 --> 00:16:10,879
+directly during the training and for us
+
+507
+00:16:09,39 --> 00:16:12,958
+uh i think really practical and we can
+
+508
+00:16:10,879 --> 00:16:15,39
+get all this information needed for us
+
+509
+00:16:12,958 --> 00:16:16,0
+972.959 --> 976
+to improve the software. Another thing
+
+510
+00:16:15,39 --> 00:16:17,759
+that we do and
+
+511
+00:16:16,0 --> 00:16:19,839
+976 --> 979.839
+that's maybe for the audience some
+
+512
+00:16:17,759 --> 00:16:21,39
+people are interested in that one
+
+513
+00:16:19,839 --> 00:16:22,560
+we know that there are plenty of
+
+514
+00:16:21,39 --> 00:16:24,399
+different MISP of groups that we don't
+
+515
+00:16:22,559 --> 00:16:28,319
+control and that we don't manage that's
+
+516
+00:16:24,399 --> 00:16:29,679
+great we have for example ISACs, ISAO
+
+517
+00:16:28,320 --> 00:16:31,360
+doing really those kind of things where
+
+518
+00:16:29,679 --> 00:16:33,838
+you have those kind of user groups
+
+519
+00:16:31,360 --> 00:16:35,600
+and what we do we participate on a
+
+520
+00:16:33,839 --> 00:16:37,279
+regular basis to one of those groups for
+
+521
+00:16:35,600 --> 00:16:39,0
+995.6 --> 998
+example on a quarterly basis on a yearly basis
+
+523
+00:16:38,0 --> 00:16:41,759
+998 --> 1001.759
+and we do a collection of requirements
+
+524
+00:16:40,240 --> 00:16:44,240
+from those different groups
+
+525
+00:16:41,759 --> 00:16:46,720
+during one session and that's really
+
+527
+00:16:44,958 --> 00:16:48,799
+i think useful for us because it's a way
+
+528
+00:16:46,720 --> 00:16:50,720
+to to gather information so for example
+
+529
+00:16:48,799 --> 00:16:52,78
+Andras mentioned those
+
+530
+00:16:50,720 --> 00:16:53,519
+financial groups where people are
+
+531
+00:16:52,78 --> 00:16:54,559
+sharing information about bank account
+
+532
+00:16:53,519 --> 00:16:56,480
+detail and so on
+
+533
+00:16:54,559 --> 00:16:57,919
+and that's where we basically gather all
+
+534
+00:16:56,480 --> 00:16:59,278
+those requirements
+
+535
+00:16:57,919 --> 00:17:01,39
+so if you are setting up a group
+
+536
+00:16:59,278 --> 00:17:03,278
+somewhere in US or
+
+537
+00:17:01,39 --> 00:17:04,318
+in the world about sharing information
+
+538
+00:17:03,278 --> 00:17:06,0
+1023.279 --> 1026
+and so on and you want to
+
+539
+00:17:04,318 --> 00:17:07,759
+invite us at some point in time it's a
+
+540
+00:17:06,0 --> 00:17:12,160
+1026 --> 1028.959
+way for us to gather those kind of requirements
+
+542
+00:17:08,959 --> 00:17:13,759
+we do a summit which is a yearly event
+
+543
+00:17:12,160 --> 00:17:15,600
+usually it was physical but nowadays
+
+544
+00:17:13,759 --> 00:17:18,0
+1033.76 --> 1038
+it's virtual trainings
+
+545
+00:17:15,599 --> 00:17:19,918
+so it's basically every user or
+
+546
+00:17:18,0 --> 00:17:21,199
+1038 --> 1041.199
+organizations using MISP presenting what
+
+547
+00:17:19,919 --> 00:17:22,959
+they are doing
+
+548
+00:17:21,199 --> 00:17:24,558
+it's a way for us to to see the
+
+549
+00:17:22,959 --> 00:17:26,480
+interactions and see what
+
+550
+00:17:24,558 --> 00:17:28,480
+can be improved in MISP and see {inaudible}
+
+551
+00:17:26,480 --> 00:17:29,759
+in the community behind
+
+552
+00:17:28,480 --> 00:17:31,839
+and then we have a kind of 20%
+
+553
+00:17:29,759 --> 00:17:35,200
+project around in MISP
+
+554
+00:17:31,839 --> 00:17:38,558
+1051.84 --> 1056
+where we design new functionalities and we test
+
+556
+00:17:36,0 --> 00:17:39,919
+1056 --> 1059.919
+them out for example one of those is the
+
+557
+00:17:38,558 --> 00:17:41,200
+detailing of indicators
+
+558
+00:17:39,919 --> 00:17:42,400
+which was a request from different
+
+559
+00:17:41,200 --> 00:17:43,919
+organizations but it was kind of
+
+560
+00:17:42,400 --> 00:17:45,919
+difficult to design
+
+561
+00:17:43,919 --> 00:17:48,240
+and with this kind of models where we
+
+562
+00:17:45,919 --> 00:17:50,480
+designed first as a kind of prototype
+
+563
+00:17:48,240 --> 00:17:52,558
+multiple iterations uh we did a multiple
+
+564
+00:17:50,480 --> 00:17:56,0
+1070.48 --> 1076
+research paper on that and then finally
+
+565
+00:17:52,558 --> 00:17:57,918
+this become part of the MISP core software
+
+566
+00:17:56,0 --> 00:17:59,679
+1076 --> 1079.679
+we will show that later on but so we
+
+567
+00:17:57,919 --> 00:18:01,679
+have a lightweight governance model
+
+568
+00:17:59,679 --> 00:18:03,840
+but really the goal is to gather as
+
+569
+00:18:01,679 --> 00:18:05,280
+much feedback from the user so don't
+
+570
+00:18:03,839 --> 00:18:08,599
+hesitate if you have any bug reports, ideas and so on
+
+571
+00:18:05,279 --> 00:18:09,319
+either open an issue,
+
+573
+00:18:08,319 --> 00:18:11,918
+get in touch with us.
+
+575
+00:18:11,919 --> 00:18:16,400
+You are more than welcome to basically
+
+576
+00:18:13,279 --> 00:18:16,399
+share such kind of information.
+
+577
+00:18:17,119 --> 00:18:22,719
+Yeah, now addressing the elephant in the room
+
+579
+00:18:20,720 --> 00:18:24,160
+when you bring so many different
+
+580
+00:18:22,160 --> 00:18:25,759
+organizations together and build a large
+
+581
+00:18:24,160 --> 00:18:27,200
+community of sharing with different
+
+582
+00:18:25,759 --> 00:18:28,558
+needs and requirements
+
+583
+00:18:27,200 --> 00:18:31,200
+you're obviously going to have to run
+
+584
+00:18:28,558 --> 00:18:32,720
+into conflicting requirements as well
+
+585
+00:18:31,200 --> 00:18:34,240
+so one of the most obvious ones that
+
+586
+00:18:32,720 --> 00:18:36,640
+that we're dealing with very often with
+
+587
+00:18:34,240 --> 00:18:38,720
+information sharing and something that
+
+588
+00:18:36,640 --> 00:18:39,840
+that we're working on tackling ,
+
+590
+00:18:38,839 --> 00:18:43,599
+basically since we started with MISP, is dealing
+
+591
+00:18:42,79 --> 00:18:45,279
+with a different requirement of
+
+592
+00:18:43,599 --> 00:18:46,879
+of what you count as valuable
+
+593
+00:18:45,279 --> 00:18:47,519
+information depending on your use case
+
+594
+00:18:46,880 --> 00:18:51,599
+so this is different also within 
+
+596
+00:18:50,400 --> 00:18:53,360
+different analysts, different roles
+
+597
+00:18:51,599 --> 00:18:56,79
+within the same organization as
+
+598
+00:18:53,359 --> 00:18:58,720
+well so for example, for us as a CSIRT in general
+
+600
+00:18:57,38 --> 00:19:00,240
+uh detection is the most important
+
+601
+00:18:58,720 --> 00:19:04,640
+matter so we're interested
+
+602
+00:19:00,240 --> 00:19:08,880
+in in using indicators to detect if our constituency
+
+604
+00:19:06,880 --> 00:19:10,0
+1146.88 --> 1150
+is affected by something that the
+
+605
+00:19:08,880 --> 00:19:12,880
+information is being
+
+606
+00:19:10,0 --> 00:19:14,160
+1150 --> 1154.16
+shared about or whether uh any of the
+
+607
+00:19:12,880 --> 00:19:17,200
+the infrastructure that we're
+
+608
+00:19:14,160 --> 00:19:17,840
+responsible for is infected 
+
+609
+00:19:17,200 --> 00:19:22,639
+on the other hand if you're talking to an isp
+
+611
+00:19:19,919 --> 00:19:22,640
+one of the large
+
+612
+00:19:22,720 --> 00:19:26,720
+requirements from an isp basically will
+
+613
+00:19:24,640 --> 00:19:29,38
+be able to protect their users
+
+614
+00:19:26,720 --> 00:19:30,79
+from potential harm so that means that
+
+616
+00:19:30,79 --> 00:19:34,480
+if there are any urls, websites, and so on
+
+618
+00:19:34,480 --> 00:19:38,480
+that they should block for their users they
+
+619
+00:19:36,880 --> 00:19:39,679
+need to be able to generate a block list
+
+620
+00:19:38,480 --> 00:19:41,440
+out of the data
+
+621
+00:19:39,679 --> 00:19:43,600
+that is considered to be malicious
+
+622
+00:19:41,440 --> 00:19:45,360
+enough now if you compare these two use cases
+
+623
+00:19:43,599 --> 00:19:48,240
+with each other detection versus blocking
+
+625
+00:19:46,240 --> 00:19:49,359
+you will immediately see that the effect
+
+627
+00:19:49,359 --> 00:19:53,359
+of having a false positive in the data
+
+628
+00:19:51,200 --> 00:19:56,160
+set or data that is no longer fresh
+
+629
+00:19:53,359 --> 00:19:57,119
+has a completely different impact 
+
+630
+00:19:56,160 --> 00:19:58,960
+sure for us when
+
+631
+00:19:57,119 --> 00:20:00,719
+that are mostly in the detection game
+
+632
+00:19:58,960 --> 00:20:02,400
+it's annoying we get a false positive
+
+633
+00:20:00,720 --> 00:20:04,400
+alert it has to be handled
+
+634
+00:20:02,400 --> 00:20:05,759
+and it takes time and effort it also
+
+635
+00:20:04,400 --> 00:20:07,200
+introduces something called alert fatigue
+
+636
+00:20:05,759 --> 00:20:09,319
+that i'm sure many of you are familiar with
+
+638
+00:20:08,319 --> 00:20:12,79
+if you're getting a lot of false
+
+639
+00:20:09,440 --> 00:20:15,120
+positive alerts you're more likely to ignore the
+
+641
+00:20:13,119 --> 00:20:16,798
+next alert that you get but besides that
+
+642
+00:20:15,679 --> 00:20:20,879
+it has no real operational impact on us 
+
+644
+00:20:19,119 --> 00:20:22,879
+on the other hand for an isp that ends up blocking
+
+645
+00:20:20,880 --> 00:20:24,880
+something that is uh
+
+646
+00:20:22,880 --> 00:20:27,400
+potentially a false positive might have a catastrophic impact
+
+648
+00:20:26,400 --> 00:20:33,600
+imagine if someone accidentally, for example shares
+
+650
+00:20:29,599 --> 00:20:35,759
+facebook.com as an indicator that might
+
+651
+00:20:33,279 --> 00:20:39,119
+basically cause a riot with their users or it might {inaudible}
+
+653
+00:20:37,279 --> 00:20:41,519
+but it's a different story
+
+654
+00:20:39,119 --> 00:20:44,479
+but with that in mind, you see that these
+
+655
+00:20:41,519 --> 00:20:47,679
+two use cases are already conflicting
+
+656
+00:20:44,480 --> 00:20:49,360
+now if you also take the perspective of
+
+657
+00:20:47,679 --> 00:20:52,400
+intelligence analysts that are tracking
+
+658
+00:20:49,359 --> 00:20:52,798
+threat actor movements in to account 
+
+660
+00:20:52,798 --> 00:20:56,400
+that's an even more lax use case 
+
+662
+00:20:56,400 --> 00:21:02,159
+where you care about whether something is a fresh indicator still or not
+
+664
+00:21:00,79 --> 00:21:03,439
+even less than the other two groups.
+
+665
+00:21:02,159 --> 00:21:04,880
+The reason for that is you're interested in
+
+666
+00:21:03,440 --> 00:21:07,120
+the historical movements of a threat actor, for example.
+
+668
+00:21:07,119 --> 00:21:11,439
+So even if something is no longer
+
+669
+00:21:08,240 --> 00:21:13,38
+an indicator because and an infected
+
+670
+00:21:11,440 --> 00:21:14,960
+website was cleaned up
+
+671
+00:21:13,38 --> 00:21:17,38
+since the time when the indicator was
+
+672
+00:21:14,960 --> 00:21:18,880
+shared they still want to see
+
+673
+00:21:17,38 --> 00:21:20,558
+how long, for example a threat actor was
+
+674
+00:21:18,880 --> 00:21:22,80
+using that infrastructure,
+
+675
+00:21:20,558 --> 00:21:25,119
+how quickly they changed to something
+
+676
+00:21:22,79 --> 00:21:27,519
+else and what methods they used
+
+677
+00:21:25,119 --> 00:21:28,239
+back when they were exploiting it. 
+
+679
+00:21:27,240 --> 00:21:31,839
+So if you bring these different requirements on board on
+
+680
+00:21:30,480 --> 00:21:36,959
+the same platform is difficult and there are some
+
+682
+00:21:35,200 --> 00:21:38,960
+things that we can do to alleviate these
+
+683
+00:21:36,960 --> 00:21:40,720
+issues. For example what we do with
+
+684
+00:21:38,960 --> 00:21:42,798
+MISP
+
+685
+00:21:40,720 --> 00:21:44,480
+we have a system called warning list
+
+686
+00:21:42,798 --> 00:21:46,480
+system that allows us to filter out
+
+687
+00:21:44,480 --> 00:21:50,640
+obvious false positives
+
+688
+00:21:46,480 --> 00:21:54,798
+so we maintain these lists of
+
+689
+00:21:50,640 --> 00:21:56,720
+most common websites, empty hash lists,
+
+690
+00:21:54,798 --> 00:21:58,319
+public dns resolvers and all these
+
+691
+00:21:56,720 --> 00:22:00,558
+typical things that end up in
+
+692
+00:21:58,319 --> 00:22:04,399
+the sets while doing automatic extraction for example
+
+694
+00:22:02,400 --> 00:22:06,80
+that end up being false positives but
+
+695
+00:22:04,400 --> 00:22:07,720
+with that said this is just one part of the story
+
+697
+00:22:06,720 --> 00:22:10,79
+So if you're looking at the different
+
+698
+00:22:08,480 --> 00:22:12,880
+use cases up there that doesn't solve our issue
+
+700
+00:22:10,880 --> 00:22:15,600
+of having different requirements
+
+701
+00:22:14,0 --> 00:22:17,558
+1334 --> 1336.559
+from the data set based on what you do with it
+
+703
+00:22:16,558 --> 00:22:20,319
+and this is where contextualization
+
+704
+00:22:18,558 --> 00:22:22,158
+becomes more important again
+
+705
+00:22:20,319 --> 00:22:24,0
+1340.32 --> 1344
+if we can supply the information together with the data,
+
+707
+00:22:23,0 --> 00:22:26,880
+1344 --> 1346.88
+why this data is relevant and what context you're
+
+708
+00:22:25,440 --> 00:22:28,640
+supposed to be using it
+
+709
+00:22:26,880 --> 00:22:30,480
+then the consumers of the data can make
+
+710
+00:22:28,640 --> 00:22:33,440
+those decisions for themselves based on
+
+711
+00:22:30,480 --> 00:22:35,279
+whatever they want to use
+
+712
+00:22:33,440 --> 00:22:38,640
+the data for in any of those different use cases
+
+714
+00:22:36,640 --> 00:22:42,720
+so one of our main efforts with MISP has been
+
+716
+00:22:40,720 --> 00:22:44,0
+1360.72 --> 1364
+to be able to provide these different
+
+717
+00:22:42,400 --> 00:22:47,519
+structures together with the data and to
+
+718
+00:22:44,0 --> 00:22:48,519
+1364 --> 1367.52
+be able to label data well enough. Back to you. 
+
+720
+00:22:48,880 --> 00:22:54,720
+Yeah so and that's iI think important regarding the
+
+721
+00:22:52,960 --> 00:22:56,720
+different kind of use cases and so on
+
+722
+00:22:54,720 --> 00:22:59,360
+and we try to support those different use cases and
+
+725
+00:22:59,759 --> 00:23:03,679
+that's sometimes challenging for us but luckily
+
+726
+00:23:01,679 --> 00:23:06,320
+we are at the same time
+
+727
+00:23:03,679 --> 00:23:07,840
+part of various community so we can see
+
+728
+00:23:06,319 --> 00:23:09,279
+the different use cases, especially
+
+729
+00:23:07,839 --> 00:23:13,480
+regarding the handling of false positive which is
+
+731
+00:23:12,480 --> 00:23:16,558
+an ongoing challenge but we will show
+
+732
+00:23:14,880 --> 00:23:17,840
+you how to handle that
+
+733
+00:23:16,558 --> 00:23:20,0
+1396.559 --> 1400
+and at the same time we basically
+
+734
+00:23:17,839 --> 00:23:22,79
+operate those different communities.
+
+735
+00:23:20,0 --> 00:23:24,159
+1400 --> 1404.159
+So for example we operate a pretty large
+
+736
+00:23:22,79 --> 00:23:26,798
+one for the private sector
+
+737
+00:23:24,159 --> 00:23:30,559
+where we have a lot of organizations,
+
+739
+00:23:28,558 --> 00:23:32,158
+more than 1200 organizations are basically connected there.
+
+740
+00:23:30,880 --> 00:23:35,440
+It's pretty large and we see an active
+
+742
+00:23:35,440 --> 00:23:38,400
+community sharing information and
+
+743
+00:23:36,798 --> 00:23:40,400
+there is plenty of different communities
+
+744
+00:23:38,400 --> 00:23:41,840
+some that we don't know even about
+
+745
+00:23:40,400 --> 00:23:43,278
+because you can even run your own
+
+746
+00:23:41,839 --> 00:23:44,558
+private communities without telling anyone, that's fine.
+
+
+748
+00:23:44,558 --> 00:23:49,759
+That's part of the system but if you want to have different kind of communities
+
+750
+00:23:48,759 --> 00:23:55,839
+you can connect those automatically then you have I would say
+
+753
+00:23:54,240 --> 00:23:57,798
+different kind of model you have those kind of
+
+755
+00:23:56,798 --> 00:24:00,480
+fully island mode communities. 
+
+756
+00:23:58,798 --> 00:24:01,679
+Those kind of trusted groups so for example for the 
+
+758
+00:24:00,679 --> 00:24:05,519
+intelligence community it's very common for them to run MISP
+
+759
+00:24:03,759 --> 00:24:09,759
+in an island mode so having air gap system and so on
+
+761
+00:24:07,759 --> 00:24:11,919
+sometimes they are partially connected
+
+762
+00:24:09,759 --> 00:24:13,599
+with third parties to share partial
+
+763
+00:24:11,919 --> 00:24:15,400
+information so for example we know some organizations
+
+765
+00:24:14,400 --> 00:24:18,640
+or for example border controls or customs
+
+767
+00:24:18,640 --> 00:24:21,919
+are using MISP but they still need to
+
+768
+00:24:20,79 --> 00:24:24,319
+share some small information and that
+
+770
+00:24:22,319 --> 00:24:24,158
+partially connected system. 
+
+771
+00:24:23,319 --> 00:24:28,0
+1464.32 --> 1468
+MISP freely supports those kind of models
+
+772
+00:24:26,159 --> 00:24:29,679
+and then you have community that are
+
+773
+00:24:28,0 --> 00:24:31,359
+1468 --> 1471.36
+more broad and more large
+
+774
+00:24:29,679 --> 00:24:33,278
+for example in the financial sector and
+
+775
+00:24:31,359 --> 00:24:35,240
+I think the CSIRT Luxembourg has some banks
+
+777
+00:24:34,240 --> 00:24:39,599
+we are involved in various sharing communities
+
+779
+00:24:37,599 --> 00:24:41,519
+at European level and worldwide level
+
+780
+00:24:40,480 --> 00:24:45,759
+where for example we know some ISACs that are dedicated to
+
+782
+00:24:43,759 --> 00:24:48,200
+the financial sector are using it as a sharing mechanism 
+
+784
+00:24:47,200 --> 00:24:51,278
+you have some organizations that are really
+
+785
+00:24:49,38 --> 00:24:52,480
+dedicated to a payment processing system
+
+786
+00:24:51,278 --> 00:24:54,519
+that are using this to share automatically
+
+788
+00:24:53,519 --> 00:24:57,519
+information and so on or analysis
+
+790
+00:24:57,519 --> 00:25:01,519
+One of the i would say pretty large community too is
+
+791
+00:24:59,278 --> 00:25:04,960
+with the military organization and international organizations
+
+793
+00:25:02,960 --> 00:25:06,720
+FIRST for example, you have a lot of FIRST members using
+
+794
+00:25:05,359 --> 00:25:08,639
+MISP for sharing their information
+
+796
+00:25:08,640 --> 00:25:13,759
+but there are plenty of networks, national governmental networks
+
+798
+00:25:11,759 --> 00:25:15,278
+a military one intelligence, one or even NATO for example are using
+
+800
+00:25:15,278 --> 00:25:19,599
+using MISP so maybe some of you are eligible to access those ones
+
+802
+00:25:19,599 --> 00:25:23,399
+so we have on the MISP an interface a way to connect to those
+
+804
+00:25:22,400 --> 00:25:26,240
+community and you can reach out to the
+
+805
+00:25:24,319 --> 00:25:27,200
+different community by asking for access for example
+
+807
+00:25:27,200 --> 00:25:30,319
+then you have very specific communities
+
+808
+00:25:28,960 --> 00:25:33,720
+that are set up by security vendors it's not uncommon
+
+810
+00:25:32,720 --> 00:25:35,759
+tp see for example a security vendor
+
+811
+00:25:34,0 --> 00:25:37,359
+1534 --> 1537.36
+services their own MISP
+
+812
+00:25:35,759 --> 00:25:39,119
+we have seen for example some
+
+813
+00:25:37,359 --> 00:25:41,319
+{inaudible} agents vendors running a dedicated MISP
+
+815
+00:25:40,319 --> 00:25:44,480
+or even some operators of specific cloud
+
+816
+00:25:42,798 --> 00:25:46,400
+services running a MISP instance
+
+817
+00:25:44,480 --> 00:25:49,360
+to share information amongst
+
+818
+00:25:46,400 --> 00:25:49,320
+their different customers.
+
+819
+00:25:49,359 --> 00:25:52,798
+Then you have communities that are
+
+820
+00:25:50,319 --> 00:25:55,38
+i would say very specific on the topic
+
+821
+00:25:52,798 --> 00:25:59,79
+for example you have about sick information uh false news
+
+823
+00:25:58,79 --> 00:26:02,278
+and stuff like that you have communities doing that
+
+825
+00:26:01,278 --> 00:26:04,720
+for example we cooperate one called the COVID-19 MISP
+
+827
+00:26:04,720 --> 00:26:09,839
+which is really targeting COVID-19 as a topic 
+
+828
+00:26:07,919 --> 00:26:10,720
+and then you have 10 different subtopics like 
+
+829
+00:26:09,839 --> 00:26:12,399
+cyber security, health related topics and so on.
+
+831
+00:26:12,400 --> 00:26:15,679
+So you can see that MISP can be really used on
+
+832
+00:26:13,919 --> 00:26:17,440
+different model of communities
+
+833
+00:26:15,679 --> 00:26:19,440
+you can bridge those communities,
+
+834
+00:26:17,440 --> 00:26:21,360
+you can interconnect those with together,
+
+835
+00:26:19,440 --> 00:26:23,759
+you can keep it for yourself, so it's
+
+836
+00:26:21,359 --> 00:26:25,839
+really a matter of models.
+
+837
+00:26:23,759 --> 00:26:27,759
+Worldwide there are I would say a lot of
+
+838
+00:26:25,839 --> 00:26:31,199
+communities that we are not aware of
+
+839
+00:26:27,759 --> 00:26:33,599
+but we as CIRCL operates
+
+840
+00:26:31,200 --> 00:26:35,120
+around 20 communities nowadays, that you
+
+841
+00:26:33,599 --> 00:26:37,839
+can basically get access
+
+842
+00:26:35,119 --> 00:26:39,839
+and Andras just sharing in the chat the
+
+843
+00:26:37,839 --> 00:26:42,439
+access to the COVID-19 MISP and if you want to get access to
+
+845
+00:26:41,440 --> 00:26:46,320
+that one you can connect on the main page and self-register and
+
+847
+00:26:46,319 --> 00:26:49,519
+you can request access to that community 
+
+849
+00:26:48,519 --> 00:26:53,38
+so you see that MISP has different groups different communities
+
+851
+00:26:53,38 --> 00:26:56,640
+and it's up to you at the end to decide
+
+852
+00:26:55,359 --> 00:26:58,879
+which kind of community you want to {inaudiable either be/visit}
+
+854
+00:27:01,38 --> 00:27:04,798
+So, a little bit besides all the technical things
+
+856
+00:27:04,798 --> 00:27:06,839
+that we talked about, that we do with MISP,
+
+857
+00:27:06,480 --> 00:27:09,919
+and that we try to solve with it.
+
+858
+00:27:07,839 --> 00:27:11,278
+In terms of sharing, there are obviously
+
+859
+00:27:09,919 --> 00:27:12,720
+going to be other hurdles that you have
+
+860
+00:27:11,278 --> 00:27:14,159
+to overcome whenever it comes to information sharing
+
+862
+00:27:14,159 --> 00:27:17,679
+one of the the toughest things to
+
+863
+00:27:16,0 --> 00:27:18,880
+1636 --> 1638.88
+overcome and this is where no tool can really help you
+
+865
+00:27:18,880 --> 00:27:23,679
+is to get enough trust in a community to
+
+866
+00:27:22,79 --> 00:27:24,319
+be able to share your information with them
+
+868
+00:27:24,319 --> 00:27:27,918
+So the only way to facilitate this is really social interactions
+
+870
+00:27:27,919 --> 00:27:32,0
+1647.919 --> 1652
+so sadly though we're living in times
+
+871
+00:27:30,398 --> 00:27:33,278
+where social interactions are tougher than usual
+
+873
+00:27:33,278 --> 00:27:37,440
+but for example events like FIRST conferences
+
+874
+00:27:35,679 --> 00:27:38,880
+ are great ways to get to know your community and to
+
+876
+00:27:38,880 --> 00:27:43,200
+build this trust and build those
+
+877
+00:27:41,440 --> 00:27:44,159
+social relationships that you need 
+
+879
+00:27:44,159 --> 00:27:47,679
+to be able to really exchange meaningful
+
+880
+00:27:45,839 --> 00:27:49,918
+information with the community
+
+881
+00:27:47,679 --> 00:27:52,0
+1667.679 --> 1672
+so i really encourage everyone that
+
+882
+00:27:49,919 --> 00:27:53,360
+wants to partake in information sharing communities
+
+884
+00:27:53,359 --> 00:27:57,278
+to be social, to reach out, and to get to know your community
+
+886
+00:27:57,278 --> 00:28:00,79
+because that's the biggest facilitator for sharing in the first place.
+
+888
+00:28:00,79 --> 00:28:03,599
+Other than that, there are obviously some
+
+889
+00:28:01,919 --> 00:28:05,360
+legal restrictions that you have
+
+890
+00:28:03,599 --> 00:28:06,398
+that might come up in the entire process.
+
+891
+00:28:05,359 --> 00:28:08,79
+We see this very often with organizations where the first
+
+893
+00:28:08,79 --> 00:28:10,918
+questions that they ask us when they join
+
+895
+00:28:09,919 --> 00:28:16,240
+in our communities okay how does this
+
+896
+00:28:13,38 --> 00:28:18,558
+fit into GDPR for example.
+
+897
+00:28:16,240 --> 00:28:21,38
+If my legal team asks me why I am sharing
+
+898
+00:28:18,558 --> 00:28:22,720
+an information out what can i
+
+899
+00:28:21,38 --> 00:28:24,798
+give them as an explanation of why i'm
+
+900
+00:28:22,720 --> 00:28:25,159
+supposed to or allowed to do this.
+
+901
+00:28:25,198 --> 00:28:28,319
+So if you need any help with that we
+
+902
+00:28:26,159 --> 00:28:29,840
+have a bunch of compliance documentation
+
+903
+00:28:28,319 --> 00:28:33,240
+and that we've been working on together with a bunch of partners
+
+905
+00:28:32,240 --> 00:28:36,798
+and so we have descriptions for how
+
+906
+00:28:34,640 --> 00:28:37,919
+MISP fits into the GDPR, the NIS directive
+
+908
+00:28:37,919 --> 00:28:41,360
+and some other frameworks so just
+
+909
+00:28:40,79 --> 00:28:43,119
+have a look there and if you have any
+
+910
+00:28:41,359 --> 00:28:44,0
+1721.36 --> 1724
+questions or if you feel that anything is not covered
+
+912
+00:28:44,0 --> 00:28:47,599
+1724 --> 1727.6
+let us know and we keep updating our documentation
+
+914
+00:28:47,599 --> 00:28:51,519
+based on on feedback of what's missing
+
+915
+00:28:49,679 --> 00:28:52,559
+or ideas that we should be incorporating in there
+
+917
+00:28:52,558 --> 00:29:00,640
+but generally , once your legal team is more
+
+919
+00:28:58,880 --> 00:29:01,360
+familiar with the process and why this
+
+920
+00:29:00,640 --> 00:29:02,80
+is {inaudiable done/tied}
+
+921
+00:29:01,359 --> 00:29:05,759
+why ensuring security for your
+
+922
+00:29:04,79 --> 00:29:06,798
+organization and for the data that you
+
+923
+00:29:05,759 --> 00:29:08,960
+have to secure is important then it's seen more as a
+
+925
+00:29:08,960 --> 00:29:13,360
+benefit than a hurdle really
+
+926
+00:29:10,640 --> 00:29:15,278
+but it obviously takes time to get
+
+927
+00:29:13,359 --> 00:29:16,240
+this into your processes to define why you're
+
+929
+00:29:16,240 --> 00:29:19,679
+doing what you're doing
+
+930
+00:29:18,398 --> 00:29:21,199
+your retention periods,
+
+931
+00:29:19,679 --> 00:29:22,960
+describing how you're going to handle data and so on
+
+933
+00:29:22,960 --> 00:29:26,399
+so this obviously has some ramp up time
+
+935
+00:29:26,398 --> 00:29:29,439
+but we have a lot of documentation that will help you with that. 
+
+937
+00:29:29,440 --> 00:29:32,558
+There are also some practical restrictions that we hear from
+
+938
+00:29:30,960 --> 00:29:34,79
+organizations so very often when
+
+939
+00:29:32,558 --> 00:29:35,440
+organizations reach out to us
+
+940
+00:29:34,79 --> 00:29:37,199
+the first thing they say is we don't
+
+941
+00:29:35,440 --> 00:29:39,120
+really have any information to share,
+
+942
+00:29:37,200 --> 00:29:40,880
+we don't have the capability for example
+
+943
+00:29:39,119 --> 00:29:42,639
+to build those highly vetted threat reports that we're so used to
+
+945
+00:29:42,640 --> 00:29:46,960
+from feed providers and obviously very few organizations do.
+
+947
+00:29:46,960 --> 00:29:51,200
+With that said information sharing comes
+
+948
+00:29:49,919 --> 00:29:54,600
+in many different shapes and sizes for example going back
+
+950
+00:29:53,599 --> 00:29:58,558
+to the initial use case about
+
+951
+00:29:55,200 --> 00:30:00,0
+1795.2 --> 1800
+providing feedback from your analysts
+
+952
+00:29:58,558 --> 00:30:02,240
+about the data that you receive from
+
+953
+00:30:00,0 --> 00:30:03,839
+1800 --> 1803.84
+your community is already valuable
+
+954
+00:30:02,240 --> 00:30:05,599
+information sharing so if someone for
+
+955
+00:30:03,839 --> 00:30:07,278
+example provides sightings
+
+956
+00:30:05,599 --> 00:30:09,839
+I've also seen this indicator at this given time
+
+958
+00:30:09,839 --> 00:30:13,359
+that can already help you tune the data set
+
+960
+00:30:13,359 --> 00:30:16,879
+for what goes into your working data
+
+961
+00:30:15,119 --> 00:30:18,319
+sets for detection and blocking and so on.
+
+963
+00:30:18,319 --> 00:30:22,960
+Also providing information on false
+
+964
+00:30:20,839 --> 00:30:24,319
+positives and some information that
+
+965
+00:30:22,960 --> 00:30:26,640
+you provided to the community turns out to be false
+
+967
+00:30:26,640 --> 00:30:30,960
+or something that is no longer relevant
+
+968
+00:30:28,880 --> 00:30:33,39
+getting information that is valid as
+
+969
+00:30:30,960 --> 00:30:35,278
+well so pretty much everyone has
+
+970
+00:30:33,38 --> 00:30:36,398
+information to share by just using the information and running
+
+972
+00:30:36,398 --> 00:30:44,0
+1836.399 --> 1844
+into frustration with the data by itself.
+
+973
+00:30:40,720 --> 00:30:44,640
+Also besides not having information to share
+
+975
+00:30:44,640 --> 00:30:50,399
+there comes also the issue of time.
+
+976
+00:30:48,398 --> 00:30:51,759
+Most of us are overburdened with
+
+977
+00:30:50,398 --> 00:30:52,798
+the different tasks that we are facing nowadays
+
+979
+00:30:52,798 --> 00:30:57,599
+so taking extra time out of the day to
+
+981
+00:30:57,599 --> 00:31:02,38
+encode information and to share it out in the community
+
+983
+00:31:01,38 --> 00:31:04,558
+is obviously going to be an extra burden
+
+984
+00:31:02,640 --> 00:31:05,600
+there is no way around it. 
+
+985
+00:31:03,558 --> 00:31:07,440
+What we try to do with MISP
+
+986
+00:31:05,599 --> 00:31:09,38
+is to make this process as minimal as
+
+987
+00:31:07,440 --> 00:31:11,0
+1867.44 --> 1870
+possible but it is going to be a time investment in the end, after all
+
+989
+00:31:10,0 --> 00:31:13,839
+1870 --> 1873.84
+especially if you want to vet the data if you want to ensure that 
+
+992
+00:31:13,839 --> 00:31:19,240
+the right data reaches the right recipients
+
+994
+00:31:18,240 --> 00:31:26,240
+This always has a time drain on you as well but in return this
+
+996
+00:31:24,480 --> 00:31:29,79
+is offset by what you gain by sharing that information we're
+
+998
+00:31:28,79 --> 00:31:31,359
+going to talk about this a little bit
+
+999
+00:31:29,440 --> 00:31:33,759
+more during the community building part
+
+1000
+00:31:31,359 --> 00:31:35,278
+about what effects you're going to see
+
+1001
+00:31:33,759 --> 00:31:36,640
+if you're sharing information and why it is relevant for you
+
+1003
+00:31:36,640 --> 00:31:41,120
+but to basically sum it up in one sentence
+
+1005
+00:31:41,119 --> 00:31:44,239
+and whatever affects your organization
+
+1006
+00:31:42,960 --> 00:31:45,679
+is probably the most important information for you and if you get
+
+1008
+00:31:45,679 --> 00:31:49,759
+feedback on that, what you're seeing in your network
+
+1010
+00:31:49,759 --> 00:31:52,398
+and more eyes on it, more perspectives
+
+1013
+00:31:52,398 --> 00:31:58,159
+and perhaps more sophisticated methods of
+
+1014
+00:31:56,79 --> 00:31:59,519
+research from other organizations
+
+1015
+00:31:58,159 --> 00:32:01,600
+then that will probably just improve
+
+1016
+00:31:59,519 --> 00:32:03,519
+your own security posture the best way it can.
+
+1018
+00:32:03,519 --> 00:32:08,880
+Now, besides timeliness and basically having information to share
+
+1020
+00:32:07,519 --> 00:32:10,960
+there's also the issue of different
+
+1021
+00:32:08,880 --> 00:32:12,240
+classification models so classification
+
+1022
+00:32:10,960 --> 00:32:16,159
+not just in a sense of of deciding who we share information with
+
+1025
+00:32:16,159 --> 00:32:19,278
+but how we classify information really
+
+1026
+00:32:18,79 --> 00:32:22,798
+in terms of contextualizating it we are all used
+
+1029
+00:32:22,798 --> 00:32:28,159
+to naming things a certain way in our organizations in
+
+1030
+00:32:26,319 --> 00:32:31,38
+our communities and we've probably
+
+1031
+00:32:28,159 --> 00:32:35,839
+been doing it for longer than digital information systems exist 
+
+1034
+00:32:34,558 --> 00:32:37,599
+so we're probably using a lot of those
+
+1035
+00:32:35,839 --> 00:32:38,639
+vocabularies that we've been using for decades
+
+1037
+00:32:38,640 --> 00:32:43,600
+and what one of the things that we
+
+1038
+00:32:41,119 --> 00:32:45,678
+wanted to avoid with MISP is to
+
+1039
+00:32:43,599 --> 00:32:46,639
+get these communities to switch to a
+
+1041
+00:32:46,640 --> 00:32:51,360
+different way of describing things so if you already
+
+1042
+00:32:49,119 --> 00:32:52,959
+have your set methods, your set processes
+
+1043
+00:32:51,359 --> 00:32:54,479
+how you define things, we don't want to alter that so one of
+
+1045
+00:32:54,480 --> 00:32:57,278
+the things that we do with MISP and we are
+
+1046
+00:32:55,839 --> 00:32:58,798
+going to talk a fair bit about, tomorrow mostly
+
+1048
+00:32:58,798 --> 00:33:03,679
+is that you have ways to describe your
+
+1049
+00:33:01,519 --> 00:33:06,0
+1981.519 --> 1986
+own taxonomies and your own vocabularies
+
+1050
+00:33:03,679 --> 00:33:07,120
+to use those in your community so very
+
+1051
+00:33:06,0 --> 00:33:08,558
+1986 --> 1988.559
+often when you're spinning up a
+
+1052
+00:33:07,119 --> 00:33:09,199
+community and when you're starting out
+
+1053
+00:33:08,558 --> 00:33:10,879
+with the sharing community,
+
+1055
+00:33:10,880 --> 00:33:14,320
+a national sharing community, sectorial one, whatever
+
+1056
+00:33:12,480 --> 00:33:16,399
+then one of the first tasks is basically
+
+1057
+00:33:14,319 --> 00:33:18,720
+defining those common vocabularies
+
+1058
+00:33:16,398 --> 00:33:20,639
+that you're going to be using
+
+1059
+00:33:18,720 --> 00:33:22,319
+now apart from the vocabularies
+
+1060
+00:33:20,640 --> 00:33:25,38
+themselves there is also the issue of
+
+1061
+00:33:22,319 --> 00:33:25,839
+of us speaking many different languages
+
+1063
+00:33:25,839 --> 00:33:29,519
+in terms of of our tools using different formats
+
+1065
+00:33:28,640 --> 00:33:33,919
+so that means even within our own organization which is
+
+1066
+00:33:32,79 --> 00:33:34,639
+rather small we have a set of different tools
+
+1068
+00:33:34,640 --> 00:33:38,559
+that will ingest data in different formats
+
+1070
+00:33:38,558 --> 00:33:42,240
+or will prefer to ingest data in given
+
+1071
+00:33:40,558 --> 00:33:43,119
+format so one of the things we also try to do with MISP
+
+1073
+00:33:43,119 --> 00:33:46,798
+is to act as a hub for all your different tools
+
+1075
+00:33:46,798 --> 00:33:51,519
+that will get their data translated into
+
+1076
+00:33:49,200 --> 00:33:52,960
+the format that they can best ingest.
+
+1077
+00:33:51,519 --> 00:33:55,839
+Obviously this is something where we cannot be completely
+
+1079
+00:33:55,839 --> 00:34:01,519
+100 percent covering all the other
+
+1080
+00:33:59,119 --> 00:34:02,879
+things that exist out there. 
+
+1081
+00:34:01,519 --> 00:34:04,558
+So one of the things we try to do with MISP
+
+1082
+00:34:02,880 --> 00:34:06,399
+is make it as modular as possible and
+
+1083
+00:34:04,558 --> 00:34:07,278
+it's easy to encode your own formats as possible.
+
+1085
+00:34:07,278 --> 00:34:13,440
+We're not going to go deeply into how to do this during the training
+
+1087
+00:34:11,358 --> 00:34:15,39
+but if anyone is interested about that just
+
+1089
+00:34:15,39 --> 00:34:17,599
+let us know and we'll point you in the
+
+1090
+00:34:16,398 --> 00:34:19,598
+right direction where you can find
+
+1091
+00:34:17,599 --> 00:34:20,159
+documentation on how to modularize and
+
+1093
+00:34:19,599 --> 00:34:24,159
+how to build import and export in MISP.
+
+1094
+00:34:26,760 --> 00:34:30,560
+So just one side note, all the training
+
+1095
+00:34:28,639 --> 00:34:32,320
+materials are available online
+
+1096
+00:34:30,559 --> 00:34:33,599
+like {inaduiable} mentioned we have a Github
+
+1097
+00:34:32,320 --> 00:34:35,599
+repository with a pretty extensive README files with all
+
+1099
+00:34:35,599 --> 00:34:41,39
+the material that we provide, there is a MISP book too which includes a
+
+1101
+00:34:41,39 --> 00:34:45,838
+lot of reference to MISP as you know MISP has a 
+
+1103
+00:34:45,838 --> 00:34:50,159
+pretty large topic coming from technical aspect and
+
+1105
+00:34:50,159 --> 00:34:54,480
+you will see that in a minute about the project overview.
+
+1107
+00:34:54,480 --> 00:34:57,519
+So don't hesitate to go there on the MISP training
+
+1109
+00:34:57,519 --> 00:35:00,639
+page on Github this one is a good
+
+1110
+00:34:59,358 --> 00:35:02,639
+reference because it's really pointing
+
+1111
+00:35:00,639 --> 00:35:05,920
+to the different elements
+
+1112
+00:35:02,639 --> 00:35:06,239
+that we have. We have a huge slide deck of
+
+1114
+00:35:06,239 --> 00:35:10,559
+close to 500 pages of slide deck on the
+
+1115
+00:35:08,559 --> 00:35:11,679
+MISP book we have close to 500 pages. I
+
+1116
+00:35:10,559 --> 00:35:13,440
+would not mention the number of pages
+
+1117
+00:35:11,679 --> 00:35:14,719
+for taxonomies, galaxies and so on. It's quite large too
+
+1119
+00:35:14,719 --> 00:35:19,39
+but really look at this as a kind of way
+
+1120
+00:35:17,519 --> 00:35:22,239
+to shape it to what you like.
+
+1121
+00:35:19,39 --> 00:35:23,519
+So it's really there to help you and if
+
+1122
+00:35:22,239 --> 00:35:25,439
+you see something missing
+
+1123
+00:35:23,519 --> 00:35:26,800
+let us know but we have slides, 
+
+1125
+00:35:26,800 --> 00:35:31,200
+for example system requirements, things like
+
+1126
+00:35:29,838 --> 00:35:32,960
+for example building community that
+
+1127
+00:35:31,199 --> 00:35:35,439
+we'll talk tomorrow, that's
+
+1128
+00:35:32,960 --> 00:35:37,599
+part of it but for more the
+
+1129
+00:35:35,440 --> 00:35:40,320
+programmatic aspect, API
+
+1130
+00:35:37,599 --> 00:35:41,200
+how to integrate with MISP {inaduiable JSON/taxono},
+
+1131
+00:35:40,320 --> 00:35:43,39
+how to extend it too
+
+1132
+00:35:41,199 --> 00:35:44,799
+there are plenty of slides regarding that
+
+1133
+00:35:43,39 --> 00:35:46,800
+so it's really a good reference
+
+1134
+00:35:44,800 --> 00:35:48,560
+and thanks to {inaduiable} to share this
+
+1135
+00:35:46,800 --> 00:35:50,800
+information on the chat
+
+1136
+00:35:48,559 --> 00:35:52,719
+so to just give a quick overview of the MISP project and really to show that
+
+1138
+00:35:52,719 --> 00:35:56,399
+the project is quite large nowadays
+
+1139
+00:35:55,199 --> 00:35:59,838
+we basically have like four pillars of things in MISP
+
+1141
+00:35:59,838 --> 00:36:03,199
+one is obviously the open software itself
+
+1143
+00:36:03,199 --> 00:36:08,78
+so the initial version in {inaduaible} it was
+
+1144
+00:36:06,239 --> 00:36:10,239
+the small first small block there
+
+1145
+00:36:08,79 --> 00:36:11,440
+the MISP core software which is like just the software
+
+1147
+00:36:11,440 --> 00:36:16,400
+mainly for the LMAP aspect where
+
+1148
+00:36:14,800 --> 00:36:17,920
+you have the backend, the web interface,
+
+1149
+00:36:16,400 --> 00:36:19,760
+and so on but over the time the project extended
+
+1151
+00:36:19,760 --> 00:36:23,40
+with multiple things so if you look on the Github
+
+1152
+00:36:20,960 --> 00:36:24,800
+repository of mid project we have around 50 repositories so
+
+1154
+00:36:24,800 --> 00:36:28,720
+it's pretty large. Just to summarize what
+
+1155
+00:36:27,519 --> 00:36:31,119
+are the different one
+
+1156
+00:36:28,719 --> 00:36:31,919
+we have for example the MISP modules um
+
+1158
+00:36:31,920 --> 00:36:35,119
+which is an easy way to extend MISP so the behavior of MISP
+
+1160
+00:36:35,119 --> 00:36:40,880
+on the expansion side on the import, export and so on by just writing
+
+1162
+00:36:40,880 --> 00:36:44,480
+python modules it's super easy to develop and use
+
+1164
+00:36:44,480 --> 00:36:47,920
+and the idea behind is obviously to
+
+1165
+00:36:46,0 --> 00:36:50,960
+2206 --> 2210.96
+extend MISP without knowing
+
+1166
+00:36:47,920 --> 00:36:51,440
+the core details about the system 
+
+1167
+00:36:50,960 --> 00:36:55,358
+then we have a library called PyMISP and this
+
+1168
+00:36:53,440 --> 00:36:58,639
+PyMISP library is basically a
+
+1169
+00:36:55,358 --> 00:37:02,319
+python library to expose the new MISP platform API
+
+1171
+00:37:02,320 --> 00:37:07,39
+so MISP has a large REST api this one can be quite large but
+
+1173
+00:37:05,199 --> 00:37:11,679
+by MISP is really helping you to for example {inaduiable jest/Get} events
+
+1174
+00:37:09,599 --> 00:37:13,200
+create feeds and stuff like that so it's
+
+1175
+00:37:11,679 --> 00:37:15,358
+really important if you want to
+
+1176
+00:37:13,199 --> 00:37:17,39
+extend MISP to have a look at PyMISP that
+
+1177
+00:37:15,358 --> 00:37:18,480
+is not the only library for extending
+
+1179
+00:37:18,480 --> 00:37:23,440
+MISP some in golang you have some
+
+1180
+00:37:21,519 --> 00:37:24,639
+other in python too, you have others in java and so on
+
+1182
+00:37:24,639 --> 00:37:28,0
+2244.64 --> 2248
+but the PyMISP one is the one that
+
+1183
+00:37:26,400 --> 00:37:31,199
+is maintained by the author of MISP so it is maintained by us
+
+1186
+00:37:31,199 --> 00:37:34,399
+and you can have a look at this one it's
+
+1187
+00:37:32,480 --> 00:37:36,0
+2252.48 --> 2256
+really the one that's up to date it's
+
+1188
+00:37:34,400 --> 00:37:38,0
+2254.4 --> 2258
+really core and part of the system too
+
+1189
+00:37:36,0 --> 00:37:40,400
+2256 --> 2260.4
+because we use it for our own tests
+
+1190
+00:37:38,0 --> 00:37:42,320
+2258 --> 2262.32
+within MISP then we have different
+
+1191
+00:37:40,400 --> 00:37:43,358
+repository i will just mention one which is
+
+1193
+00:37:43,358 --> 00:37:46,559
+dashboard, the dashboard is an extension module
+
+1195
+00:37:46,559 --> 00:37:51,838
+in MISP using what we call the ZeroMQ feed in MISP
+
+1196
+00:37:49,838 --> 00:37:54,159
+so we have a kind of way to have kind of a real-time feed
+
+1198
+00:37:54,159 --> 00:37:58,799
+in MISP you can {inaudiable} and
+
+1199
+00:37:56,400 --> 00:38:00,639
+so on but we wanted to show an example
+
+1200
+00:37:58,800 --> 00:38:02,240
+application for that and the MISP
+
+1201
+00:38:00,639 --> 00:38:04,879
+dashboard is exactly that
+
+1202
+00:38:02,239 --> 00:38:06,559
+is a way to really get all the
+
+1203
+00:38:04,880 --> 00:38:08,960
+information that you have in MISP
+
+1204
+00:38:06,559 --> 00:38:09,920
+into a very nice dashboard and so on
+
+1205
+00:38:08,960 --> 00:38:11,760
+this is really to have a good example of what you can do
+
+1207
+00:38:11,760 --> 00:38:14,240
+with information within MISP and how you can use it
+
+1209
+00:38:14,239 --> 00:38:17,519
+so that's the main pillar you have
+
+1210
+00:38:15,519 --> 00:38:18,79
+plenty of other projects but those one are the main ones
+
+1212
+00:38:18,79 --> 00:38:22,400
+on top of that you have
+
+1213
+00:38:20,880 --> 00:38:23,358
+what we call the intelligent and knowledge database of
+
+1215
+00:38:23,358 --> 00:38:27,119
+MISP and just mentioned about the difficulty
+
+1217
+00:38:27,119 --> 00:38:31,280
+sometimes in some organizations to use a
+
+1218
+00:38:29,199 --> 00:38:33,519
+{inaudiable proper/corporate} classification and so on
+
+1219
+00:38:31,280 --> 00:38:35,40
+and we try to ease this in this
+
+1220
+00:38:33,519 --> 00:38:36,639
+different organization by having a kind
+
+1221
+00:38:35,39 --> 00:38:37,279
+of library of all the taxonomies that exist
+
+1223
+00:38:37,280 --> 00:38:41,519
+so we started as a very simple one where
+
+1224
+00:38:39,679 --> 00:38:43,358
+it was just including for example a
+
+1225
+00:38:41,519 --> 00:38:45,440
+taxonomy like the traffic light protocol one, FIRST is using it
+
+1227
+00:38:45,440 --> 00:38:49,119
+and it's a commonly used classification but over
+
+1228
+00:38:47,838 --> 00:38:50,320
+the time we have seen that many
+
+1229
+00:38:49,119 --> 00:38:52,720
+organizations have different
+
+1230
+00:38:50,320 --> 00:38:54,320
+classification and so on. So we already
+
+1231
+00:38:52,719 --> 00:38:55,838
+in advance we prepare all those taxonomies in
+
+1233
+00:38:55,838 --> 00:38:59,599
+possible information {inaudiable} expose MISP
+
+1234
+00:38:58,159 --> 00:39:02,399
+and you can enable the one that you want
+
+1235
+00:38:59,599 --> 00:39:05,39
+so we have around 150 libraries now
+
+1236
+00:39:02,400 --> 00:39:05,680
+ranging from classifications, specific one for
+
+1238
+00:39:05,679 --> 00:39:10,559
+intelligence communities and some
+
+1239
+00:39:08,159 --> 00:39:12,399
+other activities so this one is our
+
+1240
+00:39:10,559 --> 00:39:13,440
+really useful label and you can just
+
+1241
+00:39:12,400 --> 00:39:15,39
+{inaudiable share/pick} the one that you want and we maintain those one
+
+1243
+00:39:15,39 --> 00:39:18,880
+so we have some that are coming from
+
+1244
+00:39:16,960 --> 00:39:21,39
+third party, some that we are collecting
+
+1245
+00:39:18,880 --> 00:39:23,39
+as each projects are creating.
+
+1246
+00:39:21,39 --> 00:39:24,719
+It's really usually a good source to see
+
+1247
+00:39:23,39 --> 00:39:26,838
+how other communities are using
+
+1248
+00:39:24,719 --> 00:39:28,639
+classifying and contextualizing the
+
+1249
+00:39:26,838 --> 00:39:30,480
+information, there nevertheless the
+
+1250
+00:39:28,639 --> 00:39:35,759
+taxonomy itself was like kind of labels, those labels were quite small
+
+1253
+00:39:33,519 --> 00:39:36,960
+so it was not like completely extensive information so
+
+1255
+00:39:36,960 --> 00:39:41,39
+over the time we maintain a kind of more extensive one called the galaxy
+
+1257
+00:39:41,39 --> 00:39:47,279
+you will hear the term very often
+
+1258
+00:39:44,79 --> 00:39:49,200
+those galaxies are defining many things
+
+1259
+00:39:47,280 --> 00:39:51,40
+for example one of the most common one is the threat actor
+
+1261
+00:39:50,39 --> 00:39:54,400
+we have a huge database of threat actors but a lot of
+
+1262
+00:39:52,800 --> 00:39:56,400
+times it was extended
+
+1263
+00:39:54,400 --> 00:39:58,320
+for example, Microsoft is not using
+
+1264
+00:39:56,400 --> 00:39:59,358
+threat actors for example there is this activity group is part of the
+
+1266
+00:39:59,358 --> 00:40:05,119
+galaxy, it's really one that we
+
+1267
+00:40:02,400 --> 00:40:05,760
+use for different and you can represent whatever
+
+1269
+00:40:05,760 --> 00:40:09,280
+galaxy you want so you have a predefined
+
+1270
+00:40:07,358 --> 00:40:10,960
+set of existing one but you can create your own 
+
+1272
+00:40:10,960 --> 00:40:14,400
+so if you have your own threat actor database
+
+1273
+00:40:12,880 --> 00:40:16,480
+you can create your own from scratch or
+
+1274
+00:40:14,400 --> 00:40:17,280
+you can reuse and fork existing ones so
+
+1275
+00:40:16,480 --> 00:40:18,480
+that's really those kind of things that we manage in
+
+1277
+00:40:18,480 --> 00:40:21,920
+the project is not only code and software
+
+1278
+00:40:20,318 --> 00:40:23,39
+we manage those kind of knowledge base
+
+1280
+00:40:23,39 --> 00:40:27,759
+for intelligent {inaudiable} organization
+
+1281
+00:40:26,79 --> 00:40:29,200
+we have some specific one like the notice list
+
+1283
+00:40:28,899 --> 00:40:32,480
+this one is a pretty small one that you use for the GDPR aspect
+
+1285
+00:40:32,480 --> 00:40:36,480
+but this one can be used for anything you want,
+
+1287
+00:40:35,480 --> 00:40:40,960
+It's for informing the analyst or the user of MISP when he
+
+1288
+00:40:39,358 --> 00:40:41,440
+touched some specific information in MISP
+
+1290
+00:40:41,440 --> 00:40:45,280
+that could impact for example the legal framework and so on
+
+1292
+00:40:44,280 --> 00:40:49,280
+it's actively use in the intelligence community,
+
+1293
+00:40:47,119 --> 00:40:50,960
+law enforcement and so on maybe less in
+
+1294
+00:40:49,280 --> 00:40:52,880
+security operation center but it's
+
+1295
+00:40:50,960 --> 00:40:54,880
+coming more and more due to the legal
+
+1296
+00:40:52,880 --> 00:40:56,240
+side of information sharing and
+
+1297
+00:40:54,880 --> 00:40:58,480
+especially storing information that might contain personal information
+
+1299
+00:40:58,480 --> 00:41:02,480
+then we have another one called the
+
+1300
+00:40:59,679 --> 00:41:08,159
+warning list and Andras quickly mentioned this kind of recurring problems or false positives
+
+1303
+00:41:06,559 --> 00:41:12,719
+and the one in MISP are basically list of existing potential false positives
+
+1305
+1306
+00:41:12,719 --> 00:41:17,439
+for example we have lists of well-known IP addresses from Microsoft, for example.
+
+1308
+00:41:17,440 --> 00:41:20,800
+We have list of things like domain names used by Google and so on
+
+1310
+00:41:20,800 --> 00:41:25,599
+that's already helping users to find out
+
+1311
+00:41:23,519 --> 00:41:27,119
+if something might be a false positive
+
+1312
+00:41:25,599 --> 00:41:28,559
+and we do that automatically and we
+
+1313
+00:41:27,119 --> 00:41:30,800
+maintain those libraries because one {inaudiable MISP/reason} they're automatically updated regularly
+
+1315
+00:41:30,800 --> 00:41:34,79
+I think we have around 50 lists nowadays
+
+1318
+00:41:34,79 --> 00:41:38,160
+It's really useful when you do on a day-to-day basis and creating events and
+
+1320
+00:41:38,159 --> 00:41:41,838
+so on you can really find and spot things that might be a false positive in advance
+
+1323
+00:41:41,838 --> 00:41:48,0
+2503.119 --> 2508
+by having those warning lists enabled
+
+1324
+00:41:45,280 --> 00:41:49,839
+and again it's up to the user to select
+
+1325
+00:41:48,0 --> 00:41:53,39
+2508 --> 2511.04
+one {inaudiable} warning list or to enable everything depending on the different use case
+
+1328
+00:41:52,800 --> 00:41:55,920
+so that's one of those {inaudiable} pillar
+
+1329
+00:41:54,480 --> 00:41:57,519
+knowledge base i mean a lot of
+
+1330
+00:41:55,920 --> 00:41:57,519
+contributions coming from threat parties
+
+1332
+00:41:57,519 --> 00:42:02,480
+are coming from that aspect so it's not really programmers
+
+1333
+00:42:00,719 --> 00:42:03,679
+or coders that are contributing there
+
+1334
+00:42:02,480 --> 00:42:05,599
+but it's more analysts and people doing really threat intelligence
+
+1336
+00:42:05,599 --> 00:42:10,160
+or classification and so on 
+
+1337
+00:42:08,318 --> 00:42:12,79
+is really something that is useful for everyone
+
+1338
+00:42:10,159 --> 00:42:14,159
+without being your direct contributions on the code
+
+1340
+00:42:14,159 --> 00:42:18,719
+then over the times we we we became a kind of de facto standard and
+
+1342
+00:42:18,719 --> 00:42:22,480
+uh nowadays is even more than a de facto standard, is a standard
+
+1344
+00:42:22,480 --> 00:42:27,199
+We published as an interesting engineering task force draft
+
+1346
+00:42:27,199 --> 00:42:31,439
+all those documents especially the core format
+
+1348
+00:42:31,440 --> 00:42:35,200
+and to ease that for the development of external tools
+1350
+00:42:35,199 --> 00:42:39,279
+integration and so on. 
+
+1351
+00:42:38,0 --> 00:42:40,119
+2558 --> 2561.119
+So if you're interested you can go to the
+
+1352
+00:42:39,280 --> 00:42:42,319
+MISP platform website where we describe the different standards that we
+
+1354
+00:42:42,318 --> 00:42:47,199
+published. We even co-host standards that are for people
+
+1356
+00:42:47,199 --> 00:42:51,598
+integrating with MISP
+
+1357
+00:42:50,480 --> 00:42:53,599
+and we have specific standards for example for the object template
+
+1359
+00:42:53,599 --> 00:42:56,800
+and that's something that we will talkabout but that's something that was
+
+1360
+00:42:54,800 --> 00:42:58,79
+
+1361
+00:42:56,800 --> 00:42:59,839
+really a need for us from the early beginning of MISP
+
+1363
+00:42:59,838 --> 00:43:02,799
+a lot of organizations want to have their own structure of information
+
+1365
+00:43:02,800 --> 00:43:06,880
+about objects and so on and we have a flexible model in MISP to
+
+1367
+00:43:06,880 --> 00:43:11,358
+really create your own data models and this one is standardized too
+
+1369
+00:43:11,358 --> 00:43:15,358
+and it's really helping sharing communities to
+
+1371
+00:43:15,358 --> 00:43:20,318
+extend MISP as they wish and their models without breaking the
+
+1373
+00:43:20,318 --> 00:43:24,79
+the standards itself so that's really interesting for for showing you new models
+
+1376
+00:43:24,79 --> 00:43:28,79
+and then next to that we will do everything possible to help community
+
+1378
+00:43:28,79 --> 00:43:31,359
+and Andras just mentioned the question of the
+
+1380
+00:43:31,358 --> 00:43:35,679
+legal aspect and i think maybe some of
+
+1381
+00:43:33,599 --> 00:43:38,640
+you already have this order to
+
+1382
+00:43:35,679 --> 00:43:40,399
+seek legal team about the information sharing policies and so on
+
+1384
+00:43:40,400 --> 00:43:44,880
+we try to make it easier so we publish this kind of compliance document
+
+1386
+00:43:44,880 --> 00:43:48,160
+and so on it's part of the MISP project
+
+1387
+00:43:46,719 --> 00:43:50,879
+everything is open source again so everything we do is open source and
+
+1389
+00:43:50,880 --> 00:43:55,760
+on open access. You can reuse it and so on. We have for example a specific
+
+1391
+00:43:55,760 --> 00:44:01,679
+document about building communities which is something that we do within the X-ISAC project
+
+1394
+00:44:01,679 --> 00:44:08,960
+and it's containing kind of best practices what are kind of agreement that you can
+
+1397
+00:44:08,960 --> 00:44:11,119
+use when doing a setup of sharing communities.
+
+1399
+00:44:11,119 --> 00:44:15,440
+Up to things about how to do contextualization and so on
+
+1400
+00:44:13,280 --> 00:44:17,40
+so that's that's maybe something that
+
+1401
+00:44:15,440 --> 00:44:17,519
+for an organization that wants to boost up an ISAC or sharing communities they can
+
+1404
+00:44:19,760 --> 00:44:23,760
+look at those documents and so on so it's again a thing that we try to help
+
+1406
+00:44:23,760 --> 00:44:30,800
+for example we produce kind of OSINT feeds of existing reports and so on to
+
+1408
+00:44:30,800 -->  00:44:36,880
+not only have software ready but to have some content and to show what kind of
+
+1411
+00:44:36,880 --> 00:44:42,559
+information can be shared within different MISP communities.
+
+1413
+00:44:42,559 --> 00:44:48,880
+So let us some get some of the naming conventions out of the way
+
+1415
+00:44:48,880 --> 00:44:52,880
+before we start with the hands-on stuff and
+
+1416
+00:44:50,400 --> 00:44:58,719
+just a quick explanation of the different uh data points and uh and naming conventions
+
+1419
+00:44:57,119 --> 00:45:00,400
+that we use for them so it's a bit easier afterwards
+
+1421
+00:45:00,400 --> 00:45:08,0
+this can be a bit overwhelming, don't worry we'll go through everything step by step also
+
+1424
+00:45:04,639 --> 
+during the hands-on part 
+
+1426
+00:45:05,519 --> 00:45:13,440
+So basically all the data that goes into MISP, we separate into two main layers
+
+1427
+00:45:11,358 --> 00:45:14,880
+one we call data layer which is really everything it has to do with
+
+1429
+00:45:14,880 --> 00:45:22,0
+individual data points their compositioning and so on
+
+1432
+00:45:20,400 --> 00:45:23,358
+So everything that we share in MISP in general in this regard
+
+1433
+00:45:22,0 --> 00:45:25,199
+2722 --> 2725.2
+starts with something that we call an event, these are our general
+
+1435
+00:45:25,199 --> 00:45:28,559
+envelopes for information so that means that
+
+1437
+00:45:28,559 --> 00:45:32,960
+whenever we're describing an incident, we're describing a threat report 
+
+1439
+00:45:32,960 --> 00:45:36,0
+2732.96 --> 2736
+we're describing a watch list that we recurringly update
+
+1441
+00:45:36,0 --> 00:45:40,400
+2736 --> 2740.4
+and they will all be grouped into something that we call an event
+
+1443
+00:45:40,400 --> 00:45:45,680
+So the name is a little bit controversial at times, we try to pick a name
+
+1445
+00:45:45,679 --> 00:45:49,519
+that is the least amount of a loaded term that we could find
+
+1448
+00:45:51,440 --> 00:45:56,240
+but obviously even with that there it can be a bit confusing but just consider
+
+1450
+00:45:56,239 --> 
+it as a generic container for data that has some contextual linking
+ 
+1453
+00:45:59,39 --> 00:46:06,318
+then each of these events is populated with lists of attributes. 
+
+1455
+00:46:05,318 --> 00:46:09,838
+So attributes are the most basic data points in MISP
+
+1457
+00:46:09,838 --> 00:46:13,279
+an attribute can describe for example an IP address
+
+1459
+00:46:13,280 --> 00:46:21,199
+you can describe a file hash or it can describe a car plate number for example
+
+1462
+00:46:21,199 --> 00:46:27,759
+It's basically just an individual data point with some basic context around it
+
+1465
+00:46:27,760 --> 00:46:30,800
+such as describing in what context this was seen in
+
+1467
+00:46:30,800 --> 00:46:32,960
+what type we're using to describe the attribute, 
+
+1469
+00:46:32,960 --> 00:46:39,679
+for example that we're using an MD5 hash to describe the hash of a file
+
+1471
+00:46:39,679 --> 00:46:44,318
+would be one of those descriptions, hopefully not used as much these days
+
+1473
+00:46:44,318 --> 00:46:51,920
+but that's just an example and then we can take these individual attributes
+
+1476
+00:46:49,599 --> 00:46:55,318
+and composite them into what we call objects that are describing multifaceted concepts.
+
+1478
+00:46:54,318 --> 00:46:59,440
+For example, a file object would be described by a list of attributes
+
+1480
+00:46:59,440 --> 00:47:05,760
+including a file name, different file hashes, maybe file entropy and so on and so forth.
+
+1484
+00:47:05,760 --> 00:47:11,440
+Each of these individual objects and attributes can then be further interlinked by what we call references.
+
+1487
+00:47:11,440 --> 00:47:15,119
+So that means that most of the time when we're describing data in MISP 
+
+1489
+00:47:15,119 --> 00:47:20,0
+we're trying to tell a story so we're thinking graphs instead of individual data points
+
+1492
+00:47:20,0 --> 00:47:24,559
+2840 --> 2844.559
+that means that we can for example, describe the entire flow of an attack
+
+1494
+00:47:24,559 --> 00:47:28,79
+from the initial attack vector all the way to the exploitation
+
+1496
+00:47:28,79 --> 00:47:33,599
+using the interconnected graphs using these references so we could say
+
+1498
+00:47:33,599 --> 00:47:36,960
+initially it all started with an email that was received
+
+1500
+00:47:36,960 --> 00:47:40,559
+that contained for example a malicious sample which then had to send this effect
+
+1503
+00:47:42,480 --> 00:47:45,838
+in our infrastructure so all of these different steps can be then described
+
+1506
+00:47:45,0 --> 00:47:53,519
+2868 --> 2873.52
+via different references there then to aggregate this information
+
+1508
+00:47:53,519 --> 00:47:58,79
+into and aggregate the sightings of this information via structure
+
+1510
+00:47:58,79 --> 00:48:02,280
+that basically captures sightings from our different information sources 
+
+1512
+00:48:01,280 --> 00:48:05,760
+that means if you have an IDS that is generating alerts
+
+1514
+00:48:05,760 --> 00:48:10,640
+you can feed information back on when individual attributes were seen
+
+1516
+00:48:10,639 --> 00:48:16,159
+in your network, in your premises or at your partners and so on
+
+1518
+00:48:16,159 --> 00:48:21,920
+so this is basically it for the data layer, these are our main building blocks for that.
+
+1521
+00:48:21,920 --> 00:48:27,599
+now in order to contextualize this information, we have different tools at our disposal.
+
+1523
+00:48:27,599 --> 00:48:32,160
+The most simple one is what we call tags these are basic text labels that 
+
+1525
+00:48:31,159 --> 00:48:35,598
+we attach on individual data points or entire events
+
+1527
+00:48:35,599 --> 00:48:39,440
+and these can either be created freely or most commonly they come from what we call taxonomies.
+
+1530
+00:48:41,519 --> 00:48:46,400
+They're basically standardized vocabularies and that are either shared
+
+1532
+00:48:46,400 --> 00:48:54,880
+by us so the MISP project at large or by individual communities to their members so
+
+1535
+00:48:53,119 --> 00:48:57,39
+these vocabularies can include anything from for example something is simple and
+
+1537
+00:48:57,39 --> 00:49:01,279
+and commonly used as TLP to national classifications 
+
+1540
+00:49:01,279 --> 00:49:08,719
+to various different sectoral classifications and so on
+
+1541
+00:49:06,318 --> 00:49:12,79
+now if you wanted to provide more high-level information instead of just simple
+
+1544
+00:49:12,559 --> 00:49:16,640
+labels for the information we can use what we call galaxy clusters
+
+1546
+00:49:16,639 --> 00:49:20,400
+so galaxy cluster is basically a knowledge based element that we use as a label
+
+1549
+00:49:21,199 --> 00:49:24,879
+these can be either coming from standard libraries 
+
+1551
+00:49:24,880 --> 00:49:28,480
+such as the ones that we maintain or you can create them ad-hoc in MISP.
+
+1553
+00:49:28,480 --> 00:49:30,0
+That means if you're describing a threat actor 
+
+1555
+00:49:30,0 --> 00:49:35,358
+you could create create a threat actor galaxy cluster that describes the various metadata
+
+1557
+00:49:35,358 --> 00:49:38,558
+about the threat actor and then use this to label your data whenever you think
+
+1560
+00:49:38,880 --> 00:49:42,160
+that whatever you're describing is associated with a threat actor
+
+1562
+00:49:42,159 --> 00:49:46,480
+you can also create for example a galaxy cluster describing the different
+
+1564
+00:49:46,480 --> 00:49:53,760
+target sectors and then interlink using cluster relationships
+
+1566
+00:49:53,760 --> 00:50:04,559
+the threat actor galaxy clusters with target sectors with exploited TTP and so on and so forth
+
+1569
+00:50:03,440 --> 00:50:07,39
+So these are the high level structures that you can put on top of your data 
+
+1572
+00:50:06,719 --> 00:50:14,838
+basically to further contextualize it. Alex
+
+1574
+00:50:15,119 --> 00:50:21,39
+Yeah, so just to summarize it and that's always a lot of people are asking about it
+
+1577
+00:50:21,199 --> 00:50:26,319
+how do you summarize it about, for example in easy way you have to see really
+
+1580
+00:50:26,318 --> 00:50:29,838
+MISP {inaudiable environment/development} as an envelope and then you
+
+1581
+00:50:28,79 --> 00:50:32,318
+have information inside and then what Andras describe is basically
+
+1583
+00:50:32,318 --> 00:50:34,800
+different component that you have within that envelope and then you have
+
+1586
+00:50:35,760 --> 00:50:42,480
+contextual layers on that envelope and relationship that are basically based on on that.
+
+1589
+00:50:42,880 --> 00:50:50,400
+So, another thing that is very often and I think it is good to explain it, is about the
+
+1592
+00:50:48,960 --> 00:50:53,119
+terminology between indicators, attributes, and so on that is
+
+1594
+00:50:53,119 --> 00:50:57,358
+a different especially indicator of compromise and so on
+
+1596
+00:50:57,358 --> 00:51:01,440
+In MISP, an attribute is close to an indicator
+
+1598
+00:51:01,440 --> 00:51:05,599
+and we have this kind of flexible models where
+
+1600
+00:51:05,599 --> 00:51:09,200
+maybe some of you are familiar with observables in MISP
+
+1602
+00:51:09,199 --> 00:51:13,440
+we call it attributes and those observables are basically depending on the type
+
+1605
+00:51:13,440 --> 00:51:20,0
+So, we have a specific flag in attributes which is basically defining
+
+1608
+00:51:20,0 --> 00:51:23,599
+3080 --> 3083.599
+if information can be used automatically for detection
+
+1610
+00:51:23,599 --> 00:51:29,960
+and that's i think one of the most important aspects when we talk about attribute in MISP
+
+1613
+00:51:28,880 --> 00:51:34,119
+an attribute can become an observable or become an indicator of compromise
+
+1615
+00:51:33,119 --> 00:51:37,880
+depending on the simple flag and this is quite important because
+
+1618
+00:51:37,280 --> 00:51:43,599
+a lot of analysis and so on will depend on that and especially all you will use that afterwards
+
+1621
+00:51:43,599 --> 00:51:48,39
+if you plan for example to use the data into a protective systems and so on 
+ 
+1624
+00:51:48,39 --> 00:51:54,79
+the IDS flags need to be set so the thing is if i take an example 
+
+1626
+00:51:54,79 --> 00:51:56,480
+you reverse the malware and this malware is connected to google.com for testing the connectivity
+
+1629
+00:51:59,519 --> 00:52:04,79
+obviously you will have an attribute for example www.google.com
+
+1632
+00:52:03,79 --> 00:52:09,440
+and this one is an interesting indicator for information for the analyst
+
+1634
+00:52:09,440 --> 00:52:14,0
+so like that you can for example maybe cluster those kind of malware together as in this kind of behavior
+
+1637
+00:52:14,0 --> 00:52:19,279
+3134 --> 3136.64
+nevertheless you are not really interested in that information as an indicator of compromise
+
+1641
+00:52:19,280 --> 00:52:23,480
+because it will generate a huge amount of false positive 
+
+1644
+00:52:23,480 --> 00:52:28,640
+but if for example at some point you have an IP address that is really dedicated to that malware 
+
+1646
+00:52:28,639 --> 00:52:39,719
+then you will set the IDS flag, so the thing is when you define in MISP these flags
+
+1649
+00:52:38,760 --> 00:52:41,599
+and we will show you later on it's very important because it will define what you can do 
+
+1652
+00:52:41,599 --> 00:52:48,639
+3164 --> 3166.64
+with information later on if you're going to automate and so on like
+
+1655
+00:52:48,159 --> 00:52:52,239
+In MISP, what we try to do too instead of having just indicators
+
+1657
+00:52:52,239 --> 00:52:57,280
+it's very common and i think many of you know about it you might see for example 
+
+1660
+00:52:57,280 --> 00:53:01,599
+a list of hashes so like for example MD5 hashes without any context
+
+1662
+00:53:01,599 --> 00:53:05,280
+and sometimes it's difficult to know exactly what we are talking about
+
+1664
+00:53:05,280 --> 00:53:11,599
+Are we talking about MD5 of malicious sample, are we talking about md5 of legitimate software,
+
+1667
+00:53:11,599 --> 00:53:17,39
+are we talking about the MD5 value of the X.509 certificate, 
+
+1669
+00:53:17,39 --> 00:53:29,719
+are we talking about an MD5 as a mutex in memory 
+
+1670
+00:53:19,679 --> 00:53:25,759
+we have plenty of way of seeing those kind of MD5 so we try in MISP to have what we call the
+
+1673
+00:53:25,759 --> 00:53:30,318
+kind of i would not say {inaudiable keep shine/kill shine} but at least contextualization a category that
+
+1675
+00:53:30,318 --> 00:53:35,279
+help to see in which context this has been seen
+
+1677
+00:53:35,280 --> 00:53:41,119
+and as for example if 1 MD5 might have a payload delivery, telling that in which scope this has been set
+
+1680
+00:53:40,559 --> 00:53:45,440
+So that means in MISP we have always and complementary type
+
+1682
+00:53:45,440 --> 00:53:52,639
+so for example for an MD5 files you can say that this one is from a file or is an md5 of a fingerprint thing
+
+1686
+00:53:52,639 --> 00:53:59,679
+So that means, always in MISP try to have as an indicator all those three information together 
+
+1689
+00:53:59,679 --> 00:54:06,639
+so it is giving at least more context and if you cannot set this context MISP will try to automatically set it.
+
+1692
+00:54:05,639 --> 00:54:12,239
+So attributes are equal to indicators but with a bit more of information which is useful for you
+
+1695
+00:54:12,239 --> 00:54:19,358
+At least being in a way to understand what is in a position to understand what you have in front of you
+
+1699
+00:54:19,358 --> 00:54:28,400
+when you have to treat those attributes.
+
+1700
+00:54:25,358 --> 00:54:29,920
+So this is just a brief view of what this looks like. 
+
+1702
+00:54:29,920 --> 00:54:36,239
+We're going to see this more in practice basically the idea is that all the data that we have in  MISP
+
+1705
+00:54:36,239 --> 00:54:43,798
+if it's well defined allows us to draw a graph out of the data and allows us to tell a story more easily
+
+1708
+00:54:42,880 --> 00:54:55,798
+So here we see a simple example that basically shows the bank account that is associated with the threat actor
+
+1712
+00:54:54,480 --> 00:55:00,679
+With all the various different data points with it and then we can basically relate these
+
+1715
+00:54:59,280 --> 00:55:03,200
+different data points to each other and give the relationship a term as well 
+
+1718
+00:55:04,880 --> 00:55:08,160
+So in this case we see from the chart immediately there that that person is the owner of that
+
+1720
+00:55:08,159 --> 00:55:13,119
+bank account with all those different data points for us as humans it's it's generally much more
+
+1724
+00:55:13,119 --> 00:55:18,839
+easily understood if we look at a graph like that and tell the story that way 
+
+1727
+00:55:17,839 --> 00:55:22,480
+then if we look at a tabularized view of the data.
+
+1728
+00:55:20,798 --> 00:55:24,239
+So one of the goals and something that we hope that we get out of 
+ 
+1731
+00:55:24,239 --> 00:55:32,480
+going through trainings like these is to really convert also the participants
+
+1732
+00:55:29,679 --> 00:55:38,558
+to to see the value of producing data in that way instead of just sharing raw indicator lists for example.
+
+1735
+00:55:40,0 --> 00:55:45,199
+3340 --> 3343.2
+And that's again what we think that's really important is the contextualization again.
+
+1738
+00:55:45,280 --> 00:55:50,480
+So i mentioned we have the galaxies in MISP and we have plenty of representation
+
+1741
+00:55:50,318 --> 00:55:55,838
+threat actors and so on and obviously one that is quite important is the MITRE Attack one
+
+1744
+00:55:54,719 --> 00:55:57,759
+so MITRE Attack is {inaduiable stored/performed} as a galaxy
+
+1746
+00:55:57,760 --> 00:56:01,520
+and we have this flexible {inaduiable mosaic/table} in MISP that you can represent those kind of
+
+748
+00:56:01,519 --> 00:56:07,39
+matrix-like model which is a case for Attack which is a very convenient way of representing the 
+
+1752
+00:56:07,679 --> 00:56:14,480
+different techniques in a progressive way used by the attackers and that's exactly what we can do in MISP. 
+
+1755
+00:56:14,159 --> 00:56:22,79
+So you have this kind of model and we have different model formats so again we have an advanced
+
+1758
+00:56:22,79 --> 00:56:30,838
+i would say integration with Attack but you can extend it with multiple different kinds of galaxies which are
+
+1762
+00:56:30,0 --> 00:56:33,838
+3390 --> 3393.839
+similar to Attack or complementary for example we have the Industrial Control System of Attack,
+
+1765
+00:56:34,400 --> 00:56:39,440
+it's a separated galaxy, you can even create a custom one directly in the system 
+
+1768
+00:56:39,440 --> 00:56:46,519
+and then you can filter out your data and so on and that's exactly the thing why we are i would say
+
+1771
+00:56:46,880 --> 00:56:51,480 
+in bracket pushing people to do more contextualization, it would be useful forthem at the end
+
+1774
+00:56:51,599 --> 00:56:58,960
+because this kind of information is really showing you for example your gap in your defense
+
+1778
+00:56:58,960 --> 00:57:02,720
+your specific things that the techniques that are not used by an attacker 
+
+1780
+00:57:02,719 --> 00:57:05,279
+you might ask why, maybe because you are missing a specific detection point that you cannot
+
+1783
+00:57:05,279 --> 00:57:12,239
+detect this kind of attacks or things like that so it's really actively using the data
+
+1786
+00:57:12,239 --> 00:57:15,759
+to show something meaningful with it and i think Attack is one of the way
+
+1788
+00:57:15,760 --> 00:57:19,119 
+but if you can combine this with additional information like site links, 
+
+1789
+00:57:19,119 --> 00:57:22,239
+contextualization of the relationship between different objects and so on
+
+1792
+00:57:22,239 --> 00:57:26,558
+basically everything in hand to improve your posture and secure it.
+
+1794
+00:57:26,559 --> 00:57:29,0
+Yeah perhaps something to add to this as well,
+
+1796
+00:57:29,0 --> 00:57:33,838
+some of the additional advantages is the moment that you encode all this information along
+
+1798
+00:57:33,838 --> 00:57:39,39
+with the data you can start asking those those questions from your tool basically
+
+1800
+00:57:39,39 --> 00:57:47,838
+for example show me what sort of threats my constituency is facing over the past year
+
+1804
+00:57:45,760 --> 00:57:49,760
+and overlayed over how what sort of threats it was facing a year ago 
+
+1806
+00:57:49,760 --> 00:57:52,319
+what are the trends that have evolved since then
+
+1808
+00:57:52,318 --> 00:57:58,960
+the other thing that it really helps with is it also gives you a high level overview of individual reports
+
+1811
+00:57:56,400 --> 00:58:06,78
+that means if I'm looking at an event in MISP and it has 800 different attributes described in there
+
+1815
+00:58:06,79 --> 00:58:10,719
+making any sense out of that quickly is very difficult, but getting a high level overview using MITRE Attack
+
+1818
+00:58:10,719 --> 00:58:16,239
+where you say oh okay this has to deal with spearphishing, it has to deal with information exfiltration,
+
+1821
+00:58:16,239 --> 00:58:22,79
+so these immediately tell me the story of what i'm dealing with without having to dig deeper into the data itself
+
+1825
+00:58:22,79 --> 00:58:27,480
+so it is incredibly useful for an analyst that is trying to make sense of the data that you're sharing.
+
+1828
+00:58:27,480 --> 00:58:36,0
+Also, as for the sharing itself i mean one of the main goals with MISP is obviously to share information,
+
+1831
+00:58:36,0 --> 00:58:43,280
+We haven't really talked about the sharing mechanisms yet, we basically have a bunch of different functionalities in MISP
+
+1834
+00:58:42,880 --> 00:58:48,639
+that we're going to see over the next two days the deal with distributing the information.
+
+1838
+00:58:48,639 --> 00:58:55,280
+One of the most obvious ones to tackle is basically who is to be the recipient of information that we're sharing
+
+1842
+00:58:55,280 --> 00:59:04,400
+so basically MISP, we can basically set the distribution settings for each individual data point individually
+
+1846
+00:59:04,400 --> 00:59:10,760
+or for entire collections of data in one shot so that means if we create an event we can decide who we share the event with 
+
+1849
+00:59:09,760 --> 00:59:15,160
+but we can further restrict individual attributes or objects further. 
+
+1854
+00:59:14,838 --> 00:59:26,79
+Now, who we share the information with gets decided on using one of two different means,
+
+1857
+00:59:25,79 --> 00:59:29,39
+one of them is a simple system where we tell MISP you are allowed to distribute it to everyone 
+
+1858
+00:59:28,440 --> 00:59:31,280
+that has access to this community, for example.
+
+1860
+00:59:31,280 --> 00:59:39,440
+Or to everyone that is directly connected to my community but you can also define more strict distribution lists
+
+1863
+00:59:37,838 --> 00:59:44,400
+what we call sharing groups where you individually name the organizations that are to be the recipients.
+
+1868
+00:59:44,400 --> 00:59:52,159
+Now on top of that, one of the things that we often struggle with is especially if you're in some of those communities
+
+1872
+00:59:51,159 --> 01:00:01,39
+or you're taking part or assisting some of the communities where sharing any information might lead to reputation or financial loss.
+
+1876
+01:00:01,39 --> 01:00:04,318
+For example in the financial sector we have these worries very often
+
+1878
+01:00:04,318 --> 01:00:08,318
+where if a financial organization were to share any information out
+
+1880
+01:00:08,318 --> 01:00:11,838
+it could be misconstrued as a successful attack against them.
+
+1882
+01:00:11,838 --> 01:00:15,719
+So instead, they choose to basically even if it was something completely benign
+
+1884
+01:00:14,719 --> 01:00:20,239
+that they caught in their sandboxes, in their honeypots, whatever
+
+1887
+01:00:19,199 --> 01:00:24,399
+and they decide not to share it out of fear of incurring this reputation loss.
+
+1889
+01:00:24,399 --> 01:00:29,440
+So one of the things that we have in MISP is this system called Delegation 
+
+1891
+01:00:29,440 --> 01:00:31,920
+where you can, for example appoint your ISAC,
+ 
+1892
+01:00:29,679 --> 01:00:38,558
+your central authority for a community, a national CSIRT, whatever 
+
+1893
+01:00:38,558 --> 01:00:41,599
+with the responsibility of taking over the data that you produce
+
+1898
+01:00:41,599 --> 01:00:43,480
+and to share it out in their name  
+
+1900
+01:00:43,480 --> 01:00:48,838
+so that way, it's basically a semi anonymized information sharing 
+
+1901
+01:00:48,559 --> 01:00:50,880
+where you are completely removed from the data that is shared out
+
+1903
+01:00:50,880 --> 01:00:55,500
+so the only two parties that will know who the originator of the data is you
+
+1904
+01:00:55,500 --> 01:01:01,500
+and whoever is taking over the data and taking over responsibility for the data.
+
+1909
+01:01:02,0 --> 01:01:05,280
+On top of that, one of the things that we wanted to achieve with MISP 
+
+1911
+01:01:05,280 --> 01:01:08,720
+was basically to build a collaboration with our different partners
+
+1913
+01:01:08,719 --> 01:01:11,519
+so it means that whenever we're sharing information we don't want it to
+
+1915
+01:01:11,519 --> 01:01:14,358
+be a one-way communication, so we don't want to have 
+
+1916
+01:01:13,358 --> 01:01:17,500
+this whole feed, provider and consumers relationship 
+
+1919
+01:01:17,500 --> 01:01:20,798
+but we want everyone to be able to chip in with their ideas
+
+1920
+01:01:20,798 --> 01:01:24,559
+so while anything that you produce in MISP will only be tied and editable
+
+1921
+01:01:24,559 --> 01:01:28,719
+by your organization, others can make proposals or counter analysis to it.
+
+1924
+01:01:28,719 --> 01:01:32,919
+So proposals are a system where you can basically flag information
+
+1926
+01:01:32,919 --> 01:01:37,0
+as incorrect and provide feedback on how to improve it 
+
+1928
+01:01:37,0 --> 01:01:40,0
+or how you can add your own perspective to an event,
+
+1930
+01:01:40,0 --> 01:01:42,0
+so if you receive an event from a third party you can say 
+
+1931
+01:01:42,0 --> 01:01:44,400
+oh i can improve it and {inaudiable listen/discern} this way
+
+1932
+01:01:44,400 --> 01:01:46,8
+please incorporate these changes in the event
+
+1933
+01:01:46,318 --> 01:01:49,500
+and then the original producer can make the decision 
+
+1935
+01:01:48,500 --> 01:01:51,519
+whether to incorporate it or discard your changes.
+
+1936
+01:01:51,519 --> 01:01:55,358
+As for counter analysis, this is what we call extend events.
+
+1938
+01:01:55,358 --> 01:01:59,358
+You can basically create an event that latches onto an original 
+
+1940
+01:01:59,358 --> 01:02:03,38
+shared by a third party and provide your own perspective of it.
+
+1942
+01:02:03,0 --> 01:02:06,160
+and then you keep full control of the data and you become the owner
+
+1945
+01:02:06,160 --> 01:02:09,440
+of whatever the extension is that you produce to the original event.
+
+1946
+01:02:09,440 --> 01:02:17,280
+This happens very often for us, for example when a vendor shares out a report.
+
+1949
+01:02:17,280 --> 01:02:21,0
+For example, we get a report from say kaspersky and we have additional information 
+
+1951
+01:02:20,0 --> 01:02:25,519
+or we have a different opinion on something, 
+
+1954
+01:02:25,519 --> 01:02:29,960
+then we might create an extended event that we share out to our constituency 
+
+1957
+01:02:28,960 --> 01:02:33,358
+which if they have access to the original report will latch onto it
+
+1958
+01:02:33,358 --> 01:02:37,0
+and it will show our perspective on top of the original.
+
+1960
+01:02:37,519 --> 01:02:41,440
+Now as for the exchange itself, every organization is free to host their own
+
+1962
+01:02:41,440 --> 01:02:44,960
+MISP instance and then they can decide who they want to interconnect with
+
+1964
+01:02:44,960 --> 01:02:48,240
+if both parties agree, a synchronization link is established
+
+1966
+01:02:48,239 --> 01:02:51,838
+between the two MISP instance and sharing can start flowing between them.
+
+1968
+01:02:51,838 --> 01:02:55,0
+Now this sharing is still governed by those distribution lists 
+
+1970
+01:02:54,500 --> 01:02:59,199
+and by some other mechanism that we'll talk about more tomorrow 
+
+1972
+01:02:59,199 --> 01:03:04,0
+but basically MISP exchanges information between the individual nodes
+
+1974
+01:03:02,798 --> 01:03:06,880
+in kind of a mesh network way.
+
+1976
+01:03:06,880 --> 01:03:10,0
+We also have feed system that allows us to generate feeds
+
+1977
+01:03:10,0 --> 01:03:11,960
+and to share those feeds with larger communities.
+
+1979
+01:03:11,960 --> 01:03:15,559
+So we as CIRCL we provide another SIEM feed, for example
+
+1980
+01:03:15,280 --> 01:03:20,0
+that we make freely available in our infrastructure
+
+1981
+01:03:20,0 --> 01:03:22,440
+anyone can just point their MISP to it and adjust the data
+
+1983
+01:03:22,440 --> 01:03:26,119
+and keep it updated using the feed system, this is also great
+
+1985
+01:03:26,119 --> 01:03:30,0
+if you have ever have the need of sharing information between air gap systems.
+
+1986
+01:03:29,559 --> 01:03:37,0
+You can just generate a feed based on certain filter rules and basically
+
+1989
+01:03:37,0 --> 01:03:43,0
+share it through say a flash drive or something like that, with an internal system
+
+1993
+01:03:44,0 --> 01:03:48,720
+Now all of these filtering options are basically user defined
+
+1994
+01:03:48,0 --> 01:03:50,880
+and they rely heavily also on the contextualization  
+
+1997
+01:03:50,880 --> 01:03:54,0
+so very often what we're doing and especially
+
+1998
+01:03:53,639 --> 01:03:57,0
+if you were ever signing up for the COVID instance that i mentioned before
+
+2000
+01:03:57,0 --> 01:04:00,559
+is you can also make those decisions based on the context, 
+
+2002
+01:04:00,559 --> 01:04:02,960
+what data you're interested in, what date you're interested in sharing out.
+
+2004
+01:04:02,960 --> 01:04:06,400
+For example, if you connect to COVID instance, we categorize all of the
+
+2006
+01:04:06,400 --> 01:04:10,79
+information into three categories, health related information
+
+2008
+01:04:9,79 --> 01:04:12,720
+so basically information about the spread of the pandemic,
+
+2010
+01:04:12,719 --> 01:04:16,399
+information about misinformation targeting COVID,
+
+2012
+01:04:16,400 --> 01:04:22,0
+and also cyber security threats that are targeting, that are now basically 
+
+2014
+01:04:21,0 --> 01:04:27,0
+abusing the whole COVID situation with remote work and so on.
+
+2016
+01:04:27,0 --> 01:04:30,0
+so if you're only interested in one or two of these three different topics,
+
+2019
+01:04:30,0 --> 01:04:36,0
+then you can set up your filters to only ingest data coming from a subset of the data set
+
+2021
+01:04:36,0 --> 01:04:39,0
+Very often what we do as well is we have these internal MISP clusters
+
+2023
+01:04:38,480 --> 01:04:44,0 
+in our own organization as well, where we collect information from different sources
+
+2026
+01:04:43,798 --> 01:04:48,798
+so we have a dedicated MISP instance where we purely collect spam information for example
+
+2029
+01:04:48,798 --> 01:04:52,0
+So for a constituency, anyone can forward their spam to us
+
+2031
+01:04:52,0 --> 01:04:55,358
+and we'll just generate events out of those in that MISP. 
+
+2032
+01:04:55,358 --> 01:04:56,38
+Generally this information 
+
+2033
+01:04:56,38 --> 01:05:00,480
+is really not interesting for a day-to-day detection use, for example.
+
+2036
+01:05:00,480 --> 01:05:03,679
+But what we do is we cache this information and we can cross-correlate
+
+2038
+01:05:03,679 --> 01:05:05,759
+this information with our operational instance
+
+2040
+01:05:05,760 --> 01:05:11,839
+that means if we start the analysis process and we start an investigation
+
+2042
+01:05:11,839 --> 01:05:14,239
+then we immediately see the moment we start encoding data points
+
+2044
+01:05:14,239 --> 01:05:18,598
+oh this is something that was already flagged once in our spam instance
+
+2046
+01:05:18,598 --> 01:05:210,359
+this information that that instance knows about, 
+
+2048
+01:05:210,359 --> 01:05:24,840
+then we can pivot over to that instance and fetch the information
+
+2049
+01:05:24,840 --> 01:05:28,400
+related to that same data point that we're also seeing in our current incident
+
+2052
+01:05:28,400 --> 01:05:32,0
+and perhaps get more information that is relevant for us from there.
+
+2054
+01:05:32,0 --> 01:05:35,79
+3932 --> 3936.079
+So basically very often we have these multi MISP internal enclaves
+
+2057
+01:05:35,79 --> 01:05:42,0
+that help us basically to separate different concerns and
+
+2058
+01:05:41,0 --> 01:05:44,0
+different collection mechanisms into their own instances.
+
+2060
+01:05:45,440 --> 01:05:49,39
+Just in that scope and I think is linked to the question that we had
+
+2062
+01:05:49,39 --> 01:05:52,799
+regarding the multi MISP internal enclave
+
+2064
+01:05:52,798 --> 01:05:57,599
+someone was asking about synchronizing with an existing MISP and so.
+
+2066
+01:05:57,599 --> 01:06:00,720
+You have this kind of local enclave options, where you can synchronize to MISP
+
+2068
+01:06:00,719 --> 01:06:05,199
+like they behave in the same organization, that's one of the interesting options.
+
+2071
+01:06:05,199 --> 01:06:09,358
+By the way, I would just give the mic to Josh that will explain a bit more about 
+
+2074
+01:06:09,358 --> 01:06:16,0
+the question and answer in zoom, to have directly the ability to answer the question answering the Zoom {inaudiable}
+
+2077
+01:06:18,400 --> 01:06:20,639
+I just want to jump in real quick, yeah if you have any questions 
+
+2080
+01:06:20,639 --> 01:06:26,400
+please direct them at the Q&A board versus the chat room 
+
+2081
+01:06:26,400 --> 01:06:28,0
+that way we can kind of keep a monitor of that 
+
+2082
+01:06:28,0 --> 01:06:32,0
+and other people can actually see the questions and the answer directly in that area
+
+2085
+01:06:32,0 --> 01:06:38,0
+so if you have questions feel free to use the Q&A board and that's all 
+
+2086
+01:06:38,0 --> 01:06:43,199
+thank you josh that's very useful so we can keep track of them and we can answer live or
+
+2090
+01:06:43,199 --> 01:06:44,700
+directly in the chat. 
+
+2091
+01:06:44,700 --> 01:06:49,520
+Okay great, so you see that the sharing aspect of MISP is like pretty extensive
+
+2094
+01:06:49,520 --> 01:06:53,279
+and you have different models of of usage of MISP 
+
+2097
+01:06:53,279 --> 01:06:58,318
+some people have this pre-conception about MISP being like oh I need to share with MISP 
+
+2099
+01:06:58,318 --> 01:07:01,119
+no, it's depending on what you want to do with your MISP instance
+
+2101
+01:07:01,119 --> 01:07:05,500
+and the core functionality of MISP is really to give, I would say the freedom 
+
+2104
+01:07:05,500 --> 01:07:11,0
+to each of the organizations to decide what to do with the data, if they want to share or not
+
+2106
+01:07:11,0 --> 01:07:17,359
+and we always design MISP that everyone can be kind of consumers
+ 
+2109
+01:07:17,359 --> 01:07:21,838
+so that basically getting data from different fields or producer or contributors
+
+2110
+01:07:21,838 --> 01:07:29,0
+Andras mentioned a different way of contributing like sightings, making proposals, things like that
+
+2114
+01:07:29,0 --> 01:07:34,240
+but it's up to the original contributors to decide if they want to share 
+
+2117
+01:07:34,240 --> 01:07:41,119
+that's really the thing, with MISP you can set up a MISP for like just pulling data, getting the data and that's it
+
+2120
+01:07:41,119 --> 01:07:46,480
+and if at one point in time you want to like push some data you can just enable it and that's it 
+
+2123
+01:07:46,480 --> 01:07:51,0
+so it's really, it's just a matter of just tuning the configuration ,
+
+2126
+01:07:51,0 --> 01:07:53,0
+the filtering really on the synchronization, if you want to share.
+
+2128
+01:07:53,0 --> 01:07:55,838
+So you don't have to change anything in your MISP instance
+
+2129
+01:07:55,838 --> 01:07:59,0
+it's just a matter of of what you decide and what you need to share
+
+2132
+01:07:59,0 --> 01:08:01,500
+and then the thing that is really important in MISP
+
+2133
+01:08:01,500 --> 01:08:05,760
+everything can be in flex. I mean even for example that we were mentioning 
+
+2135
+01:08:05,760 --> 01:08:10,240
+so those kind of envelope information might change over time
+
+2137
+01:08:10,239 --> 01:08:15,0
+we have seen for example some past or incident report that has been updated like 
+
+2140
+01:08:15,0 --> 01:08:19,0
+two years later because they discover who was the target or the threat actor behind
+
+2142
+01:08:19,0 --> 01:08:24,0
+and that's the thing that's really in MISP that we really want to be flexible 
+
+2145
+01:08:24,0 --> 01:08:29,500
+you can really expand the information either internally, add some comment and so on
+
+2147
+01:08:29,500 --> 01:08:35,359
+and to share this information in your different MISP instances and share with partners,
+
+2150
+01:08:35,359 --> 01:08:37,200
+your teams and so on so. 
+
+2151
+01:08:37,200 --> 01:08:42,0
+Really, MISP the core functionality of MISP is distributing information 
+
+2153
+01:08:42,0 --> 01:08:46,500
+but if you don't want to use it it's fine you just don't enable synchronization 
+
+2156
+01:08:46,500 --> 01:08:50,0
+but if you want to use partially, part of synchronization and so on 
+
+2158
+01:08:50,0 --> 01:08:53,838
+you just set up this kind of parameters. 
+
+2160
+01:08:55,0 --> 01:09:00,0
+So on top of collecting all this information
+
+2161
+01:09:00,0 --> 01:09:03,0
+and synchronizing the information that we talked about before
+
+2162
+01:09:03,0 --> 01:09:06,0
+we basically do a bunch of different stuff to improve 
+
+2164
+01:09:06,0 --> 01:09:08,0
+to handle the quality management of the information as well.
+
+2165
+01:09:08,0 --> 01:09:11,0
+So one of the first things we do, this is something we mentioned a bit before
+
+2167
+01:09:11,0 --> 01:09:16,0
+is we correlate information so we're interested in data that we've already seen before
+
+2170
+01:09:16,0 --> 01:09:18,559
+we also have the feedback loop that we mentioned before with sightings 
+
+2172
+01:09:18,560 --> 01:09:22,0
+that means we really want to get timeliness to the information as well
+
+2175
+01:09:22,0 --> 01:09:27,439
+so that we can but make better decisions on what we keep in our working data set for detection,
+
+2177
+01:09:27,439 --> 01:09:29,5
+for blocking and so on.
+
+2178
+01:09:29,520 --> 01:09:33,679
+The false positive management is a huge part so the warning list system
+
+2180
+01:09:33,679 --> 01:09:37,0
+where we basically exclude those typical false positives
+
+2182
+01:09:37,0 --> 01:09:41,440
+plays a very important role in the legal equation and this is also a community driven effort
+
+2184
+01:09:41,439 --> 01:09:46,0
+so if you want to get involved with that and build and include your own infrastructure 
+
+2187
+01:09:46,0 --> 01:09:48,399
+for example in the warning list and so on,
+
+2189
+01:09:48,399 --> 01:09:53,0
+either do it internally for your MISP or just share it with the open source community as well
+
+2191
+01:09:53,0 --> 01:09:56,719
+so let us know if you want to have that included as well 
+
+2193
+01:09:56,719 --> 01:09:58,500
+we haven't talked about enrichment systems yet 
+
+2195
+01:09:58,500 --> 01:10:00,880
+but basically one of the things that we do in MISP is 
+
+2196
+01:10:00,880 --> 01:10:05,238 
+we have connectors to all those different services that you might already be subscribed to
+
+2199
+01:10:05,238  --> 01:10:11,439
+so if you have domain tools, passive total or what way or any of the other services
+
+2202
+01:10:11,439 --> 01:10:15,439
+intel 471, and so on that you already subscribed to, then you can use  
+
+2205
+01:10:15,439 --> 01:10:19,600
+those services to enrich the data that you're working on 
+
+2208
+01:10:19,600 --> 01:10:22,0
+so if you have an incident and you're encoding information 
+
+2209
+01:10:22,0 --> 01:10:24,640
+you go out to all the services that you connect, that you have access to
+
+2210
+01:10:24,640 --> 01:10:29,600
+4224.64 --> 4228
+and fetch the information on what else those systems know about the different data points that you're encoding
+
+2213
+01:10:29,600 --> 01:10:33,679
+so that you basically get a jump start on your investigation.
+
+2215
+01:10:33,679 --> 01:10:37,119
+Now one of the most important things that we have to deal with and this is probably 
+
+2217
+01:10:37,119 --> 01:10:42,559
+i think about 50% of the code base of MISP 
+
+2219
+01:10:42,560 --> 01:10:46,560
+is basically the APIs and the libraries that deal with integrating MISP with other tools
+
+2221
+01:10:46,560 --> 01:10:50,580
+so everything that we can do by the UI, MISP is also exposed to the api
+
+2223
+01:10:50,580 --> 01:10:54,960
+and one of the most important things for us is to make sure that
+
+2225
+01:10:54,960 --> 01:11:00,0
+you can use MISP as simply a backend for another tool as opposed to just directly using MISP itself.
+
+2228
+01:11:00,0 --> 01:11:04,640
+As for timeliness, we haven't really touched on that yet.
+
+2230
+01:11:04,640 --> 01:11:10,480
+Besides the sighting aspect, you can also encode information about time ranges when something was seen
+
+2233
+01:11:10,480 --> 01:11:19,200
+and you can build a full timeline of the events that occurred during a cyber incident for example.
+
+2237
+01:11:19,200 --> 01:11:22,719
+So if you encode this information together with all your data points
+
+2239
+01:11:22,719 --> 01:11:26,960
+then you get an additional graph out of it that tells you when what happens
+
+2241
+01:11:26,960 --> 01:11:30,0
+and time-based correlations are really important as well.
+
+2243
+01:11:30,0 --> 01:11:33,599
+So very often when you're seeing two things happening at the same time
+
+2245
+01:11:33,600 --> 01:11:35,800
+they might be related with each other and 
+
+2248
+01:11:35,800 --> 01:11:40,960
+they might be worth digging into whether there is a link between those two things that happened.
+
+2250
+01:11:40,960 --> 01:11:43,480
+So something else that we will touch on more tomorrow 
+
+2251
+01:11:43,480 --> 01:11:47,200
+is we have a full indicator lifecycle management system in MISP.
+
+2254
+01:11:47,200 --> 01:11:50,0
+That means you can define your own rules and tune your own rules 
+
+2256
+01:11:50,0 --> 01:11:53,500
+on how you're going to be scoring and decaying indicators 
+
+2257
+01:11:53,500 --> 01:11:57,119
+based on all the contextualization that you have,
+
+2258
+01:11:57,119 --> 01:11:58,719
+based on the type of the data that you have, 
+
+2259
+01:11:58,719 --> 01:12:02,439
+based on source of the information that you have and so on and so forth.
+
+2260
+01:12:02,439 --> 01:12:09,0
+So we're going to go into much more detail on that tomorrow. Alex.
+
+2265
+01:12:15,359 --> 01:12:20,359
+Yeah, so I was just answering a question and then I will make it public in a minute
+
+2267
+01:12:20,359 --> 01:12:25,639
+that's a question about the API and using MISP. 
+
+2270
+01:12:25,639 --> 01:12:30,0
+There are different ways to evaluate the quality of the information that you share in MISP.
+
+2273
+01:12:30,0 --> 01:12:35,238
+One of those is obviously to look at statistics, There is a statistics version in MISP to see 
+
+2276
+01:12:35,238 --> 01:12:40,238
+for example, the kind of indicator shared by organization and so on.
+
+2278
+01:12:40,238 --> 01:12:43,279
+In addition to that, there is for example 
+
+2279
+01:12:43,279 --> 01:12:46,279
+MISP dashboard which includes a kind of gamification of the platforms
+
+2281
+01:12:46,279 --> 01:12:53,600
+and which is giving badges per organization depending on the kind of information that you share
+
+2284
+01:12:53,600 --> 01:12:59,520
+and that's a nice way to to find out if you are reaching a certain level of capabilities when using MISP
+
+2287
+01:12:59,520 --> 01:13:02,360
+where you basically have for example information like
+
+2289
+01:13:02,360 --> 01:13:08,960
+are you using sightings, do you use objects and stuff like that. 
+
+2292
+01:13:08,960 --> 01:13:12,0
+For example, thing that you can really look at if you want to see 
+
+2293
+01:13:12,0 --> 01:13:14,480
+if the quality of information that you create in MISP
+
+2296
+01:13:14,480 --> 01:13:19,560
+i would just following the standards what is following the best practices in the different organization
+
+2297
+01:13:19,560 --> 01:13:22,640
+is to compare with the {inaudiable} feed 
+
+2300
+01:13:22,640 --> 01:13:25,198
+there are some goods even in the OSINT feed and 
+
+2301
+01:13:25,198 --> 01:13:29,519
+for example, things that are really a good indicator is to see
+
+2303
+01:13:29,520 --> 01:13:32,880
+are you just using indicators and using objects, 
+
+2305
+01:13:32,880 --> 01:13:35,0
+are those objects linked together by using the relationship to it,
+
+2306
+01:13:35,0 --> 01:13:40,199
+are you using galaxies, are those galaxies at the event level, {inaudiable} level,
+
+2308
+01:13:40,198 --> 01:13:46,0
+do you have tags,  labels on specific objects or specific attributes and so on
+
+2311
+01:13:46,0 --> 01:13:52,960
+that's different parameters and i think the question from {inaudiable} is pretty good.
+
+2315
+01:13:52,960 --> 01:14:00,39
+and if you really want to dive into the KPI aspect of MISP and quality of information.
+
+2316
+01:14:00,39 --> 01:14:03,239
+In addition to what Andras just said 
+
+2320
+01:14:03,239 --> 01:14:07,600
+there are some other things about the quality of information shared within the community
+
+2321
+01:14:07,600 --> 01:14:11,920
+and there's some good examples in the MISP dashboard about the different badges
+
+2324
+01:14:11,920 --> 01:14:16,0
+there is even a model for sharing such kind of information.
+
+2326
+01:14:16,0 --> 01:14:19,0
+So another thing that is i think quite useful and 
+
+2329
+01:14:19,0 --> 01:14:23,520
+it was one of the core functionality of MISP was the correlation features.
+
+2330
+01:14:23,520 --> 01:14:29,119
+This one is, it looks like obvious but it's not always obvious 
+
+2332
+01:14:29,119 --> 01:14:32,800
+I mean a lot of tools in the security field exist but they don't do automatic correlations.
+
+2334
+01:14:32,800 --> 01:14:35,679
+For example, at the {inaudiable} we are using ticketing system  
+
+2337
+01:14:37,119 --> 01:14:39,0
+and sometimes it's very difficult to find if we have two correlating events 
+
+2338
+01:14:39,0 --> 01:14:42,820
+and what we decided in MISP which covers the cost. 
+
+2339
+01:14:42,820 --> 01:14:48,800
+I mean the correlation engine is maybe one of the costly aspects of using MISP on a database level.
+
+2341
+01:14:48,800 --> 01:14:49,919
+but it's really useful.
+
+2342
+01:14:49,919 --> 01:14:52,500
+For example, here we just have an example of 
+
+2343
+01:14:52,500 --> 01:15:00,500
+information about some malware spam that are used to share uh information about
+
+2348
+01:15:00,500 --> 01:15:04,239
+target campaigns for the financial malware
+
+2351
+01:15:04,239 --> 01:15:09,819
+and what we can see there is basically correlation on similar points
+
+2352
+01:15:09,819 --> 01:15:12,880
+and those ones are mainly IP addresses of the infrastructure
+
+2355
+01:15:12,880 --> 01:15:16,0
+but you can really spot interesting things there.
+
+2357
+01:15:16,0 --> 01:15:19,679
+For example, you see that the third {inaudiable bone/bin} in Germany share indicators,
+
+2360
+01:15:19,679 --> 01:15:24,0
+you have a polish bank sharing the same kind of indicators 
+
+2361
+01:15:24,0 --> 01:15:26,560
+we were sharing such kind of indicators too
+
+2362
+01:15:26,560 --> 01:15:30,640
+and even if they have different names or different contextualization 
+
+2365
+01:15:30,640 --> 01:15:33,439
+we can really spot similar infrastructure 
+
+2366
+01:15:33,439 --> 01:15:39,198
+so we can see okay, it's maybe the same actors using an infrastructure for different kind of things
+
+2369
+01:15:39,198 --> 01:15:45,679
+or for example we can actually see here that we have different names of the similar malware 
+
+2372
+01:15:45,679 --> 01:15:48,0
+so really this is important for example another thing that is interesting is
+
+2374
+01:15:48,0 --> 01:15:53,739
+for example if you have a sinkhole IP address setup by a antivirus company for example, 
+
+2377
+01:15:53,739 --> 01:15:57,560
+you can directly spot it. I mean if you have, I don't know, APT 29 
+
+2380
+01:15:57,560 --> 01:16:01,840
+and you have like three different criminals malware going on that one and so on 
+
+2383
+01:16:01,840 --> 01:16:05,600
+obviously it's usually not the same infrastructures but on the other hand 
+
+2385
+01:16:05,600 --> 01:16:08,39
+you can directly spot, okay this one is already take down 
+
+2386
+01:16:08,39 --> 01:16:12,159
+it's handled by this antivirus company and you can really handle it
+
+2388
+01:16:12,158 --> 01:16:20,679
+so it's really a way to quickly find if it's a new threat or something that is already known in the infrastructure
+
+2392
+01:16:22,439 --> 01:16:28,640
+So a little bit of the sightings themselves so we're going to see this more in practice
+
+2395
+01:16:28,640 --> 01:16:36,79
+basically we have a very simple interfacing list that allows us to to tell the community
+
+2398
+01:16:36,79 --> 01:16:40,158
+that we've seen an indicator, as well as when we've seen it
+
+2401
+01:16:40,158 --> 01:16:46,238
+and perhaps also include information on what tool we've picked up, what context we've seen,
+
+2402
+01:16:46,238 --> 01:16:50,359
+so sightings can have some metadata on top of just being a sighting. 
+
+2406
+01:16:50,359 --> 01:16:54,79
+We can also flag something that we call negative sightings which is a false positive sighting
+
+2409
+01:16:54,79 --> 01:16:59,0
+where we indicate that we've seen it but it produced issues for us so it was a false positive.
+
+2412
+01:16:59,0 --> 01:17:05,520
+We can also indicate that something is potentially going to be expired at a certain date,
+
+2415
+01:17:05,520 --> 01:17:10,0
+so this is interesting, for example, if we're in talks with a provider 
+
+2418
+01:17:10,0 --> 01:17:11,519
+and we know that there is going to be a takedown 
+
+2420
+01:17:11,519 --> 01:17:17,0
+then we can already indicate that okay, this is no longer an indicator after a certain point in time.
+
+2422
+01:17:17,0 --> 01:17:21,679
+Apart from that if you are ever dealing with bulk sightings,
+
+2424
+01:17:21,679 --> 01:17:28,0
+so if you want to for example just capture any IP address seen in your network or something like that
+
+2427
+01:17:28,0 --> 01:17:34,560
+there is another tool called SightingDB, which is developed by Devo, it's also an open source tool.
+
+2430
+01:17:34,560 --> 01:17:38,79
+It's really recommended to use that, it allows you to to capture massive massive amounts of data
+
+2432
+01:17:38,79 --> 01:17:45,539
+so if you're capturing the entire network flow of your constituency and or your organization 
+
+2436
+01:17:45,539 --> 01:17:49,920
+and just dumping all the data somewhere this is a great place to do it
+
+2439
+01:17:49,920 --> 01:17:53,760
+and it's a very fast lookup database that is integrated with MISP
+
+2441
+01:17:53,760 --> 01:17:58,500
+where MISP can automatically just query it for any of the indicators that you're seeing in MISP,
+
+2445
+01:17:58,500 --> 01:18:05,359
+and whether it was seen in your network, and in which time range it was seen in.
+
+2446
+01:18:03,0 --> 01:18:07,500
+interesting thing with that is it's also for historical values 
+
+2448
+01:18:07,500 --> 01:18:14,238
+so if you're just doing bulk collection of all the observables in your network
+
+2451
+01:18:14,238 --> 01:18:26,500
+and then even half a year later if it turns out that a indicator is being shared with you 
+
+2454
+01:18:26,500 --> 01:18:27,0
+that correlates with an observable that SightingDB from half a year ago 
+
+2456
+01:18:27,0 --> 01:18:30,0 
+then you know that you might need to launch an investigation into something
+
+2459
+01:18:30,0 --> 01:18:34,0
+that happened half a year ago in logs and so on based on the historic look up. 
+
+2460
+01:18:38,0 --> 01:18:41,0
+Alex
+
+2462
+01:18:41,0 --> 01:18:44,500
+Just complementary notes regarding sightings and
+
+2464
+01:18:44,500 --> 01:18:49,439
+that's something that is basically maybe the easiest way of sharing additional information
+
+2467
+01:18:49,439 --> 01:18:53,839
+it costs nothing and if you are connected to a MISP instance
+
+2468
+01:18:53,839 --> 01:18:56,319
+and you can tell someone else that you have seen it 
+
+2469
+01:18:56,319 --> 01:18:59,900
+it's really a quick thing that can be useful for many organizations.
+
+2473
+01:18:59,900 --> 01:19:04,500
+So the sighting itself sounds like a very small feature
+
+2474
+01:19:04,500 --> 01:19:10,399
+but at the end, it's a an easy one for contributing and helping the others to know
+
+2478
+01:19:10,399 --> 01:19:15,0
+if an indicator is still valuable and so on, so sighting is really something that 
+
+2481
+01:19:15,0 --> 01:19:22,920
+can basically be a kind of of entry-level things to do when sharing information 
+
+2484
+01:19:22,920 --> 01:19:28,500
+Something else that we have in MISP, this one is I think becoming more and more important
+
+2487
+01:19:28,500 --> 01:19:32,239
+and we will do a quick demo later regarding that.
+
+2489
+01:19:32,238 --> 01:19:37,0
+It's a timeline, i mean when we do analysis and so on,
+ 
+2490
+01:19:37,0 --> 01:19:40,0
+it's really i would say common to have a first seen, last seen 
+
+2492
+01:19:40,0 --> 01:19:42,159
+to see the evolution of things over time.
+
+2494
+01:19:42,159 --> 01:19:45,198
+In the example that you see on the screen there
+
+2496
+01:19:45,198 --> 01:19:47,319
+It's based on specific threat actors
+
+2497
+01:19:47,319 --> 01:19:54,839
+that sends a significant numbers of spear phishing 
+
+2499
+01:19:54,839 --> 01:20:00,0
+and those spear phishing are very well known when we collect those timestamps and so on.
+
+2503
+01:20:00,0 --> 01:20:03,0
+So you can really see and trace the evolution of a specific group and so on.
+
+2506
+01:20:03,0 --> 01:20:07,500
+This can be done automatically, for example passive dns records
+
+2507
+01:20:07,500 --> 01:20:13,0
+I have very often the first seen, last seen and automatically you can really build
+
+2510
+01:20:13,0 --> 01:20:18,0
+and create this kind of timeline because it can be really cumbersome if you have to do it manually
+
+2514
+01:20:18,0 --> 01:20:22,239
+So we have a nice view like that so that means every time you set a first seen, last seen
+
+2516
+01:20:22,239 --> 01:20:26,0
+on any attribute, object, and so on; it automatically populate on the timeline
+
+2518
+01:20:26,0 --> 01:20:31,7
+and it's an easy way to to see evolution, trend and so on for your analysis
+
+2521
+01:20:31,700 --> 01:20:39,280
+and this is a completely interactive so you can navigate over that.
+
+2522
+01:20:39,280 --> 01:20:42,0
+We will show that later.
+
+2524
+01:20:43,0 --> 01:20:47,39
+So for life cycle management, again this is something that we show briefly but 
+
+2527
+01:20:47,39 --> 01:20:49,480
+we're going to way more depth about that tomorrow 
+
+2528
+01:20:49,480 --> 01:20:53,519
+is basically here we see some examples of some attributes 
+
+2531
+01:20:53,519 --> 01:20:58,800
+that have scores applied to them coming from different scoring models.
+
+2532
+01:20:58,800 --> 01:21:03,0
+So we see there an IDS simple decaying model and then a custom model 
+
+2533
+01:21:03,0 --> 01:21:08,800
+titled "Model 5" that are basically running on each of those indicators 
+
+2535
+01:21:08,800 --> 01:21:13,500
+and they generate a score taking into account for things such as labels that are attached to them,
+
+2536
+01:21:13,500 --> 01:21:17,0
+the timestamp on when the attribute was created 
+
+2537
+01:21:17,0 --> 01:21:21,0
+as well as the timestamp of the different sightings that came in so generally
+
+2544
+01:21:21,0 --> 01:21:24,0
+if something is still being actively seen in your network 
+
+2545
+01:21:24,0 --> 01:21:28,0
+that is still relevant despite the indicator itself being perhaps older 
+
+2546
+01:21:28,0 --> 01:21:33,520
+and then using the score that gets generated from these different models that you define
+
+2551
+01:21:33,520 --> 01:21:37,500
+you can basically then make those decisions when you're exporting data to only include
+
+2554
+01:21:37,500 --> 01:21:43,0
+data above a certain threshold when you're feeding your SIEM for example.
+
+2556
+01:21:44,79 --> 01:21:48,500
+Yeah, and this one is quite interesting because you can really define 
+
+2557
+01:21:48,500 --> 01:21:52,159
+so the thing that is really important with the decaying of indicators
+
+2559
+01:21:52,159 --> 01:21:58,920
+you are not modifying that actually you are really just updating and overlapping 
+
+2564
+01:21:58,920 --> 01:22:01,759
+and you can just define those kind of models so that means for example
+
+2566
+01:22:01,759 --> 01:22:05,39
+even within a team where you don't agree on a specific model, you can have both models.
+
+2569
+01:22:05,39 --> 01:22:09,679
+It's very common, for example, to have models for intrusion detection systems
+
+2571
+01:22:09,679 --> 01:22:16,719
+and specific models for i don't know, endpoint, {inaudiable} or endpoint protection device
+
+2574
+01:22:16,719 --> 01:22:20,639
+and in MISP you have even a models or kind of simulator 
+
+2575
+01:22:20,639 --> 01:22:25,500
+where you can simulate the different model that you want to apply
+
+2578
+01:22:25,500 --> 01:22:28,920
+and to see what kind of lifetime you want to apply,
+
+2579
+01:22:28,920 --> 01:22:32,0
+when it decay, when for example you have a specific threshold where 
+
+2582
+01:22:32,0 --> 01:22:39,500
+basically say okay you don't use anymore those kind of data and you can do the mapping with 
+ 
+2583
+01:22:39,500 --> 01:22:45,500
+specific taxonomies you can with the different types, attributes, and so on
+
+2585
+01:22:45,500 --> 01:22:49,0
+directly in MISP and it is really a quick win.
+
+2588
+01:22:49,0 --> 01:22:53,500
+So you are not bound, for example, we know that some TIPs for example 
+
+2591
+01:22:53,500 --> 01:22:58,479
+have a kind of system-wide decaying models in MISP it is not like that,
+
+2593
+01:22:56,880 --> 01:23:02,679
+everyone has their models, we are sharing some models 
+
+2594
+01:23:02,679 --> 01:23:06,0
+and you can define what you want to use without really altering the data.
+
+2598
+01:23:06,0 --> 01:23:10,238
+So that means this kind of of information there is just an overlay 
+
+2599
+01:23:10,238 --> 01:23:15,0
+and you actually keep your own data in the systems without having any modification.
+
+2601
+01:23:17,0 --> 01:23:24,0
+And you can simulate that one.
+
+2605
+01:23:27,0 --> 01:23:31,0
+So when it comes to starting out, one of the trickiest things obviously is 
+
+2606
+01:23:31,0 --> 01:23:34,0
+when you're starting out with MISP is if you're staring as an empty instance 
+
+2607
+01:23:34,0 --> 01:23:37,198
+then getting started and encoding information is really tough 
+
+2610
+01:23:37,198 --> 01:23:40,0
+because you don't know what is really expected from the communities out there, you don't know how.
+
+2612
+01:23:40,0 --> 01:23:44,0
+It's a new tool, you don't really know how to get started. 
+
+2616
+01:23:44,0 --> 01:23:50,239
+So in order to ease this a little bit there are a bunch of different feeds some of those that we also provide ourselves
+
+2619
+01:23:50,239 --> 01:23:54,500
+which is obviously operational information something that you can use directly
+
+2622
+01:23:54,500 --> 01:24:00,799
+so these are OSINT feeds that we produce as well from our TLP white data set 
+
+2623
+01:24:00,799 --> 01:24:04,0
+and the idea is that this will really help with bootstrapping your processes.
+
+2625
+01:24:04,0 --> 01:24:08,0
+Look at the data we consider that generally well-formed
+
+2629
+01:24:08,0 --> 01:24:12,500
+and well contextualized. It should give you an idea of what data generally looks like in MISP.
+
+2631
+01:24:12,500 --> 01:24:15,500
+So don't start out with a fresh instance, 
+
+2632
+01:24:15,500 --> 01:24:18,0
+just go to your feed menu in your MISP when you're installing it
+
+2633
+01:24:18,0 --> 01:24:22,500
+and pull in some of these OSINT feeds so that you see the information already.
+
+2636
+01:24:23,500 --> 01:24:27,359
+Also it's a great way to test your internal tooling 
+
+2637
+01:24:27,359 --> 01:24:31,119
+so if you want to test the APIs, if you want to test internal synchronization,
+
+2640
+01:24:31,119 --> 01:24:33,500
+it's good to have larger data set already from the get go 
+
+2641
+01:24:33,500 --> 01:24:38,679
+so that you already see that the movement of the data is working as expected.
+
+2645
+01:24:38,679 --> 01:24:44,500
+Yeah, the other thing that you can do and where we're going to talk about that quite a bit tomorrow
+
+2648
+01:24:44,500 --> 01:24:50,500
+is basically figuring out which feeds are worth ingesting,
+
+2650
+01:24:50,500 --> 01:24:55,719
+how the feeds compare to each other, running overlap analysis between them and so on
+
+2653
+01:24:55,719 --> 01:25:00,0
+So this is something that this is quite a heavy topic for tomorrow.
+
+2656
+01:25:05,0 --> 01:25:08,0
+You're muted alex. 
+
+2657
+01:25:08,0 --> 01:25:09,500
+Yeah just discover {inaudiable this/MISP}.
+
+2658
+01:25:09,500 --> 01:25:12,0
+So as you can see for MISP,
+
+2659
+01:25:12,0 --> 01:25:15,300
+it's the development of MISP already done over the years, 
+
+2661
+01:25:15,300 --> 01:25:19,760
+based on the feedback of users and that's really one of the key elements for us.
+
+2663
+01:25:19,760 --> 01:25:22,0
+We wanted a tool for us that works 
+
+2665
+01:25:22,0 --> 01:25:28,879
+and it's key and based on that we wanted something that works for others too
+
+2667
+01:25:28,880 --> 01:25:33,679
+and i mean the tool is evolving over time so you see that we have plenty of functionalities
+
+2670
+01:25:33,679 --> 01:25:37,79
+On those two days of workshop we'll try to cover a part of it,
+
+2672
+01:25:37,79 --> 01:25:41,679
+we had already some good questions regarding how to customize this and so on.
+
+2675
+01:25:41,679 --> 01:25:45,119
+We might give you some hints how to do it and and so on,
+
+2677
+01:25:45,119 --> 01:25:47,0
+so we won't be able to cover everything in those two days 
+
+2678
+01:25:47,0 --> 01:25:54,0
+but you'll see that you can really update MISP based on your specific use cases and so on. 
+
+2679
+01:25:54,0 --> 01:26:00,500
+So MISP is there as a tool, what really usually matters and are the successful,
+
+2680
+01:26:00,500--> 01:26:07,0
+I would say, sharing communities depends on the practices or you do that and so on
+
+2687
+01:26:07,0 --> 01:26:11,0
+and we really want at least at the end, even if it's a complex tool and so on 
+
+2690
+01:26:11,0 --> 01:26:15,520
+to be as easy as possible for covering different use case 
+
+2691
+01:26:15,520 --> 01:26:17,500
+and that's really the thing that we want to do, 
+
+2693
+01:26:17,500 --> 01:26:19,520
+is for example for a lot of things that we have in MISP 
+
+2694
+01:26:19,520 --> 01:26:23,700
+and someone just asked the questions about how can you customize MISP
+
+2697
+01:26:23,700 --> 01:26:27,119
+a lot of things in MISP can be customized by just modifying some JSON files.
+
+2700
+01:26:27,119 --> 01:26:32,519
+It's the case for MISP objects so if you want to create a new object you just update the json files,
+
+2701 
+01:26:32,519 --> 01:26:39,500
+if you want to, for example, create a new taxonomies or create a new galaxy 
+
+2706
+01:26:39,50 --> 01:26:41,839
+you just create those kind of json files.
+
+2708
+01:26:41,839 --> 01:26:45,500
+You have other ways to update and change the behavior of MISP.
+
+2709
+01:26:45,500 --> 01:26:48,158
+it's based for example on MISP modules
+
+2710
+01:26:48,158 --> 01:26:51,439
+so if you want to change the behavior of the expansion and so on
+
+2712
+01:26:51,439 --> 01:26:58,800
+you can just play with MISP modules and we will quickly show you some examples on these modules
+
+2716
+01:26:58,800 --> 01:27:02,80
+but that's really simple i mean there's no {inaudiable}
+
+2719
+01:27:02,80 --> 01:27:10,239
+and that's the thing that you have to understand with MISP project is not just a small open source software somewhere
+
+2720
+01:27:10,239 --> 01:27:16,800
+it's really a set of combination of tool, software, packages, open standards,
+
+2721
+01:27:16,800 --> 01:27:23,799
+various best practices, shared knowledge base and obviously the community is using it.
+
+2728
+01:27:23,799 --> 01:27:26,500
+So that's really the thing that we will have we love with FIRST for example. 
+
+2731
+01:27:26,500 --> 01:27:31,0
+it is to have this kind of community, learning together, sharing information,
+
+2732
+01:27:31,0 --> 01:27:33,119
+and so that's that's really a key for us.
+
+2735
+01:27:33,119 --> 01:27:41,500
+We have, I think more than 500 contributors on the MISP project with even more nowadays.
+
+2738
+01:27:41,500 --> 01:27:45,500
+So if you want to become one of the contributors it's really straightforward i mean
+
+2739
+01:27:45,500 --> 01:27:48,800
+if you have something, a problem that you want to solve,
+
+2742
+01:27:48,800 --> 01:27:51,400
+for example on an object, you just do a pull request and
+
+2743
+01:27:51,400 --> 01:27:55,840
+it will be in MISP immediately and you become a contributor in the project 
+
+2747
+01:27:57,679 --> 01:27:58,0
+so really for us, it's really key in MISP 
+
+2748
+01:27:58,0 --> 01:28:02,0
+is to have a kind of tool that is supporting the different use cases
+
+2749
+01:28:02,0 --> 01:28:06,238
+Okay so before that, we do a break i will share you with you 
+
+2750
+01:28:06,238 --> 01:28:12,759
+some practical details on accessing the MISP training instance because there were some questions regarding that
+
+2755
+01:28:12,759 --> 01:28:20,0
+and after the break, we will do the hands-on practical session 
+
+2756
+01:28:20,0 --> 01:28:25,359
+with an example, so we will with a real example, so you will create the full event 
+
+2757
+01:28:25,359 --> 01:28:27,359
+based on some information that you receive.
+
+2759
+01:28:27,359 --> 01:28:36,500
+So first of all, I will give you some details about how to access the MISP instance.
+
+
+2763
+01:28:36,500 --> 01:28:42,500
+S0, first of all we have a {inaudiable acting/active} page 
+
+2764
+01:28:42,500 --> 01:28:48,500
+which I obviously share at some point in time and i will share it again.
+
+2766
+01:28:48,500 --> 01:28:54,799
+Yes. So there's a page with some pages that you can even edit.
+
+2769
+01:28:54,799 --> 01:29:00,0
+I will paste the link again in the chat for everyone.
+
+2772
+01:29:05,639 --> 01:29:11,319
+That's the link, so we have a 50 account on the training instance. 
+
+2773
+01:29:11,319 --> 01:29:14,159
+Pick randomly one
+
+2775
+01:29:14,158 --> 01:29:18,0
+it doesn't matter if you are multiple one using the same account but be careful
+
+2777
+01:29:18,0 --> 01:29:22,119
+don't change the password because maybe some people will complain,
+
+2780
+01:29:22,119 --> 01:29:30,800
+and then we have a "TrainingFIRST2021" password so super simple
+
+2782
+01:29:30,800 --> 01:29:33,600
+not so secure but that's fine it's a training instance.
+
+2785
+01:29:33,600 --> 01:29:41,0
+Just for the reference, for the one that doesn't want to use the training instance
+
+2786
+01:29:41,0 --> 01:29:44,0
+sometimes for whatever reason you want to use your own instance.
+
+2788
+01:29:44,0 --> 01:29:50,238
+We have different images, virtual box and VMware images for MISP.
+
+2791
+01:29:50,238 --> 01:29:54,158
+So if you want to play with MISP locally and so on.
+
+2793
+01:29:54,158 --> 01:29:57,279
+If you want to play with synchronization too, you can even connect those two 
+
+2794
+01:29:59,500 --> 01:30:05,280
+So and during the sessions we will connect to that instance so the instant is "iglocska.eu"
+
+2796
+01:30:05,280 --> 01:30:14,0
+and when you connect, you will get access to the instance.
+
+2799
+01:30:14,0 --> 01:30:18,158
+So you enter your training password so I will enter with my specific account
+
+2802
+01:30:18,158 --> 01:30:23,500
+and we will use that instance for the hands-on that we will do just after the break.
+
+2804
+01:30:23,500 --> 01:30:31,0
+So what i propose now is to do a 15 minute break and we start at 45, if it's fine for everyone
+
+2808
+01:30:31,0 --> 01:30:39,600
+and we will start by with the practical sessions with a specific email
+
+2811
+01:30:39,600 --> 01:30:43,600
+that we will share in the {inaudiable} as a practical example
+
+ 2813
+01:30:43,600 --> 01:30:51,300 
+so thank you for the one that join us now and we will start again at 45 
+
+2814
+01:30:51,300 --> 01:30:54,500
+to do the hands-on session. Thank you very much.
+
+2817
+01:30:55,500 --> 01:30:57,500
+Thank you.
+
+TODO
+2819
+01:44:10,399 --> 01:44:15,118
+okay and shall we get started
+
+2820
+01:44:16,238 --> 01:44:22,559
+sure welcome back everyone
+
+2821
+01:44:20,79 --> 01:44:24,399
+okay so now what we're going to be doing
+
+2822
+01:44:22,560 --> 01:44:26,80
+is we're going to look a little bit
+
+2823
+01:44:24,399 --> 01:44:27,679
+at miss pizza so we've talked plenty
+
+2824
+01:44:26,79 --> 01:44:28,960
+about it but we haven't actually done
+
+2825
+01:44:27,679 --> 01:44:30,560
+anything with it yet
+
+2826
+01:44:28,960 --> 01:44:32,560
+so i really encourage everyone that has
+
+2827
+01:44:30,560 --> 01:44:35,199
+a misfits to also play along
+
+2828
+01:44:32,560 --> 01:44:36,800
+and to create your own events what we're
+
+2829
+01:44:35,198 --> 01:44:37,439
+going to be doing is we're going to go
+
+2830
+01:44:36,800 --> 01:44:40,639
+through as
+
+2831
+01:44:37,439 --> 01:44:41,359
+any fictional little exercise assume
+
+2832
+01:44:40,639 --> 01:44:44,0
+6280.639 --> 6284
+that you
+
+2833
+01:44:41,359 --> 01:44:44,799
+that you receive an email from uh in
+
+2834
+01:44:44,0 --> 01:44:46,560
+6284 --> 6286.56
+this case
+
+2835
+01:44:44,800 --> 01:44:49,840
+luxembourg english telco this is certain
+
+2836
+01:44:46,560 --> 01:44:52,80
+of them describing an incident of a very
+
+2837
+01:44:49,840 --> 01:44:53,520
+simplistic incident
+
+2838
+01:44:52,79 --> 01:44:56,479
+of what happened what we're going to be
+
+2839
+01:44:53,520 --> 01:44:59,280
+trying to do now is to model this a miss
+
+2840
+01:44:56,479 --> 01:45:00,839
+and to explain how you can further
+
+2841
+01:44:59,279 --> 01:45:02,800
+improve it and contextualize this
+
+2842
+01:45:00,840 --> 01:45:05,39
+information
+
+2843
+01:45:02,800 --> 01:45:06,239
+so before we start uh once you're logged
+
+2844
+01:45:05,39 --> 01:45:08,639
+into the
+
+2845
+01:45:06,238 --> 01:45:09,678
+into miss pinsons such as the hosted
+
+2846
+01:45:08,639 --> 01:45:11,359
+training instance
+
+2847
+01:45:09,679 --> 01:45:13,840
+this is what you're going to be seeing
+
+2848
+01:45:11,359 --> 01:45:15,198
+so it's a it's a little bit squeezed on
+
+2849
+01:45:13,840 --> 01:45:18,639
+alex's screen
+
+2850
+01:45:15,198 --> 01:45:21,599
+but the idea is that you have a list of
+
+2851
+01:45:18,639 --> 01:45:23,279
+events that are listed on the main page
+
+2852
+01:45:21,600 --> 01:45:25,280
+so we're in the event index this is our
+
+2853
+01:45:23,279 --> 01:45:26,719
+landing page when we load up misp
+
+2854
+01:45:25,279 --> 01:45:28,79
+and each of these individual lines
+
+2855
+01:45:26,719 --> 01:45:30,158
+represents an event so they're
+
+2856
+01:45:28,79 --> 01:45:33,519
+describing either an attack
+
+2857
+01:45:30,158 --> 01:45:34,960
+or perhaps a report recurring
+
+2858
+01:45:33,520 --> 01:45:38,800
+distribution
+
+2859
+01:45:34,960 --> 01:45:40,0
+6334.96 --> 6340
+or a certain type of of indicator lists
+
+2860
+01:45:38,800 --> 01:45:41,600
+and so on
+
+2861
+01:45:40,0 --> 01:45:43,439
+6340 --> 6343.44
+so what you're seeing here is you have
+
+2862
+01:45:41,600 --> 01:45:45,679
+each of these events having an id
+
+2863
+01:45:43,439 --> 01:45:47,359
+and some metadata around it so these are
+
+2864
+01:45:45,679 --> 01:45:48,960
+this metadata can be either coming from
+
+2865
+01:45:47,359 --> 01:45:50,719
+this galaxy cluster
+
+2866
+01:45:48,960 --> 01:45:52,639
+system that we mentioned for example
+
+2867
+01:45:50,719 --> 01:45:55,679
+describing different
+
+2868
+01:45:52,639 --> 01:45:56,880
+attacker techniques the different types
+
+2869
+01:45:55,679 --> 01:45:58,560
+of
+
+2870
+01:45:56,880 --> 01:46:00,560
+ransomwares in this case or attack
+
+2871
+01:45:58,560 --> 01:46:02,0
+6358.56 --> 6362
+patterns that are leveraged
+
+2872
+01:46:00,560 --> 01:46:03,520
+and then if we scroll a bit further
+
+2873
+01:46:02,0 --> 01:46:04,319
+6362 --> 6364.32
+right so this is a bit lower resolution
+
+2874
+01:46:03,520 --> 01:46:06,800
+there that we see
+
+2875
+01:46:04,319 --> 01:46:07,920
+but uh you should have it visible on the
+
+2876
+01:46:06,800 --> 01:46:12,159
+same page
+
+2877
+01:46:07,920 --> 01:46:14,239
+um you see the information about uh
+
+2878
+01:46:12,158 --> 01:46:15,439
+what this event is trying to describe to
+
+2879
+01:46:14,238 --> 01:46:17,198
+us
+
+2880
+01:46:15,439 --> 01:46:19,599
+it's simple to understand text-based
+
+2881
+01:46:17,198 --> 01:46:21,198
+representation now this instance is used
+
+2882
+01:46:19,600 --> 01:46:22,719
+for trainings in general so it's going
+
+2883
+01:46:21,198 --> 01:46:24,559
+to be filled with a lot of junk
+
+2884
+01:46:22,719 --> 01:46:27,39
+interspersed with real data that is
+
+2885
+01:46:24,560 --> 01:46:28,800
+coming from our tlp wide feed
+
+2886
+01:46:27,39 --> 01:46:31,679
+so you're going to see some obviously
+
+2887
+01:46:28,800 --> 01:46:33,840
+weird events in there
+
+2888
+01:46:31,679 --> 01:46:35,840
+these are just there for testing just
+
+2889
+01:46:33,840 --> 01:46:37,199
+players playing during an exercise and
+
+2890
+01:46:35,840 --> 01:46:40,159
+so on
+
+2891
+01:46:37,198 --> 01:46:41,439
+but also some real events there so what
+
+2892
+01:46:40,158 --> 01:46:43,118
+we're going to be doing now is we're
+
+2893
+01:46:41,439 --> 01:46:44,879
+going to create our own event based on
+
+2894
+01:46:43,118 --> 01:46:45,759
+that email that we received it's also on
+
+2895
+01:46:44,880 --> 01:46:47,600
+the hackamd
+
+2896
+01:46:45,760 --> 01:46:48,880
+page so just have a look at email
+
+2897
+01:46:47,600 --> 01:46:51,119
+exactly
+
+2898
+01:46:48,880 --> 01:46:52,239
+and we need to start encoding with that
+
+2899
+01:46:51,118 --> 01:46:54,319
+event
+
+2900
+01:46:52,238 --> 01:46:55,839
+so before we include anything in misp
+
+2901
+01:46:54,319 --> 01:46:57,920
+the first thing that we need to do
+
+2902
+01:46:55,840 --> 01:47:00,239
+is we need to create a new event so this
+
+2903
+01:46:57,920 --> 01:47:02,399
+is where everything starts
+
+2904
+01:47:00,238 --> 01:47:04,238
+way to do it is to just click on add
+
+2905
+01:47:02,399 --> 01:47:05,359
+event on the left side of the menu
+
+2906
+01:47:04,238 --> 01:47:07,359
+and then you start with a very
+
+2907
+01:47:05,359 --> 01:47:11,198
+simplistic form that where we can
+
+2908
+01:47:07,359 --> 01:47:13,679
+describe the event in a very high level
+
+2909
+01:47:11,198 --> 01:47:15,118
+so here you see it's it's the first step
+
+2910
+01:47:13,679 --> 01:47:16,399
+is very straightforward
+
+2911
+01:47:15,118 --> 01:47:17,920
+the import the things that we have to
+
+2912
+01:47:16,399 --> 01:47:18,479
+watch out for or here is we already
+
+2913
+01:47:17,920 --> 01:47:20,239
+decide
+
+2914
+01:47:18,479 --> 01:47:22,638
+who gets to see the event so this is the
+
+2915
+01:47:20,238 --> 01:47:23,279
+distribution level and that we need to
+
+2916
+01:47:22,639 --> 01:47:25,520
+set and
+
+2917
+01:47:23,279 --> 01:47:27,599
+basically a basic description of it as
+
+2918
+01:47:25,520 --> 01:47:30,159
+for the distribution itself
+
+2919
+01:47:27,600 --> 01:47:32,159
+you have different uh ways of
+
+2920
+01:47:30,158 --> 01:47:33,679
+interacting with the data here already
+
+2921
+01:47:32,158 --> 01:47:35,359
+so one of the decisions that you have to
+
+2922
+01:47:33,679 --> 01:47:35,760
+make even if you're going to share to
+
+2923
+01:47:35,359 --> 01:47:37,759
+the
+
+2924
+01:47:35,760 --> 01:47:40,0
+6455.76 --> 6460
+wider community out there is do i keep
+
+2925
+01:47:37,760 --> 01:47:41,119
+this internal until i'm ready to share
+
+2926
+01:47:40,0 --> 01:47:43,118
+6460 --> 6463.119
+it with the community
+
+2927
+01:47:41,118 --> 01:47:44,719
+or do i already make it visible to
+
+2928
+01:47:43,118 --> 01:47:46,559
+anyone that has access to the data in
+
+2929
+01:47:44,719 --> 01:47:48,960
+the community
+
+2930
+01:47:46,560 --> 01:47:50,800
+now keep in mind that we have a
+
+2931
+01:47:48,960 --> 01:47:52,79
+publishing process in misp so until an
+
+2932
+01:47:50,800 --> 01:47:54,320
+event is published
+
+2933
+01:47:52,79 --> 01:47:55,118
+it is not propagated out to other missed
+
+2934
+01:47:54,319 --> 01:47:56,639
+instances
+
+2935
+01:47:55,118 --> 01:47:58,158
+that means anyone on the current miss
+
+2936
+01:47:56,639 --> 01:47:59,679
+pencils can see the data
+
+2937
+01:47:58,158 --> 01:48:02,0
+6478.159 --> 6482
+but it will not jump to a different
+
+2938
+01:47:59,679 --> 01:48:04,319
+misspen since at this point in any way
+
+2939
+01:48:02,0 --> 01:48:05,439
+6482 --> 6485.44
+but if you if you're creating it on a
+
+2940
+01:48:04,319 --> 01:48:07,679
+hosted instance
+
+2941
+01:48:05,439 --> 01:48:08,799
+for example if you if your isak is
+
+2942
+01:48:07,679 --> 01:48:10,319
+running a miss pinstance and you're
+
+2943
+01:48:08,800 --> 01:48:11,840
+creating it on that one directly
+
+2944
+01:48:10,319 --> 01:48:14,0
+6490.32 --> 6494
+then this already has an impact on who
+
+2945
+01:48:11,840 --> 01:48:16,400
+can see the data
+
+2946
+01:48:14,0 --> 01:48:18,0
+6494 --> 6498
+so the option here either go with your
+
+2947
+01:48:16,399 --> 01:48:19,519
+organization only and then
+
+2948
+01:48:18,0 --> 01:48:21,679
+6498 --> 6501.679
+raise the distribution level once it's
+
+2949
+01:48:19,520 --> 01:48:23,840
+ready to be released or you already
+
+2950
+01:48:21,679 --> 01:48:25,440
+involve addressing the process and you
+
+2951
+01:48:23,840 --> 01:48:27,279
+pick something like community only where
+
+2952
+01:48:25,439 --> 01:48:28,319
+others can chip in with their ideas from
+
+2953
+01:48:27,279 --> 01:48:30,960
+the get-go
+
+2954
+01:48:28,319 --> 01:48:32,559
+so this is up to you it's a risk versus
+
+2955
+01:48:30,960 --> 01:48:34,719
+efficiency question
+
+2956
+01:48:32,560 --> 01:48:35,600
+do i want to share the information and
+
+2957
+01:48:34,719 --> 01:48:37,760
+potentially
+
+2958
+01:48:35,600 --> 01:48:39,199
+overshare a bit by including by
+
+2959
+01:48:37,760 --> 01:48:40,960
+accidentally uploading information that
+
+2960
+01:48:39,198 --> 01:48:43,198
+is not yet
+
+2961
+01:48:40,960 --> 01:48:45,679
+confirmed that it can be shared out
+
+2962
+01:48:43,198 --> 01:48:47,439
+versus losing out on perhaps others
+
+2963
+01:48:45,679 --> 01:48:49,118
+immediately jumping on board and saying
+
+2964
+01:48:47,439 --> 01:48:50,399
+okay this is also something we've seen
+
+2965
+01:48:49,118 --> 01:48:51,599
+we've already done the analysis of it
+
+2966
+01:48:50,399 --> 01:48:53,599
+here you go
+
+2967
+01:48:51,600 --> 01:48:54,960
+so you have to balance those two things
+
+2968
+01:48:53,600 --> 01:48:59,39
+out so let's start
+
+2969
+01:48:54,960 --> 01:49:01,920
+no for example for example what
+
+2970
+01:48:59,39 --> 01:49:03,359
+you have is when people are working on a
+
+2971
+01:49:01,920 --> 01:49:06,960
+case by default they say
+
+2972
+01:49:03,359 --> 01:49:08,79
+it's organization and at one point in
+
+2973
+01:49:06,960 --> 01:49:10,79
+time
+
+2974
+01:49:08,79 --> 01:49:11,840
+the team lead for example decide at some
+
+2975
+01:49:10,79 --> 01:49:13,359
+point it's okay no you can share it
+
+2976
+01:49:11,840 --> 01:49:16,239
+to a wider community and then you change
+
+2977
+01:49:13,359 --> 01:49:17,839
+the distribution level
+
+2978
+01:49:16,238 --> 01:49:19,519
+yeah indeed so let's start with the
+
+2979
+01:49:17,840 --> 01:49:20,800
+organization only for now uh
+
+2980
+01:49:19,520 --> 01:49:22,560
+for different reasons that we'll get
+
+2981
+01:49:20,800 --> 01:49:24,0
+6560.8 --> 6564
+back to later on it allows us to show
+
+2982
+01:49:22,560 --> 01:49:25,119
+off another feature afterwards that is
+
+2983
+01:49:24,0 --> 01:49:26,800
+6564 --> 6566.8
+handy
+
+2984
+01:49:25,118 --> 01:49:28,639
+so we start with that then we have to
+
+2985
+01:49:26,800 --> 01:49:29,199
+describe this the threat level so this
+
+2986
+01:49:28,639 --> 01:49:31,840
+is
+
+2987
+01:49:29,198 --> 01:49:33,598
+a very subjective question uh threat
+
+2988
+01:49:31,840 --> 01:49:34,800
+level will depend a lot on what sort of
+
+2989
+01:49:33,599 --> 01:49:36,560
+an organization you are
+
+2990
+01:49:34,800 --> 01:49:38,0
+6574.8 --> 6578
+versus who you're sharing it with so we
+
+2991
+01:49:36,560 --> 01:49:40,400
+all have different interpretations of
+
+2992
+01:49:38,0 --> 01:49:41,760
+6578 --> 6581.76
+what we consider a high threat level
+
+2993
+01:49:40,399 --> 01:49:43,679
+we have some descriptions for each of
+
+2994
+01:49:41,760 --> 01:49:45,520
+these fields uh
+
+2995
+01:49:43,679 --> 01:49:46,800
+predefined if you click on the little
+
+2996
+01:49:45,520 --> 01:49:49,199
+information box
+
+2997
+01:49:46,800 --> 01:49:51,520
+it will tell you that hi is uh
+
+2998
+01:49:49,198 --> 01:49:53,519
+sophisticated apt malware or zero day
+
+2999
+01:49:51,520 --> 01:49:55,40
+attack
+
+3000
+01:49:53,520 --> 01:49:57,599
+please just freely disregard this
+
+3001
+01:49:55,39 --> 01:49:58,479
+because nowadays a lot of information
+
+3002
+01:49:57,599 --> 01:50:00,159
+sharing
+
+3003
+01:49:58,479 --> 01:50:02,79
+happens in completely different domains
+
+3004
+01:50:00,158 --> 01:50:03,598
+so if a fraud team is sharing
+
+3005
+01:50:02,79 --> 01:50:06,880
+information about
+
+3006
+01:50:03,599 --> 01:50:08,400
+fraudster their definition of high
+
+3007
+01:50:06,880 --> 01:50:08,719
+threat level would be very different
+
+3008
+01:50:08,399 --> 01:50:11,439
+from
+
+3009
+01:50:08,719 --> 01:50:13,198
+those in cyber security for example so
+
+3010
+01:50:11,439 --> 01:50:15,519
+generally it's just a subjective
+
+3011
+01:50:13,198 --> 01:50:17,198
+first measure but a lot of organizations
+
+3012
+01:50:15,520 --> 01:50:19,40
+users use this to briefly filter out
+
+3013
+01:50:17,198 --> 01:50:21,439
+what they should tackle first
+
+3014
+01:50:19,39 --> 01:50:22,960
+so still use it with care if you don't
+
+3015
+01:50:21,439 --> 01:50:25,759
+want to use this field
+
+3016
+01:50:22,960 --> 01:50:27,679
+picking undefined is fine too analysis
+
+3017
+01:50:25,760 --> 01:50:30,560
+the next field describes how far along
+
+3018
+01:50:27,679 --> 01:50:33,39
+you've come with the analysis process
+
+3019
+01:50:30,560 --> 01:50:34,480
+so basically uh with this what you're
+
+3020
+01:50:33,39 --> 01:50:36,158
+telling the communities i'm just
+
+3021
+01:50:34,479 --> 01:50:39,118
+starting out with the analysis
+
+3022
+01:50:36,158 --> 01:50:40,719
+these are my initial findings versus for
+
+3023
+01:50:39,118 --> 01:50:41,839
+example saying that my analysis process
+
+3024
+01:50:40,719 --> 01:50:44,960
+is already complete
+
+3025
+01:50:41,840 --> 01:50:48,0
+6641.84 --> 6648
+i'm not going to be digging more for now
+
+3026
+01:50:44,960 --> 01:50:50,840
+i consider this complete if you have
+
+3027
+01:50:48,0 --> 01:50:54,960
+6648 --> 6654.96
+additional information then obviously
+
+3028
+01:50:50,840 --> 01:50:56,880
+uh already start collaborating with us
+
+3029
+01:50:54,960 --> 01:50:58,399
+so just pick whichever is most
+
+3030
+01:50:56,880 --> 01:50:59,840
+appropriate for you let's just go with
+
+3031
+01:50:58,399 --> 01:51:01,679
+initial for now
+
+3032
+01:50:59,840 --> 01:51:04,159
+and then comes the most important part
+
+3033
+01:51:01,679 --> 01:51:06,319
+of this form which is
+
+3034
+01:51:04,158 --> 01:51:08,319
+describing the event info so this is a
+
+3035
+01:51:06,319 --> 01:51:10,158
+brief description for analysts that are
+
+3036
+01:51:08,319 --> 01:51:12,79
+looking at the data that describe
+
+3037
+01:51:10,158 --> 01:51:13,198
+the best described the event that you're
+
+3038
+01:51:12,79 --> 01:51:16,719
+basically uh
+
+3039
+01:51:13,198 --> 01:51:17,678
+sharing now be brief here and be careful
+
+3040
+01:51:16,719 --> 01:51:20,480
+about
+
+3041
+01:51:17,679 --> 01:51:22,639
+including very domain or organization
+
+3042
+01:51:20,479 --> 01:51:23,279
+specific information one of the mistakes
+
+3043
+01:51:22,639 --> 01:51:25,279
+that
+
+3044
+01:51:23,279 --> 01:51:26,319
+that people often make here is for
+
+3045
+01:51:25,279 --> 01:51:29,359
+example uh
+
+3046
+01:51:26,319 --> 01:51:30,479
+typing a ticket number or ticket id in
+
+3047
+01:51:29,359 --> 01:51:32,158
+there
+
+3048
+01:51:30,479 --> 01:51:33,759
+so if you have a ticketing system and
+
+3049
+01:51:32,158 --> 01:51:35,198
+you basically start your investigation
+
+3050
+01:51:33,760 --> 01:51:36,800
+from your ticketing system
+
+3051
+01:51:35,198 --> 01:51:38,719
+sharing out something like what alex has
+
+3052
+01:51:36,800 --> 01:51:40,239
+typed there is not very handy for anyone
+
+3053
+01:51:38,719 --> 01:51:41,679
+else nobody will have a clue what you
+
+3054
+01:51:40,238 --> 01:51:43,198
+mean with that
+
+3055
+01:51:41,679 --> 01:51:44,639
+another mistake that can happen here
+
+3056
+01:51:43,198 --> 01:51:46,0
+6703.199 --> 6706
+very often is especially if you're
+
+3057
+01:51:44,639 --> 01:51:47,840
+starting out small and
+
+3058
+01:51:46,0 --> 01:51:49,760
+6706 --> 6709.76
+in turn initially you're only keeping
+
+3059
+01:51:47,840 --> 01:51:51,520
+the events for yourself
+
+3060
+01:51:49,760 --> 01:51:53,760
+and then perhaps later on you decide
+
+3061
+01:51:51,520 --> 01:51:56,159
+that you want to maybe perhaps
+
+3062
+01:51:53,760 --> 01:51:57,520
+after all share it out to a community
+
+3063
+01:51:56,158 --> 01:51:58,960
+then one of the things that can really
+
+3064
+01:51:57,520 --> 01:52:00,719
+hurt you at that point is if you've
+
+3065
+01:51:58,960 --> 01:52:02,319
+used different language for example to
+
+3066
+01:52:00,719 --> 01:52:03,520
+describe the event info so we've seen
+
+3067
+01:52:02,319 --> 01:52:06,639
+this very often
+
+3068
+01:52:03,520 --> 01:52:07,360
+we instead of describing the things in
+
+3069
+01:52:06,639 --> 01:52:10,480
+english we
+
+3070
+01:52:07,359 --> 01:52:10,479
+choose our own languages
+
+3071
+01:52:14,479 --> 01:52:18,79
+and myself is hungarian we are we're
+
+3072
+01:52:16,719 --> 01:52:21,599
+pretty prone to doing this
+
+3073
+01:52:18,79 --> 01:52:22,639
+in general uh and this is generally
+
+3074
+01:52:21,599 --> 01:52:24,400
+something that will hurt us
+
+3075
+01:52:22,639 --> 01:52:25,920
+in the long term because uh once you
+
+3076
+01:52:24,399 --> 01:52:28,399
+share it out with a more
+
+3077
+01:52:25,920 --> 01:52:30,79
+international community you either have
+
+3078
+01:52:28,399 --> 01:52:32,799
+to go through the effort of translating
+
+3079
+01:52:30,79 --> 01:52:34,399
+it or basically make it illegible for
+
+3080
+01:52:32,800 --> 01:52:36,800
+the recipient
+
+3081
+01:52:34,399 --> 01:52:37,839
+so stick to something simple simple
+
+3082
+01:52:36,800 --> 01:52:41,199
+phrasing
+
+3083
+01:52:37,840 --> 01:52:45,840
+be as concise as possible
+
+3084
+01:52:41,198 --> 01:52:45,839
+but make sure that it's still understood
+
+3085
+01:52:51,920 --> 01:52:55,440
+we know that it's targeting the telco
+
+3086
+01:52:53,359 --> 01:52:57,198
+sector in luxembourg and we know that we
+
+3087
+01:52:55,439 --> 01:52:57,598
+have a malware sample so that's a pretty
+
+3088
+01:52:57,198 --> 01:52:59,598
+nice
+
+3089
+01:52:57,599 --> 01:53:01,39
+short explanation of what the event is
+
+3090
+01:52:59,599 --> 01:53:02,560
+about
+
+3091
+01:53:01,39 --> 01:53:04,800
+so once we click submit we have our
+
+3092
+01:53:02,560 --> 01:53:06,480
+event created and we already see that
+
+3093
+01:53:04,800 --> 01:53:08,400
+that our event suddenly has a lot of
+
+3094
+01:53:06,479 --> 01:53:09,39
+data that we didn't intentionally put in
+
+3095
+01:53:08,399 --> 01:53:11,39
+there yet
+
+3096
+01:53:09,39 --> 01:53:13,359
+so we see a bunch of tags that are
+
+3097
+01:53:11,39 --> 01:53:15,840
+applied to the event we see that
+
+3098
+01:53:13,359 --> 01:53:16,799
+the event already has information about
+
+3099
+01:53:15,840 --> 01:53:18,639
+uh
+
+3100
+01:53:16,800 --> 01:53:20,0
+6796.8 --> 6800
+who created the information who the
+
+3101
+01:53:18,639 --> 01:53:22,0
+6798.639 --> 6802
+local owners and
+
+3102
+01:53:20,0 --> 01:53:24,238
+6800 --> 6804.239
+information and so on so this basically
+
+3103
+01:53:22,0 --> 01:53:25,439
+6802 --> 6805.44
+takes a lot of local settings from uh
+
+3104
+01:53:24,238 --> 01:53:27,519
+from the instance
+
+3105
+01:53:25,439 --> 01:53:28,960
+and it uses the event when it is created
+
+3106
+01:53:27,520 --> 01:53:31,199
+with these basic datasets
+
+3107
+01:53:28,960 --> 01:53:33,439
+a lot of these also involve the
+
+3108
+01:53:31,198 --> 01:53:35,118
+contextualization that we start out with
+
+3109
+01:53:33,439 --> 01:53:36,559
+so it might seem a little bit pointless
+
+3110
+01:53:35,118 --> 01:53:38,479
+to immediately
+
+3111
+01:53:36,560 --> 01:53:40,0
+6816.56 --> 6820
+label something that we have not even
+
+3112
+01:53:38,479 --> 01:53:42,79
+started working on yet
+
+3113
+01:53:40,0 --> 01:53:43,359
+6820 --> 6823.36
+but also keep in mind that very often
+
+3114
+01:53:42,79 --> 01:53:45,118
+what we do internally in our
+
+3115
+01:53:43,359 --> 01:53:46,79
+organizations is we have several missed
+
+3116
+01:53:45,118 --> 01:53:49,359
+instances
+
+3117
+01:53:46,79 --> 01:53:51,198
+that are uh that already are domain
+
+3118
+01:53:49,359 --> 01:53:52,799
+specific so for example we have our spam
+
+3119
+01:53:51,198 --> 01:53:56,0
+6831.199 --> 6836
+collector instance we have our
+
+3120
+01:53:52,800 --> 01:53:58,639
+our sandboxing ignis vincents and so on
+
+3121
+01:53:56,0 --> 01:54:00,479
+6836 --> 6840.48
+these these already are uh define the
+
+3122
+01:53:58,639 --> 01:54:00,960
+scope of the information that go into
+
+3123
+01:54:00,479 --> 01:54:02,879
+them
+
+3124
+01:54:00,960 --> 01:54:04,960
+so we can already decide okay if we if
+
+3125
+01:54:02,880 --> 01:54:05,599
+we are on our spam collector miss
+
+3126
+01:54:04,960 --> 01:54:07,279
+vincent
+
+3127
+01:54:05,599 --> 01:54:08,880
+anything that goes in there will be
+
+3128
+01:54:07,279 --> 01:54:10,719
+related to spam so in this case we can
+
+3129
+01:54:08,880 --> 01:54:12,159
+remove these tags because we don't
+
+3130
+01:54:10,719 --> 01:54:14,880
+we don't actually want to include those
+
+3131
+01:54:12,158 --> 01:54:15,679
+just yet maybe we can keep that one
+
+3132
+01:54:14,880 --> 01:54:17,520
+because it's still
+
+3133
+01:54:15,679 --> 01:54:20,319
+a draft so that means we will do an
+
+3134
+01:54:17,520 --> 01:54:23,599
+evaluation of this famous email accuracy
+
+3135
+01:54:20,319 --> 01:54:24,238
+and then um so we have some defined
+
+3136
+01:54:23,599 --> 01:54:25,920
+taxonomy
+
+3137
+01:54:24,238 --> 01:54:27,439
+misplan on this instance we enabled for
+
+3138
+01:54:25,920 --> 01:54:29,520
+example the workflow one
+
+3139
+01:54:27,439 --> 01:54:31,39
+uh this one is maybe of interest from
+
+3140
+01:54:29,520 --> 01:54:33,280
+different organizations is
+
+3141
+01:54:31,39 --> 01:54:35,599
+a generic one about workflow uh what is
+
+3142
+01:54:33,279 --> 01:54:37,920
+the current state or other thing so
+
+3143
+01:54:35,599 --> 01:54:39,279
+don't forget uh in the initial event
+
+3144
+01:54:37,920 --> 01:54:40,560
+when we created the event we have
+
+3145
+01:54:39,279 --> 01:54:42,960
+information about
+
+3146
+01:54:40,560 --> 01:54:44,639
+uh the state and stuff like that now
+
+3147
+01:54:42,960 --> 01:54:46,158
+with this what we do is recommend to
+
+3148
+01:54:44,639 --> 01:54:46,880
+have taxonomies and you can you can
+
+3149
+01:54:46,158 --> 01:54:49,359
+really
+
+3150
+01:54:46,880 --> 01:54:51,440
+set up whatever you like and in the misp
+
+3151
+01:54:49,359 --> 01:54:52,319
+event to define the current state of
+
+3152
+01:54:51,439 --> 01:54:55,839
+this event
+
+3153
+01:54:52,319 --> 01:54:55,840
+so we keep draft from this case
+
+3154
+01:54:57,39 --> 01:55:01,840
+yeah indeed so we keep it at this and we
+
+3155
+01:55:00,238 --> 01:55:03,598
+scroll further down and we see that miss
+
+3156
+01:55:01,840 --> 01:55:05,119
+warns us about a few things first of all
+
+3157
+01:55:03,599 --> 01:55:06,639
+data is not published
+
+3158
+01:55:05,118 --> 01:55:08,639
+and second of all if we scroll a bit
+
+3159
+01:55:06,639 --> 01:55:10,239
+further down we see that mispo also
+
+3160
+01:55:08,639 --> 01:55:11,920
+tells us that there are no attributes in
+
+3161
+01:55:10,238 --> 01:55:12,399
+here so this is still an empty envelope
+
+3162
+01:55:11,920 --> 01:55:14,319
+that we
+
+3163
+01:55:12,399 --> 01:55:15,519
+are about to share so list tells us
+
+3164
+01:55:14,319 --> 01:55:18,719
+don't share this just yet
+
+3165
+01:55:15,520 --> 01:55:19,119
+fill it up with data first so at this
+
+3166
+01:55:18,719 --> 01:55:22,319
+point
+
+3167
+01:55:19,118 --> 01:55:26,0
+6919.119 --> 6926
+we can start populating the information
+
+3168
+01:55:22,319 --> 01:55:26,0
+6922.32 --> 6926
+so if you if you look at the
+
+3169
+01:55:27,439 --> 01:55:31,919
+initial document that we that we use as
+
+3170
+01:55:29,840 --> 01:55:32,800
+a starting point we see in there that we
+
+3171
+01:55:31,920 --> 01:55:35,760
+have a lot of
+
+3172
+01:55:32,800 --> 01:55:37,679
+information in there described we see
+
+3173
+01:55:35,760 --> 01:55:38,400
+for example that we are dealing with
+
+3174
+01:55:37,679 --> 01:55:40,319
+spearfishing
+
+3175
+01:55:38,399 --> 01:55:41,598
+we see that we have an email that was
+
+3176
+01:55:40,319 --> 01:55:44,880
+received at a certain
+
+3177
+01:55:41,599 --> 01:55:47,199
+point in time and we also see that
+
+3178
+01:55:44,880 --> 01:55:48,319
+we have an attacker that pretends to be
+
+3179
+01:55:47,198 --> 01:55:51,678
+um
+
+3180
+01:55:48,319 --> 01:55:54,0
+6948.32 --> 6954
+working at the ceo's uh uh daughter
+
+3181
+01:55:51,679 --> 01:55:55,440
+and sending the email address from
+
+3182
+01:55:54,0 --> 01:55:57,198
+6954 --> 6957.199
+spoofed uh
+
+3183
+01:55:55,439 --> 01:55:59,359
+the email from a spoofed email address
+
+3184
+01:55:57,198 --> 01:56:00,719
+so we can start by by describing this
+
+3185
+01:55:59,359 --> 01:56:01,759
+information by including this
+
+3186
+01:56:00,719 --> 01:56:03,279
+information
+
+3187
+01:56:01,760 --> 01:56:04,800
+so perhaps one of the things that we can
+
+3188
+01:56:03,279 --> 01:56:06,880
+take here is let's start with the most
+
+3189
+01:56:04,800 --> 01:56:09,119
+basic thing we're describing an email
+
+3190
+01:56:06,880 --> 01:56:10,880
+so let's start with an email object so
+
+3191
+01:56:09,118 --> 01:56:15,839
+we're going to add an object
+
+3192
+01:56:10,880 --> 01:56:15,840
+and we're going to select email
+
+3193
+01:56:18,479 --> 01:56:22,479
+so here we see that this is coming from
+
+3194
+01:56:20,639 --> 01:56:26,400
+the templating system where you can
+
+3195
+01:56:22,479 --> 01:56:28,79
+define uh pre different concepts with
+
+3196
+01:56:26,399 --> 01:56:30,79
+different fields that have to be then
+
+3197
+01:56:28,79 --> 01:56:31,760
+populated using this object templating
+
+3198
+01:56:30,79 --> 01:56:33,359
+system
+
+3199
+01:56:31,760 --> 01:56:35,440
+so we have a bunch of information that
+
+3200
+01:56:33,359 --> 01:56:37,39
+we can fill out here we see the spoofed
+
+3201
+01:56:35,439 --> 01:56:43,839
+address so we see a from address that we
+
+3202
+01:56:37,39 --> 01:56:43,840
+can encode
+
+3203
+01:56:45,439 --> 01:56:52,879
+okay we also have um
+
+3204
+01:56:50,399 --> 01:56:55,118
+a sample that i don't know if you if
+
+3205
+01:56:52,880 --> 01:56:58,960
+i've uploaded anywhere alex if not just
+
+3206
+01:56:55,118 --> 01:57:00,880
+pick any file for now because
+
+3207
+01:56:58,960 --> 01:57:02,319
+i think that's something i forgot to do
+
+3208
+01:57:00,880 --> 01:57:03,679
+yeah i don't know where the sample is
+
+3209
+01:57:02,319 --> 01:57:06,719
+yeah maybe we should add it
+
+3210
+01:57:03,679 --> 01:57:11,840
+yeah just put putty dot x or something
+
+3211
+01:57:06,719 --> 01:57:11,840
+if you have it
+
+3212
+01:57:12,800 --> 01:57:15,119
+oops
+
+3213
+01:57:16,639 --> 01:57:19,599
+or we can do it as a separate object we
+
+3214
+01:57:18,158 --> 01:57:21,39
+can we can just do this separately yeah
+
+3215
+01:57:19,599 --> 01:57:24,400
+we can do a separate objective
+
+3216
+01:57:21,39 --> 01:57:25,118
+yeah indeed indeed okay so what we can
+
+3217
+01:57:24,399 --> 01:57:27,118
+already
+
+3218
+01:57:25,118 --> 01:57:28,238
+describe here is we can we can still add
+
+3219
+01:57:27,118 --> 01:57:31,839
+the name of the
+
+3220
+01:57:28,238 --> 01:57:34,158
+uh attachment that we had in there
+
+3221
+01:57:31,840 --> 01:57:34,159
+um
+
+3222
+01:57:35,359 --> 01:57:39,839
+just to fast track it a bit
+
+3223
+01:57:40,639 --> 01:57:42,880
+good
+
+3224
+01:57:46,79 --> 01:57:49,760
+so we have a timestamp too which is
+
+3225
+01:57:47,679 --> 01:57:52,319
+interesting so um
+
+3226
+01:57:49,760 --> 01:57:54,239
+this one has been received as a specific
+
+3227
+01:57:52,319 --> 01:57:56,639
+so it was a third
+
+3228
+01:57:54,238 --> 01:57:58,479
+of so the first scene is basically
+
+3229
+01:57:56,639 --> 01:58:03,440
+something that you can you can really uh
+
+3230
+01:57:58,479 --> 01:58:03,439
+set up so it was the third of february
+
+3231
+01:58:03,920 --> 01:58:10,158
+we had a specific time if i'm misleading
+
+3232
+01:58:07,198 --> 01:58:11,39
+um so in this one we have uh this one
+
+3233
+01:58:10,158 --> 01:58:14,349
+has been
+
+3234
+01:58:11,39 --> 01:58:16,880
+sent on received on
+
+3235
+01:58:14,350 --> 01:58:21,840
+[Music]
+
+3236
+01:58:16,880 --> 01:58:21,840
+16 so i can
+
+3237
+01:58:27,439 --> 01:58:34,158
+we also see that that basically
+
+3238
+01:58:30,639 --> 01:58:37,199
+the attachment was spoofing
+
+3239
+01:58:34,158 --> 01:58:39,598
+the document uh
+
+3240
+01:58:37,198 --> 01:58:40,638
+about the report about the ceo's
+
+3241
+01:58:39,599 --> 01:58:42,719
+daughter's
+
+3242
+01:58:40,639 --> 01:58:44,79
+progress in school so we can pick the
+
+3243
+01:58:42,719 --> 01:58:47,279
+file name for the
+
+3244
+01:58:44,79 --> 01:58:50,639
+uh attachment and that is under the
+
+3245
+01:58:47,279 --> 01:58:50,639
+attachment section in the object
+
+3246
+01:58:54,560 --> 01:59:01,199
+good i'm just clicking it
+
+3247
+01:58:58,158 --> 01:59:02,960
+yeah it is called report.x attacks i
+
+3248
+01:59:01,198 --> 01:59:04,319
+mean maybe it's not in the text right
+
+3249
+01:59:02,960 --> 01:59:06,639
+now okay it might not be in the text
+
+3250
+01:59:04,319 --> 01:59:12,319
+might be just the original file
+
+3251
+01:59:06,639 --> 01:59:12,319
+about that so yeah report.x dot x
+
+3252
+01:59:12,800 --> 01:59:15,360
+attachment
+
+3253
+01:59:21,198 --> 01:59:24,879
+and then we also know that it was
+
+3254
+01:59:22,399 --> 01:59:24,879
+received
+
+3255
+01:59:25,39 --> 01:59:28,800
+that we have received header ip so we
+
+3256
+01:59:27,279 --> 01:59:29,198
+can include that as well that's also in
+
+3257
+01:59:28,800 --> 01:59:33,440
+the
+
+3258
+01:59:29,198 --> 01:59:33,439
+stated email it's 137.221
+
+3259
+01:59:41,599 --> 01:59:44,639
+and we even have the hostname if you
+
+3260
+01:59:42,960 --> 01:59:47,198
+want to include that that was also
+
+3261
+01:59:44,639 --> 01:59:47,199
+included in
+
+3262
+01:59:48,880 --> 01:59:51,679
+or in the report
+
+3263
+01:59:54,960 --> 01:59:59,679
+perfect so this is as you can see here
+
+3264
+01:59:58,79 --> 02:00:01,198
+we did not fill everything out because
+
+3265
+01:59:59,679 --> 02:00:03,118
+we don't know everything based on the
+
+3266
+02:00:01,198 --> 02:00:04,158
+report but we knew some of the fields we
+
+3267
+02:00:03,118 --> 02:00:05,839
+also see that
+
+3268
+02:00:04,158 --> 02:00:07,839
+each of these objects basically have
+
+3269
+02:00:05,840 --> 02:00:08,639
+some requirements and we satisfy those
+
+3270
+02:00:07,840 --> 02:00:10,560
+in this case
+
+3271
+02:00:08,639 --> 02:00:12,239
+so if you scroll all the way to the top
+
+3272
+02:00:10,560 --> 02:00:12,880
+you will see that that this object had a
+
+3273
+02:00:12,238 --> 02:00:14,559
+requirement
+
+3274
+02:00:12,880 --> 02:00:16,0
+7212.88 --> 7216
+any of those fields have to be filled
+
+3275
+02:00:14,560 --> 02:00:18,80
+we've definitely met that
+
+3276
+02:00:16,0 --> 02:00:21,359
+7216 --> 7221.36
+so we can just click submit and we can
+
+3277
+02:00:18,79 --> 02:00:21,359
+create our object in this case
+
+3278
+02:00:23,198 --> 02:00:26,799
+so here we see mrs telling us if we
+
+3279
+02:00:25,359 --> 02:00:27,519
+create this object that's what it will
+
+3280
+02:00:26,800 --> 02:00:28,880
+look like
+
+3281
+02:00:27,520 --> 02:00:30,719
+so we have in this case created our
+
+3282
+02:00:28,880 --> 02:00:31,359
+object and now it is attached to the
+
+3283
+02:00:30,719 --> 02:00:33,840
+event and
+
+3284
+02:00:31,359 --> 02:00:34,960
+suddenly stuff happened here so we see
+
+3285
+02:00:33,840 --> 02:00:37,119
+that each of these
+
+3286
+02:00:34,960 --> 02:00:38,480
+attributes already start correlating
+
+3287
+02:00:37,118 --> 02:00:40,799
+with existing events
+
+3288
+02:00:38,479 --> 02:00:42,718
+now we read this uh this little exercise
+
+3289
+02:00:40,800 --> 02:00:44,159
+before we didn't correlate with some of
+
+3290
+02:00:42,719 --> 02:00:46,880
+those previous events
+
+3291
+02:00:44,158 --> 02:00:50,238
+but normally uh if this was a real case
+
+3292
+02:00:46,880 --> 02:00:50,239
+if you get a correlation
+
+3293
+02:00:50,319 --> 02:00:54,399
+that is either something very similar
+
+3294
+02:00:52,319 --> 02:00:56,639
+that already happened before or is it
+
+3295
+02:00:54,399 --> 02:00:58,719
+something that simply
+
+3296
+02:00:56,639 --> 02:01:00,400
+might be a coincidence but it's still
+
+3297
+02:00:58,719 --> 02:01:02,239
+close for investigation
+
+3298
+02:01:00,399 --> 02:01:04,559
+to check is this something that might
+
+3299
+02:01:02,238 --> 02:01:07,439
+help me bootstrap my investigation
+
+3300
+02:01:04,560 --> 02:01:08,719
+or is it just noise that is not maybe a
+
+3301
+02:01:07,439 --> 02:01:09,279
+side note because we have often the
+
+3302
+02:01:08,719 --> 02:01:12,560
+questions
+
+3303
+02:01:09,279 --> 02:01:14,319
+um when you create such object in
+
+3304
+02:01:12,560 --> 02:01:15,840
+you see that can be cumbersome to create
+
+3305
+02:01:14,319 --> 02:01:17,439
+it manually
+
+3306
+02:01:15,840 --> 02:01:20,79
+so don't forget that everything that we
+
+3307
+02:01:17,439 --> 02:01:22,479
+do right now can be done through the api
+
+3308
+02:01:20,79 --> 02:01:23,519
+so you can use pymisp automatically do
+
+3309
+02:01:22,479 --> 02:01:26,319
+it and so on so
+
+3310
+02:01:23,520 --> 02:01:27,840
+what we show there um i think if you
+
+3311
+02:01:26,319 --> 02:01:29,599
+think on the api level
+
+3312
+02:01:27,840 --> 02:01:31,119
+it can be done automatically so if you
+
+3313
+02:01:29,599 --> 02:01:33,119
+have two that are extracting emails
+
+3314
+02:01:31,118 --> 02:01:35,39
+automatically from the
+
+3315
+02:01:33,118 --> 02:01:36,559
+pc mailbox whatever you can
+
+3316
+02:01:35,39 --> 02:01:37,760
+automatically do it in mist
+
+3317
+02:01:36,560 --> 02:01:39,679
+we just show the complete process
+
+3318
+02:01:37,760 --> 02:01:41,39
+manually but you can never mix things
+
+3319
+02:01:39,679 --> 02:01:42,399
+for some event
+
+3320
+02:01:41,39 --> 02:01:44,158
+maybe some might be created
+
+3321
+02:01:42,399 --> 02:01:46,638
+automatically and then update it
+
+3322
+02:01:44,158 --> 02:01:47,839
+manually and so on
+
+3323
+02:01:46,639 --> 02:01:49,520
+something else that might be interesting
+
+3324
+02:01:47,840 --> 02:01:50,960
+here at this point is we've encoded this
+
+3325
+02:01:49,520 --> 02:01:54,560
+object and we look at it
+
+3326
+02:01:50,960 --> 02:01:56,880
+and perhaps we we might want to
+
+3327
+02:01:54,560 --> 02:01:58,400
+to change the distribution settings
+
+3328
+02:01:56,880 --> 02:01:59,279
+based on the different data points that
+
+3329
+02:01:58,399 --> 02:02:02,238
+we have in there
+
+3330
+02:01:59,279 --> 02:02:04,79
+so most of these such as the malicious
+
+3331
+02:02:02,238 --> 02:02:05,759
+host that email is sent from
+
+3332
+02:02:04,79 --> 02:02:07,279
+are technical information that we can
+
+3333
+02:02:05,760 --> 02:02:10,320
+share with the broader community
+
+3334
+02:02:07,279 --> 02:02:12,399
+but perhaps the name of the
+
+3335
+02:02:10,319 --> 02:02:13,599
+school that our ceo's daughter attends
+
+3336
+02:02:12,399 --> 02:02:15,118
+is something that we don't need to share
+
+3337
+02:02:13,599 --> 02:02:17,679
+with the entire community
+
+3338
+02:02:15,118 --> 02:02:20,0
+7335.119 --> 7340
+so we could reduce the distribution of
+
+3339
+02:02:17,679 --> 02:02:21,760
+that individual attribute in this object
+
+3340
+02:02:20,0 --> 02:02:23,520
+7340 --> 7343.52
+so that we keep that for example only
+
+3341
+02:02:21,760 --> 02:02:24,639
+for our own organization and for our own
+
+3342
+02:02:23,520 --> 02:02:26,0
+7343.52 --> 7346
+internal records
+
+3343
+02:02:24,639 --> 02:02:27,599
+so one of the things you can do in this
+
+3344
+02:02:26,0 --> 02:02:28,158
+7346 --> 7348.159
+case is you can edit that individual
+
+3345
+02:02:27,599 --> 02:02:32,960
+attribute
+
+3346
+02:02:28,158 --> 02:02:34,799
+so the from address in the object
+
+3347
+02:02:32,960 --> 02:02:36,399
+and you can set a distribution level to
+
+3348
+02:02:34,800 --> 02:02:38,560
+your organization only
+
+3349
+02:02:36,399 --> 02:02:40,479
+in this case once we release the uh the
+
+3350
+02:02:38,560 --> 02:02:43,440
+event to a broader audience
+
+3351
+02:02:40,479 --> 02:02:45,198
+it will keep this individual attribute
+
+3352
+02:02:43,439 --> 02:02:46,0
+7363.44 --> 7366
+for an organization and it will not
+
+3353
+02:02:45,198 --> 02:02:49,598
+share it out with
+
+3354
+02:02:46,0 --> 02:02:51,279
+7366 --> 7371.28
+uh with other constituencies okay
+
+3355
+02:02:49,599 --> 02:02:53,39
+so some other stuff that happened at
+
+3356
+02:02:51,279 --> 02:02:54,479
+this point we see that
+
+3357
+02:02:53,39 --> 02:02:55,679
+several of you are creating events so
+
+3358
+02:02:54,479 --> 02:02:57,359
+that's great the correlation account
+
+3359
+02:02:55,679 --> 02:02:59,440
+really went up all of the sudden
+
+3360
+02:02:57,359 --> 02:03:00,479
+so it's good to see something else that
+
+3361
+02:02:59,439 --> 02:03:03,439
+happened at this point
+
+3362
+02:03:00,479 --> 02:03:05,198
+is uh is the event itself got correlated
+
+3363
+02:03:03,439 --> 02:03:06,158
+to other events as well so if you scroll
+
+3364
+02:03:05,198 --> 02:03:07,598
+up all the way
+
+3365
+02:03:06,158 --> 02:03:09,519
+we see that the attributes that we've
+
+3366
+02:03:07,599 --> 02:03:11,360
+added are also showing us what other
+
+3367
+02:03:09,520 --> 02:03:12,159
+events we're correlating in so this is a
+
+3368
+02:03:11,359 --> 02:03:13,598
+summary of
+
+3369
+02:03:12,158 --> 02:03:15,359
+all the individual attributes
+
+3370
+02:03:13,599 --> 02:03:17,119
+correlations from the event
+
+3371
+02:03:15,359 --> 02:03:18,639
+that means that if you have if this
+
+3372
+02:03:17,118 --> 02:03:20,79
+object is correlating or
+
+3373
+02:03:18,639 --> 02:03:21,920
+these attributes within the object are
+
+3374
+02:03:20,79 --> 02:03:23,840
+correlating to it with a certain event
+
+3375
+02:03:21,920 --> 02:03:25,359
+and certain other objects are
+
+3376
+02:03:23,840 --> 02:03:27,119
+correlating with other events
+
+3377
+02:03:25,359 --> 02:03:29,359
+then this would be a full summary of all
+
+3378
+02:03:27,118 --> 02:03:31,920
+the events that you're correlating with
+
+3379
+02:03:29,359 --> 02:03:33,198
+you can also draw a graph out of that if
+
+3380
+02:03:31,920 --> 02:03:35,199
+you click on the correlation graph you
+
+3381
+02:03:33,198 --> 02:03:37,118
+will see how the events are interlinked
+
+3382
+02:03:35,198 --> 02:03:38,719
+and you can further explore this by
+
+3383
+02:03:37,118 --> 02:03:41,519
+selecting any of the notes
+
+3384
+02:03:38,719 --> 02:03:42,639
+and pressing x on that to further expand
+
+3385
+02:03:41,520 --> 02:03:46,159
+it with
+
+3386
+02:03:42,639 --> 02:03:46,159
+with it with its own correlations
+
+3387
+02:03:46,960 --> 02:03:52,78
+okay let's go back to event
+
+3388
+02:03:52,238 --> 02:03:56,399
+yeah i don't think we have a lot of
+
+3389
+02:03:55,679 --> 02:03:58,399
+correlations
+
+3390
+02:03:56,399 --> 02:03:59,679
+there for the other events they're all
+
+3391
+02:03:58,399 --> 02:04:02,960
+the same
+
+3392
+02:03:59,679 --> 02:04:03,920
+uh okay now going back to a little
+
+3393
+02:04:02,960 --> 02:04:06,319
+example uh
+
+3394
+02:04:03,920 --> 02:04:07,440
+we have now created four attributes all
+
+3395
+02:04:06,319 --> 02:04:10,319
+together out of
+
+3396
+02:04:07,439 --> 02:04:11,759
+uh of the object template but we could
+
+3397
+02:04:10,319 --> 02:04:12,880
+have done this differently as well what
+
+3398
+02:04:11,760 --> 02:04:14,800
+we could have done
+
+3399
+02:04:12,880 --> 02:04:16,480
+is we could also have created those
+
+3400
+02:04:14,800 --> 02:04:17,39
+attributes individually and added those
+
+3401
+02:04:16,479 --> 02:04:20,319
+to the
+
+3402
+02:04:17,39 --> 02:04:21,920
+uh to the um event directly
+
+3403
+02:04:20,319 --> 02:04:24,319
+so one of the things that we can do now
+
+3404
+02:04:21,920 --> 02:04:25,920
+is we can go back to our report and
+
+3405
+02:04:24,319 --> 02:04:27,359
+tackle the next thing that is described
+
+3406
+02:04:25,920 --> 02:04:28,480
+there and let's do it slightly
+
+3407
+02:04:27,359 --> 02:04:31,198
+differently
+
+3408
+02:04:28,479 --> 02:04:31,759
+so we also see that basically uh the
+
+3409
+02:04:31,198 --> 02:04:34,479
+person
+
+3410
+02:04:31,760 --> 02:04:36,840
+uh that this is impersonated is also
+
+3411
+02:04:34,479 --> 02:04:40,959
+described so that is basically
+
+3412
+02:04:36,840 --> 02:04:40,960
+um in this case
+
+3413
+02:04:41,118 --> 02:04:45,359
+john doe the teacher of the student so
+
+3414
+02:04:43,520 --> 02:04:47,40
+let's just create a personal object and
+
+3415
+02:04:45,359 --> 02:04:50,78
+describe that
+
+3416
+02:04:47,39 --> 02:04:53,519
+so what we can do now is instead of
+
+3417
+02:04:50,78 --> 02:04:54,158
+directly describing it as an object we
+
+3418
+02:04:53,520 --> 02:04:57,520
+can first
+
+3419
+02:04:54,158 --> 02:04:58,78
+add those different fields at least a
+
+3420
+02:04:57,520 --> 02:05:00,0
+7497.52 --> 7500
+name
+
+3421
+02:04:58,78 --> 02:05:01,599
+as individual attributes so let's let's
+
+3422
+02:05:00,0 --> 02:05:03,279
+7500 --> 7503.28
+see how adding individual attributes
+
+3423
+02:05:01,599 --> 02:05:05,39
+work so we click on the little plus icon
+
+3424
+02:05:03,279 --> 02:05:08,880
+above the attribute list
+
+3425
+02:05:05,39 --> 02:05:08,880
+and we simply select category person
+
+3426
+02:05:09,439 --> 02:05:13,598
+and from person we select first name
+
+3427
+02:05:11,439 --> 02:05:15,39
+first name is john
+
+3428
+02:05:13,599 --> 02:05:17,39
+and here we can already define is this
+
+3429
+02:05:15,39 --> 02:05:19,198
+an indicator do we want to
+
+3430
+02:05:17,39 --> 02:05:21,599
+set the for intrusion detection system
+
+3431
+02:05:19,198 --> 02:05:22,879
+flag no definitely not this in itself is
+
+3432
+02:05:21,599 --> 02:05:24,880
+not an indicator
+
+3433
+02:05:22,880 --> 02:05:26,719
+in fact we want to also disable
+
+3434
+02:05:24,880 --> 02:05:27,679
+correlation on this as this is a pretty
+
+3435
+02:05:26,719 --> 02:05:31,840
+common
+
+3436
+02:05:27,679 --> 02:05:34,719
+uh name that is definitely not something
+
+3437
+02:05:31,840 --> 02:05:36,0
+7531.84 --> 7536
+to we don't need a comment for enough
+
+3438
+02:05:34,719 --> 02:05:38,800
+but now we're going to convert it into
+
+3439
+02:05:36,0 --> 02:05:41,439
+7536 --> 7541.44
+an object anyway
+
+3440
+02:05:38,800 --> 02:05:42,880
+uh so what we can do is we can also
+
+3441
+02:05:41,439 --> 02:05:44,158
+disable correlation on this we don't
+
+3442
+02:05:42,880 --> 02:05:47,520
+want to correlate on john
+
+3443
+02:05:44,158 --> 02:05:51,39
+okay okay doesn't matter
+
+3444
+02:05:47,520 --> 02:05:53,360
+actually we can do it uh
+
+3445
+02:05:51,39 --> 02:05:55,279
+the same thing for the last name though
+
+3446
+02:05:53,359 --> 02:05:57,198
+and we can basically say that this is
+
+3447
+02:05:55,279 --> 02:05:58,960
+now
+
+3448
+02:05:57,198 --> 02:06:00,399
+last name now we've added these two
+
+3449
+02:05:58,960 --> 02:06:01,599
+things in there now the problem with
+
+3450
+02:06:00,399 --> 02:06:03,679
+this is if we just had
+
+3451
+02:06:01,599 --> 02:06:04,719
+attributes instead of objects is we
+
+3452
+02:06:03,679 --> 02:06:06,399
+don't really see that
+
+3453
+02:06:04,719 --> 02:06:08,78
+john and do in this case are the first
+
+3454
+02:06:06,399 --> 02:06:10,559
+name and last name belong together
+
+3455
+02:06:08,78 --> 02:06:12,238
+so if i were to describe several people
+
+3456
+02:06:10,560 --> 02:06:13,599
+in the same event you would have a list
+
+3457
+02:06:12,238 --> 02:06:17,118
+of first names and a list of
+
+3458
+02:06:13,599 --> 02:06:17,520
+last names with no connection between
+
+3459
+02:06:17,118 --> 02:06:20,399
+the
+
+3460
+02:06:17,520 --> 02:06:21,920
+two things so it's better to use objects
+
+3461
+02:06:20,399 --> 02:06:24,399
+in general whenever you're describing
+
+3462
+02:06:21,920 --> 02:06:26,158
+multiple aspects of the same thing
+
+3463
+02:06:24,399 --> 02:06:27,920
+obviously if you just have a list of
+
+3464
+02:06:26,158 --> 02:06:29,359
+file hashes that you got from a feed and
+
+3465
+02:06:27,920 --> 02:06:30,719
+you just encode those and you don't have
+
+3466
+02:06:29,359 --> 02:06:32,0
+7589.36 --> 7592
+any other information with them you
+
+3467
+02:06:30,719 --> 02:06:33,279
+might as well just create flat
+
+3468
+02:06:32,0 --> 02:06:34,479
+7592 --> 7594.48
+attributes out of them
+
+3469
+02:06:33,279 --> 02:06:36,880
+because there is nothing else to
+
+3470
+02:06:34,479 --> 02:06:38,399
+describe from your perspective
+
+3471
+02:06:36,880 --> 02:06:39,679
+but even in that case it's arguable
+
+3472
+02:06:38,399 --> 02:06:40,799
+whether you don't want to start an
+
+3473
+02:06:39,679 --> 02:06:42,399
+object
+
+3474
+02:06:40,800 --> 02:06:44,0
+7600.8 --> 7604
+from the get go but what we can do in
+
+3475
+02:06:42,399 --> 02:06:45,598
+this case if we did start with this way
+
+3476
+02:06:44,0 --> 02:06:47,520
+7604 --> 7607.52
+or if you receive information in this
+
+3477
+02:06:45,599 --> 02:06:48,719
+format or your tools parse the data out
+
+3478
+02:06:47,520 --> 02:06:50,560
+in this format is
+
+3479
+02:06:48,719 --> 02:06:51,920
+you can select those two attributes by
+
+3480
+02:06:50,560 --> 02:06:52,960
+clicking the little check marks next
+
+3481
+02:06:51,920 --> 02:06:54,800
+there are little
+
+3482
+02:06:52,960 --> 02:06:56,560
+tick boxes next to them and then
+
+3483
+02:06:54,800 --> 02:06:58,79
+clicking on group selected attributes
+
+3484
+02:06:56,560 --> 02:06:59,920
+into an object
+
+3485
+02:06:58,78 --> 02:07:01,599
+and here miss will propose okay these
+
+3486
+02:06:59,920 --> 02:07:03,440
+are the different object templates that
+
+3487
+02:07:01,599 --> 02:07:04,719
+satisfy
+
+3488
+02:07:03,439 --> 02:07:06,960
+the list of attributes that you've
+
+3489
+02:07:04,719 --> 02:07:07,920
+selected there's a person object that we
+
+3490
+02:07:06,960 --> 02:07:11,118
+can use so let's
+
+3491
+02:07:07,920 --> 02:07:11,118
+just pick that one for now
+
+3492
+02:07:11,599 --> 02:07:15,199
+so here we see if we were to combine
+
+3493
+02:07:13,679 --> 02:07:16,800
+these two things they would be merged
+
+3494
+02:07:15,198 --> 02:07:19,198
+into an object
+
+3495
+02:07:16,800 --> 02:07:20,560
+uh that is fine with us we see first
+
+3496
+02:07:19,198 --> 02:07:23,359
+name will become
+
+3497
+02:07:20,560 --> 02:07:24,480
+the the first name of the object last
+
+3498
+02:07:23,359 --> 02:07:27,839
+name the last name
+
+3499
+02:07:24,479 --> 02:07:27,839
+so let's merge it
+
+3500
+02:07:28,960 --> 02:07:34,239
+now we basically have a personality now
+
+3501
+02:07:32,238 --> 02:07:36,718
+we also know that this person that we're
+
+3502
+02:07:34,238 --> 02:07:38,638
+dealing with here is impersonating uh
+
+3503
+02:07:36,719 --> 02:07:40,560
+the teacher of the ceo's or daughter so
+
+3504
+02:07:38,639 --> 02:07:42,400
+the same person impersonated person is a
+
+3505
+02:07:40,560 --> 02:07:44,480
+teacher of the of the ceo's author
+
+3506
+02:07:42,399 --> 02:07:45,679
+so we added the object and we also see
+
+3507
+02:07:44,479 --> 02:07:48,78
+that there is a um
+
+3508
+02:07:45,679 --> 02:07:50,239
+that we can add just another text field
+
+3509
+02:07:48,78 --> 02:07:53,439
+yeah just text field works
+
+3510
+02:07:50,238 --> 02:07:54,879
+where we can describe it i just want to
+
+3511
+02:07:53,439 --> 02:07:57,598
+first disable the correlation because
+
+3512
+02:07:54,880 --> 02:07:57,599
+different means
+
+3513
+02:08:06,840 --> 02:08:10,800
+okay
+
+3514
+02:08:08,238 --> 02:08:12,319
+yeah that works and we just add a text
+
+3515
+02:08:10,800 --> 02:08:13,440
+description of the identity of the
+
+3516
+02:08:12,319 --> 02:08:22,319
+person we can just say
+
+3517
+02:08:13,439 --> 02:08:26,0
+7693.44 --> 7706
+teacher of the ceo's daughter
+
+3518
+02:08:22,319 --> 02:08:27,439
+okay now we're done we have now added
+
+3519
+02:08:26,0 --> 02:08:28,960
+7706 --> 7708.96
+the additional attribute and now now we
+
+3520
+02:08:27,439 --> 02:08:31,118
+know what this object is actually about
+
+3521
+02:08:28,960 --> 02:08:32,880
+without having a description in there
+
+3522
+02:08:31,118 --> 02:08:34,960
+but we still just have an email and a
+
+3523
+02:08:32,880 --> 02:08:36,239
+person described in here but we don't
+
+3524
+02:08:34,960 --> 02:08:37,760
+know anything else we
+
+3525
+02:08:36,238 --> 02:08:39,279
+don't know that this email is proofing
+
+3526
+02:08:37,760 --> 02:08:41,119
+to be that person so we should add a
+
+3527
+02:08:39,279 --> 02:08:43,118
+relationship between the two
+
+3528
+02:08:41,118 --> 02:08:44,639
+now for this we can switch over to the
+
+3529
+02:08:43,118 --> 02:08:46,719
+event graph view
+
+3530
+02:08:44,639 --> 02:08:48,400
+so that is a little bit further up this
+
+3531
+02:08:46,719 --> 02:08:50,239
+one allows us to create
+
+3532
+02:08:48,399 --> 02:08:52,0
+7728.4 --> 7732
+connected graphs out of our individual
+
+3533
+02:08:50,238 --> 02:08:54,559
+data points so we see that we have
+
+3534
+02:08:52,0 --> 02:08:55,279
+7732 --> 7735.28
+two unreferenced objects so we explode
+
+3535
+02:08:54,560 --> 02:08:58,639
+that mode
+
+3536
+02:08:55,279 --> 02:09:00,719
+by pressing x and we can we can draw
+
+3537
+02:08:58,639 --> 02:09:02,639
+an edge between those two nodes by
+
+3538
+02:09:00,719 --> 02:09:04,319
+clicking edit and add reference
+
+3539
+02:09:02,639 --> 02:09:05,760
+and drawing a line between the two from
+
+3540
+02:09:04,319 --> 02:09:08,880
+the
+
+3541
+02:09:05,760 --> 02:09:08,880
+email to the person
+
+3542
+02:09:09,39 --> 02:09:12,880
+when you do that miss will propose a
+
+3543
+02:09:11,118 --> 02:09:15,39
+list of relationship
+
+3544
+02:09:12,880 --> 02:09:16,480
+types between these two two different
+
+3545
+02:09:15,39 --> 02:09:18,158
+nodes
+
+3546
+02:09:16,479 --> 02:09:19,439
+there is also a custom one there so if
+
+3547
+02:09:18,158 --> 02:09:21,198
+you don't want to select anything from
+
+3548
+02:09:19,439 --> 02:09:24,559
+the list that is fine too but for now
+
+3549
+02:09:21,198 --> 02:09:26,238
+we can just use the impersonates
+
+3550
+02:09:24,560 --> 02:09:28,79
+relationship which already exists in the
+
+3551
+02:09:26,238 --> 02:09:31,39
+default library
+
+3552
+02:09:28,78 --> 02:09:31,39
+just click on submit
+
+3553
+02:09:31,760 --> 02:09:34,880
+and now we have a relationship set
+
+3554
+02:09:33,198 --> 02:09:36,78
+between those two so we started telling
+
+3555
+02:09:34,880 --> 02:09:37,520
+our story by basically having a
+
+3556
+02:09:36,78 --> 02:09:40,399
+connected graph between the
+
+3557
+02:09:37,520 --> 02:09:40,880
+these two points now let's further look
+
+3558
+02:09:40,399 --> 02:09:43,920
+at our
+
+3559
+02:09:40,880 --> 02:09:47,520
+original email and see what else we can
+
+3560
+02:09:43,920 --> 02:09:49,520
+get out of the text from there
+
+3561
+02:09:47,520 --> 02:09:51,199
+we also see that the malicious file was
+
+3562
+02:09:49,520 --> 02:09:54,0
+7789.52 --> 7794
+contained in the email as
+
+3563
+02:09:51,198 --> 02:09:55,519
+well as an attachment so let's upload an
+
+3564
+02:09:54,0 --> 02:09:57,198
+7794 --> 7797.199
+attachment now to ms
+
+3565
+02:09:55,520 --> 02:09:58,880
+i hope you have put in the text there or
+
+3566
+02:09:57,198 --> 02:10:01,359
+something because i forgot to clearly
+
+3567
+02:09:58,880 --> 02:10:01,359
+i've
+
+3568
+02:10:02,880 --> 02:10:07,279
+so as an attachment and this is where
+
+3569
+02:10:05,439 --> 02:10:08,719
+things become a little bit tricky
+
+3570
+02:10:07,279 --> 02:10:10,158
+uh there's there's a quick question
+
+3571
+02:10:08,719 --> 02:10:11,920
+there on the chat i'll just quickly
+
+3572
+02:10:10,158 --> 02:10:14,78
+answer that then we can get back to this
+
+3573
+02:10:11,920 --> 02:10:15,679
+where can i create a reference if you go
+
+3574
+02:10:14,78 --> 02:10:17,519
+above the attribute list there is an
+
+3575
+02:10:15,679 --> 02:10:18,960
+event graph button if you click on that
+
+3576
+02:10:17,520 --> 02:10:20,719
+you get the event graph
+
+3577
+02:10:18,960 --> 02:10:22,800
+and on the top left side you click on
+
+3578
+02:10:20,719 --> 02:10:24,239
+edit and then add reference
+
+3579
+02:10:22,800 --> 02:10:26,639
+like i can show it again nowadays oh
+
+3580
+02:10:24,238 --> 02:10:29,279
+yeah that's a bit better here
+
+3581
+02:10:26,639 --> 02:10:30,319
+so have this kind of gray bar there with
+
+3582
+02:10:29,279 --> 02:10:32,719
+even graph
+
+3583
+02:10:30,319 --> 02:10:33,679
+so you can basically collapse or expand
+
+3584
+02:10:32,719 --> 02:10:36,880
+it
+
+3585
+02:10:33,679 --> 02:10:37,359
+uh and then there you can select one of
+
+3586
+02:10:36,880 --> 02:10:40,480
+those
+
+3587
+02:10:37,359 --> 02:10:41,39
+reference objects you press x to expand
+
+3588
+02:10:40,479 --> 02:10:44,638
+all those
+
+3589
+02:10:41,39 --> 02:10:47,679
+reference objects then you can just
+
+3590
+02:10:44,639 --> 02:10:51,39
+select one object that you want
+
+3591
+02:10:47,679 --> 02:10:53,39
+to add and then you can edit add the
+
+3592
+02:10:51,39 --> 02:10:54,78
+references and then you can add specific
+
+3593
+02:10:53,39 --> 02:10:55,599
+references
+
+3594
+02:10:54,78 --> 02:10:56,960
+in case it doesn't make sense to make a
+
+3595
+02:10:55,599 --> 02:10:57,760
+second reference but that's basically
+
+3596
+02:10:56,960 --> 02:10:59,279
+how you do it
+
+3597
+02:10:57,760 --> 02:11:01,280
+then you select your relationship type
+
+3598
+02:10:59,279 --> 02:11:03,759
+and you can add your reference
+
+3599
+02:11:01,279 --> 02:11:04,479
+uh it's not the only way to do it
+
+3600
+02:11:03,760 --> 02:11:06,79
+there's a
+
+3601
+02:11:04,479 --> 02:11:07,198
+i would say current-based representation
+
+3602
+02:11:06,78 --> 02:11:09,118
+where you can do it because we can't
+
+3603
+02:11:07,198 --> 02:11:11,519
+even show it
+
+3604
+02:11:09,118 --> 02:11:13,39
+so you have to go it's it's much more
+
+3605
+02:11:11,520 --> 02:11:16,480
+difficult to understand what happens
+
+3606
+02:11:13,39 --> 02:11:18,238
+yeah so so there the referendum that you
+
+3607
+02:11:16,479 --> 02:11:20,959
+created through the even graph
+
+3608
+02:11:18,238 --> 02:11:22,479
+is represented here so you see that this
+
+3609
+02:11:20,960 --> 02:11:24,399
+object
+
+3610
+02:11:22,479 --> 02:11:25,598
+has a reference so from email to
+
+3611
+02:11:24,399 --> 02:11:27,39
+impersonate
+
+3612
+02:11:25,599 --> 02:11:28,960
+and here's the opposite relationship
+
+3613
+02:11:27,39 --> 02:11:30,399
+that you can describe the reference buy
+
+3614
+02:11:28,960 --> 02:11:32,560
+and you have the reference buy
+
+3615
+02:11:30,399 --> 02:11:33,679
+on this object so another niche mention
+
+3616
+02:11:32,560 --> 02:11:37,840
+is i think
+
+3617
+02:11:33,679 --> 02:11:40,0
+7893.679 --> 7900
+less uh i would say 54 for
+
+3618
+02:11:37,840 --> 02:11:41,199
+and so on but sometimes you just when
+
+3619
+02:11:40,0 --> 02:11:43,39
+7900 --> 7903.04
+you are in the object you just want to
+
+3620
+02:11:41,198 --> 02:11:47,39
+see if you have any reference or
+
+3621
+02:11:43,39 --> 02:11:47,39
+a sign and you can quickly see that
+
+3622
+02:11:48,639 --> 02:11:54,880
+so let's add an attachment now
+
+3623
+02:11:53,39 --> 02:11:56,319
+and upload the sample that was uh
+
+3624
+02:11:54,880 --> 02:11:59,118
+included in the
+
+3625
+02:11:56,319 --> 02:12:00,559
+original uh email so we just click on
+
+3626
+02:11:59,118 --> 02:12:01,839
+add attachment
+
+3627
+02:12:00,560 --> 02:12:04,880
+we select the file that you want to
+
+3628
+02:12:01,840 --> 02:12:05,599
+upload yeah so for the attachment uh in
+
+3629
+02:12:04,880 --> 02:12:07,279
+this you have
+
+3630
+02:12:05,599 --> 02:12:08,400
+really two models you have the model
+
+3631
+02:12:07,279 --> 02:12:09,679
+that an attachment is basically
+
+3632
+02:12:08,399 --> 02:12:12,479
+something completely
+
+3633
+02:12:09,679 --> 02:12:13,118
+uh being safe and you can basically
+
+3634
+02:12:12,479 --> 02:12:16,479
+share it
+
+3635
+02:12:13,118 --> 02:12:17,359
+uh directly so for example you have
+
+3636
+02:12:16,479 --> 02:12:20,399
+attachment like
+
+3637
+02:12:17,359 --> 02:12:21,920
+reports and stuff in our case um
+
+3638
+02:12:20,399 --> 02:12:23,598
+what we want to share here it's a
+
+3639
+02:12:21,920 --> 02:12:25,760
+malicious number um
+
+3640
+02:12:23,599 --> 02:12:27,199
+so and that's i will take i will take
+
+3641
+02:12:25,760 --> 02:12:30,560
+which one
+
+3642
+02:12:27,198 --> 02:12:30,559
+take a sample somewhere
+
+3643
+02:12:32,840 --> 02:12:36,560
+um
+
+3644
+02:12:34,639 --> 02:12:38,78
+press on one what we are interesting
+
+3645
+02:12:36,560 --> 02:12:42,320
+there
+
+3646
+02:12:38,78 --> 02:12:44,158
+uh by the windows executables
+
+3647
+02:12:42,319 --> 02:12:45,599
+and then you have to select if the
+
+3648
+02:12:44,158 --> 02:12:46,799
+sample is malicious if you don't do
+
+3649
+02:12:45,599 --> 02:12:48,239
+anything
+
+3650
+02:12:46,800 --> 02:12:50,880
+what it will be it will be something
+
+3651
+02:12:48,238 --> 02:12:51,519
+like same uh report a pdf report
+
+3652
+02:12:50,880 --> 02:12:54,78
+something that's
+
+3653
+02:12:51,520 --> 02:12:55,599
+like supporting you in contextualization
+
+3654
+02:12:54,78 --> 02:12:56,238
+could be a screenshot for example things
+
+3655
+02:12:55,599 --> 02:12:58,400
+like that
+
+3656
+02:12:56,238 --> 02:12:59,279
+but if you share a sample you have to
+
+3657
+02:12:58,399 --> 02:13:02,158
+select
+
+3658
+02:12:59,279 --> 02:13:03,920
+uh it's a sample because like that mist
+
+3659
+02:13:02,158 --> 02:13:05,679
+will encrypt
+
+3660
+02:13:03,920 --> 02:13:07,679
+and hash a file so that means you have a
+
+3661
+02:13:05,679 --> 02:13:08,719
+zip file encrypted with a default
+
+3662
+02:13:07,679 --> 02:13:11,679
+password
+
+3663
+02:13:08,719 --> 02:13:12,560
+infected but i got to avoid classical
+
+3664
+02:13:11,679 --> 02:13:15,359
+mistake of
+
+3665
+02:13:12,560 --> 02:13:17,360
+clicking on a link executing binaries on
+
+3666
+02:13:15,359 --> 02:13:18,799
+your analysis machines and so on and so
+
+3667
+02:13:17,359 --> 02:13:20,639
+on you don't want to do that so
+
+3668
+02:13:18,800 --> 02:13:22,0
+7998.8 --> 8002
+if it's malicious always click malware
+
+3669
+02:13:20,639 --> 02:13:23,440
+samples
+
+3670
+02:13:22,0 --> 02:13:25,599
+8002 --> 8005.599
+then you have one below which will
+
+3671
+02:13:23,439 --> 02:13:27,919
+advance the extraction
+
+3672
+02:13:25,599 --> 02:13:30,0
+8005.599 --> 8010
+uh mist can do a lot of things behind
+
+3673
+02:13:27,920 --> 02:13:31,599
+the scene when you receive a file in
+
+3674
+02:13:30,0 --> 02:13:34,800
+8010 --> 8014.8
+this case it's a window
+
+3675
+02:13:31,599 --> 02:13:36,480
+of windows portable executable files so
+
+3676
+02:13:34,800 --> 02:13:37,920
+we have particular advanced extraction
+
+3677
+02:13:36,479 --> 02:13:40,158
+for those files and we can
+
+3678
+02:13:37,920 --> 02:13:41,199
+expand completely the files including
+
+3679
+02:13:40,158 --> 02:13:44,799
+resources
+
+3680
+02:13:41,198 --> 02:13:48,0
+8021.199 --> 8028
+code segment and stuff again
+
+3681
+02:13:44,800 --> 02:13:48,0
+8024.8 --> 8028
+so i will upload the files
+
+3682
+02:13:53,359 --> 02:13:57,439
+okay in this case this one was just like
+
+3683
+02:13:55,39 --> 02:14:00,78
+a very simple one
+
+3684
+02:13:57,439 --> 02:14:01,279
+so in this case what do we have we have
+
+3685
+02:14:00,78 --> 02:14:04,319
+an object
+
+3686
+02:14:01,279 --> 02:14:06,559
+with the file names the size invite and
+
+3687
+02:14:04,319 --> 02:14:08,158
+then the hash file so automatically miss
+
+3688
+02:14:06,560 --> 02:14:08,880
+will do the hashing of the different
+
+3689
+02:14:08,158 --> 02:14:11,519
+files
+
+3690
+02:14:08,880 --> 02:14:12,0
+8048.88 --> 8052
+the sample itself is attached so you can
+
+3691
+02:14:11,520 --> 02:14:14,880
+basically
+
+3692
+02:14:12,0 --> 02:14:16,880
+8052 --> 8056.88
+use it and some additional ones like ssd
+
+3693
+02:14:14,880 --> 02:14:18,880
+for example my type are automatically
+
+3694
+02:14:16,880 --> 02:14:20,480
+extracted
+
+3695
+02:14:18,880 --> 02:14:22,239
+just maybe for the sake of it i will
+
+3696
+02:14:20,479 --> 02:14:25,359
+just take maybe another
+
+3697
+02:14:22,238 --> 02:14:25,839
+binary just for showing you what could
+
+3698
+02:14:25,359 --> 02:14:28,479
+happen
+
+3699
+02:14:25,840 --> 02:14:30,0
+8065.84 --> 8070
+with other binaries maybe that's for
+
+3700
+02:14:28,479 --> 02:14:32,559
+later for different events so
+
+3701
+02:14:30,0 --> 02:14:33,439
+8070 --> 8073.44
+okay the objectives because it's easier
+
+3702
+02:14:32,560 --> 02:14:35,360
+to see for the
+
+3703
+02:14:33,439 --> 02:14:37,359
+photograph that's fine too you can show
+
+3704
+02:14:35,359 --> 02:14:39,39
+it afterwards yeah
+
+3705
+02:14:37,359 --> 02:14:41,39
+okay so now we have this again this kind
+
+3706
+02:14:39,39 --> 02:14:42,719
+of object attached and there's a
+
+3707
+02:14:41,39 --> 02:14:46,238
+relationship to create objections
+
+3708
+02:14:42,719 --> 02:14:48,0
+8082.719 --> 8088
+indeed so so in this case the
+
+3709
+02:14:46,238 --> 02:14:50,158
+relationship is to the email itself so
+
+3710
+02:14:48,0 --> 02:14:52,319
+8088 --> 8092.32
+we know that the email contained
+
+3711
+02:14:50,158 --> 02:14:53,920
+this file so what we can do is we can
+
+3712
+02:14:52,319 --> 02:14:54,479
+just create relationship between the
+
+3713
+02:14:53,920 --> 02:14:56,158
+email
+
+3714
+02:14:54,479 --> 02:14:58,718
+and the file and see that email contain
+
+3715
+02:14:56,158 --> 02:14:58,719
+that file
+
+3716
+02:15:00,719 --> 02:15:04,800
+do you see it it's again the same model
+
+3717
+02:15:02,639 --> 02:15:04,800
+so
+
+3718
+02:15:06,880 --> 02:15:09,840
+contains
+
+3719
+02:15:15,439 --> 02:15:19,839
+there we go so now what we can do is if
+
+3720
+02:15:18,319 --> 02:15:21,39
+you look further in the email we see
+
+3721
+02:15:19,840 --> 02:15:22,480
+that there is a bunch of other stuff
+
+3722
+02:15:21,39 --> 02:15:23,198
+still described so what we can do is we
+
+3723
+02:15:22,479 --> 02:15:27,598
+can just
+
+3724
+02:15:23,198 --> 02:15:30,238
+now for exercise sake just take um
+
+3725
+02:15:27,599 --> 02:15:30,880
+at least a next few lines or the next
+
+3726
+02:15:30,238 --> 02:15:33,198
+paragraph
+
+3727
+02:15:30,880 --> 02:15:35,118
+and drop the entire paragraph into
+
+3728
+02:15:33,198 --> 02:15:37,118
+something called the free text importer
+
+3729
+02:15:35,118 --> 02:15:38,319
+what this will do is it will try to
+
+3730
+02:15:37,118 --> 02:15:40,238
+parse this uh
+
+3731
+02:15:38,319 --> 02:15:41,679
+this text blob and it will try to
+
+3732
+02:15:40,238 --> 02:15:43,678
+extract anything that looks like an
+
+3733
+02:15:41,679 --> 02:15:44,319
+indicator out of that so this is another
+
+3734
+02:15:43,679 --> 02:15:46,78
+method of
+
+3735
+02:15:44,319 --> 02:15:49,39
+of basically entering attribute
+
+3736
+02:15:46,78 --> 02:15:51,679
+synthesis so free text import
+
+3737
+02:15:49,39 --> 02:15:54,319
+we just paste it in there and we just
+
+3738
+02:15:51,679 --> 02:15:54,319
+hit submit
+
+3739
+02:15:54,399 --> 02:15:57,679
+so this will tell us in this case it
+
+3740
+02:15:55,760 --> 02:15:59,280
+didn't extract everything actually so we
+
+3741
+02:15:57,679 --> 02:16:00,158
+need to still go back to it and refined
+
+3742
+02:15:59,279 --> 02:16:01,920
+a bit more
+
+3743
+02:16:00,158 --> 02:16:03,118
+but it extracted some of those things
+
+3744
+02:16:01,920 --> 02:16:05,39
+that were in there already so that's
+
+3745
+02:16:03,118 --> 02:16:07,598
+fine we can just already add those
+
+3746
+02:16:05,39 --> 02:16:07,599
+to the event
+
+3747
+02:16:08,238 --> 02:16:12,479
+so how does it work in in behind the
+
+3748
+02:16:10,238 --> 02:16:13,519
+scenes uh we have a bunch of regex
+
+3749
+02:16:12,479 --> 02:16:15,198
+images
+
+3750
+02:16:13,520 --> 02:16:17,199
+automatically extracting information
+
+3751
+02:16:15,198 --> 02:16:18,719
+from from natural text
+
+3752
+02:16:17,198 --> 02:16:20,559
+it's one way to do it there's another
+
+3753
+02:16:18,719 --> 02:16:21,760
+tool for doing it which is part of the
+
+3754
+02:16:20,560 --> 02:16:24,639
+even report
+
+3755
+02:16:21,760 --> 02:16:26,159
+um but it's usually it's a quick way to
+
+3756
+02:16:24,639 --> 02:16:28,880
+automatically extract information and to
+
+3757
+02:16:26,158 --> 02:16:31,198
+see if it's already known for example
+
+3758
+02:16:28,880 --> 02:16:32,318
+so what we see here already is that evil
+
+3759
+02:16:31,198 --> 02:16:35,119
+provider
+
+3760
+02:16:32,318 --> 02:16:36,79
+was basically according to the email
+
+3761
+02:16:35,120 --> 02:16:38,800
+text
+
+3762
+02:16:36,79 --> 02:16:40,959
+and the place that was uh used to
+
+3763
+02:16:38,799 --> 02:16:43,920
+download the secondary payload from
+
+3764
+02:16:40,959 --> 02:16:44,558
+so we can take evil provider and we also
+
+3765
+02:16:43,920 --> 02:16:46,719
+know that
+
+3766
+02:16:44,558 --> 02:16:47,920
+we got an ipv6 address to it so we're
+
+3767
+02:16:46,718 --> 02:16:51,39
+going to add that to it as well and
+
+3768
+02:16:47,920 --> 02:16:52,879
+convert this into an object again
+
+3769
+02:16:51,40 --> 02:16:54,880
+so we're going to to just select that
+
+3770
+02:16:52,879 --> 02:16:55,438
+one convert to object and the object
+
+3771
+02:16:54,879 --> 02:16:58,159
+that we're
+
+3772
+02:16:55,439 --> 02:17:01,599
+going to convert it to is going to be a
+
+3773
+02:16:58,159 --> 02:17:04,799
+url object
+
+3774
+02:17:01,599 --> 02:17:07,120
+yep all the way down there perfect
+
+3775
+02:17:04,799 --> 02:17:08,558
+let's just do the conversion and then we
+
+3776
+02:17:07,120 --> 02:17:09,920
+edit the object afterwards and we add
+
+3777
+02:17:08,558 --> 02:17:12,318
+the additional information that we have
+
+3778
+02:17:09,920 --> 02:17:12,318
+about it
+
+3779
+02:17:12,638 --> 02:17:18,318
+so we have an ipv6 that we can that it
+
+3780
+02:17:15,840 --> 02:17:18,318
+resolves to
+
+3781
+02:17:24,239 --> 02:17:29,840
+we also have a port so once we're done
+
+3782
+02:17:26,959 --> 02:17:29,839
+with that
+
+3783
+02:17:31,280 --> 02:17:34,639
+happy destination perfect
+
+3784
+02:17:36,159 --> 02:17:43,840
+we can also add the port it was
+
+3785
+02:17:38,799 --> 02:17:43,840
+communicating on port 443
+
+3786
+02:17:46,558 --> 02:17:50,239
+and again everything i'm currently doing
+
+3787
+02:17:48,799 --> 02:17:53,920
+there can be done through
+
+3788
+02:17:50,239 --> 02:17:57,840
+api obviously yeah and and finally we
+
+3789
+02:17:53,920 --> 02:17:57,840
+also have a domain evilprovider.com
+
+3790
+02:18:02,638 --> 02:18:08,79
+now let's deal with with referencing the
+
+3791
+02:18:05,840 --> 02:18:09,40
+this to the other objects later on we
+
+3792
+02:18:08,79 --> 02:18:11,280
+can still
+
+3793
+02:18:09,40 --> 02:18:12,960
+still add the additional information
+
+3794
+02:18:11,280 --> 02:18:15,439
+that we have in there and then we do the
+
+3795
+02:18:12,959 --> 02:18:17,358
+linking afterwards again we we have the
+
+3796
+02:18:15,439 --> 02:18:20,159
+same problem here on this one because
+
+3797
+02:18:17,359 --> 02:18:21,760
+you see that the command has a the part
+
+3798
+02:18:20,159 --> 02:18:23,679
+it has a command so that means we can
+
+3799
+02:18:21,760 --> 02:18:25,359
+just convert it as an object again
+
+3800
+02:18:23,679 --> 02:18:27,679
+yeah and the ip belongs to that one as
+
+3801
+02:18:25,359 --> 02:18:30,719
+well by the way okay great
+
+3802
+02:18:27,679 --> 02:18:31,679
+it's even better yeah exactly just my
+
+3803
+02:18:30,718 --> 02:18:39,839
+screen that is a bit
+
+3804
+02:18:31,679 --> 02:18:39,840
+smaller okay
+
+3805
+02:18:40,318 --> 02:18:43,920
+so in this case it's again a url
+
+3806
+02:18:49,359 --> 02:18:54,719
+and the things that we have this time
+
+3807
+02:18:52,718 --> 02:18:56,239
+the port is actually a high port so
+
+3808
+02:18:54,718 --> 02:18:58,79
+while in the other one we do not
+
+3809
+02:18:56,239 --> 02:18:59,519
+correlate on on the port because port
+
+3810
+02:18:58,79 --> 02:19:01,359
+443 is common
+
+3811
+02:18:59,519 --> 02:19:03,40
+this is one of those ports that we might
+
+3812
+02:19:01,359 --> 02:19:04,639
+want to correlate on already
+
+3813
+02:19:03,40 --> 02:19:07,840
+so we want we don't want to disable
+
+3814
+02:19:04,638 --> 02:19:07,839
+correlation for this one
+
+3815
+02:19:09,840 --> 02:19:13,120
+once for the other one we we should
+
+3816
+02:19:11,679 --> 02:19:15,439
+disable the correlation for the other
+
+3817
+02:19:13,120 --> 02:19:15,439
+part
+
+3818
+02:19:18,840 --> 02:19:25,280
+443
+
+3819
+02:19:21,280 --> 02:19:27,280
+okay now the other thing that we have at
+
+3820
+02:19:25,280 --> 02:19:28,719
+this point is we have a secondary sample
+
+3821
+02:19:27,280 --> 02:19:30,719
+so if you can you have a second one that
+
+3822
+02:19:28,718 --> 02:19:34,959
+you can upload yeah i just just add the
+
+3823
+02:19:30,718 --> 02:19:39,279
+domain so i get it
+
+3824
+02:19:34,959 --> 02:19:41,358
+okay so what do you want
+
+3825
+02:19:39,280 --> 02:19:42,479
+so we still have another file to update
+
+3826
+02:19:41,359 --> 02:19:45,359
+and we have a cv
+
+3827
+02:19:42,478 --> 02:19:48,318
+that was also mentioned in the okay cv
+
+3828
+02:19:45,359 --> 02:19:50,559
+it's an interesting one um
+
+3829
+02:19:48,318 --> 02:19:51,519
+we have we have single attributes for cd
+
+3830
+02:19:50,559 --> 02:19:53,119
+but
+
+3831
+02:19:51,520 --> 02:19:55,680
+sometimes you want to have some more
+
+3832
+02:19:53,120 --> 02:19:56,160
+information so what you could do there
+
+3833
+02:19:55,680 --> 02:19:58,960
+is
+
+3834
+02:19:56,159 --> 02:20:02,719
+to create a simple attribute um so the
+
+3835
+02:19:58,959 --> 02:20:05,438
+cv is much better delivery in this case
+
+3836
+02:20:02,719 --> 02:20:08,79
+we have type which is vulnerability and
+
+3837
+02:20:05,439 --> 02:20:11,200
+usually a venerability is defined by cv
+
+3838
+02:20:08,79 --> 02:20:12,719
+you can you can use other value but
+
+3839
+02:20:11,200 --> 02:20:14,880
+the best practice is the obviously to
+
+3840
+02:20:12,719 --> 02:20:17,119
+use cd
+
+3841
+02:20:14,879 --> 02:20:19,39
+it's very old cv those kind of attackers
+
+3842
+02:20:17,120 --> 02:20:21,120
+are always reusing those kind of old
+
+3843
+02:20:19,40 --> 02:20:22,640
+things but you know it works you know
+
+3844
+02:20:21,120 --> 02:20:25,439
+never people never patch i
+
+3845
+02:20:22,639 --> 02:20:26,799
+know this one is interesting because you
+
+3846
+02:20:25,439 --> 02:20:29,439
+know it was exploited
+
+3847
+02:20:26,799 --> 02:20:31,199
+so i would add the ideas flag because it
+
+3848
+02:20:29,439 --> 02:20:32,159
+may be interesting to look into your
+
+3849
+02:20:31,200 --> 02:20:35,40
+system for
+
+3850
+02:20:32,159 --> 02:20:36,398
+additional ones so in this case what do
+
+3851
+02:20:35,40 --> 02:20:39,439
+we have we have again
+
+3852
+02:20:36,398 --> 02:20:41,358
+a single attribute which is not the nice
+
+3853
+02:20:39,439 --> 02:20:43,520
+thing that you want to have is basically
+
+3854
+02:20:41,359 --> 02:20:44,318
+you want to have as much context as you
+
+3855
+02:20:43,520 --> 02:20:47,600
+want
+
+3856
+02:20:44,318 --> 02:20:48,0
+8444.319 --> 8448
+for such kind of investigation luckily
+
+3857
+02:20:47,600 --> 02:20:51,40
+on
+
+3858
+02:20:48,0 --> 02:20:53,359
+8448 --> 8453.359
+this instance we have one of those
+
+3859
+02:20:51,40 --> 02:20:58,479
+expansion modules
+
+3860
+02:20:53,359 --> 02:21:00,559
+and why the cv advantage is okay
+
+3861
+02:20:58,478 --> 02:21:02,79
+great so and then you have some
+
+3862
+02:21:00,559 --> 02:21:03,840
+additional information in this case we
+
+3863
+02:21:02,79 --> 02:21:06,959
+have some some description
+
+3864
+02:21:03,840 --> 02:21:07,920
+um so what i can do in this in this one
+
+3865
+02:21:06,959 --> 02:21:11,358
+is
+
+3866
+02:21:07,920 --> 02:21:14,639
+so you see that we have either the
+
+3867
+02:21:11,359 --> 02:21:16,318
+overlay uh thing so in these modules uh
+
+3868
+02:21:14,639 --> 02:21:16,959
+someone was asking about extension of
+
+3869
+02:21:16,318 --> 02:21:18,719
+this
+
+3870
+02:21:16,959 --> 02:21:19,759
+is one way you have this overlay things
+
+3871
+02:21:18,719 --> 02:21:20,639
+where you can basically just do
+
+3872
+02:21:19,760 --> 02:21:23,680
+expansions
+
+3873
+02:21:20,639 --> 02:21:25,119
+and see okay contextual information but
+
+3874
+02:21:23,680 --> 02:21:26,960
+sometimes you just want to be
+
+3875
+02:21:25,120 --> 02:21:29,190
+to have a bit more than just contextual
+
+3876
+02:21:26,959 --> 02:21:31,199
+information uh you want to have
+
+3877
+02:21:29,190 --> 02:21:33,920
+[Music]
+
+3878
+02:21:31,200 --> 02:21:36,240
+the uh associated object then so there
+
+3879
+02:21:33,920 --> 02:21:38,159
+you have this this kind of
+
+3880
+02:21:36,239 --> 02:21:40,879
+kind of explosion there and you can add
+
+3881
+02:21:38,159 --> 02:21:42,79
+the enrichment i'll give a try on that
+
+3882
+02:21:40,879 --> 02:21:44,79
+one
+
+3883
+02:21:42,79 --> 02:21:45,920
+okay great so there's something wrong on
+
+3884
+02:21:44,79 --> 02:21:48,478
+this machine that's great
+
+3885
+02:21:45,920 --> 02:21:49,840
+i'll take the other one but this this
+
+3886
+02:21:48,478 --> 02:21:53,199
+it's not an object for that
+
+3887
+02:21:49,840 --> 02:21:55,120
+that's fine we can just like yeah can
+
+3888
+02:21:53,200 --> 02:21:56,399
+summon the attribute in this case
+
+3889
+02:21:55,120 --> 02:21:58,560
+so we have basically the description
+
+3890
+02:21:56,398 --> 02:22:01,599
+then coming from the enrichment
+
+3891
+02:21:58,559 --> 02:22:04,239
+and what we can do is to uh
+
+3892
+02:22:01,600 --> 02:22:05,520
+then make an object called vulnerability
+
+3893
+02:22:04,239 --> 02:22:07,920
+then
+
+3894
+02:22:05,520 --> 02:22:09,359
+id credit in this case is the
+
+3895
+02:22:07,920 --> 02:22:12,398
+descriptions
+
+3896
+02:22:09,359 --> 02:22:14,559
+and make an object of it usually you
+
+3897
+02:22:12,398 --> 02:22:16,639
+should have a full
+
+3898
+02:22:14,559 --> 02:22:19,39
+expansion there but i didn't test it on
+
+3899
+02:22:16,639 --> 02:22:22,559
+the training instance maybe something is
+
+3900
+02:22:19,40 --> 02:22:23,280
+broken on that instance okay so now what
+
+3901
+02:22:22,559 --> 02:22:25,920
+do we have is
+
+3902
+02:22:23,280 --> 02:22:27,840
+it's more contextual information we we
+
+3903
+02:22:25,920 --> 02:22:29,520
+start with a story and there
+
+3904
+02:22:27,840 --> 02:22:31,920
+we see that we have an emails we have a
+
+3905
+02:22:29,520 --> 02:22:34,640
+first url a second one which is a
+
+3906
+02:22:31,920 --> 02:22:36,239
+download and a specific cv so maybe no
+
+3907
+02:22:34,639 --> 02:22:38,79
+we can go back to the uh
+
+3908
+02:22:36,239 --> 02:22:39,280
+we still miss one thing which was a
+
+3909
+02:22:38,79 --> 02:22:42,239
+secondary file that was
+
+3910
+02:22:39,280 --> 02:22:43,40
+downloaded oh okay from the secondary
+
+3911
+02:22:42,239 --> 02:22:46,799
+files yes
+
+3912
+02:22:43,40 --> 02:22:47,280
+yeah so according to story what happens
+
+3913
+02:22:46,799 --> 02:22:50,318
+was
+
+3914
+02:22:47,280 --> 02:22:52,319
+uh the initial sample was uh
+
+3915
+02:22:50,318 --> 02:22:54,239
+when executed was downloading a
+
+3916
+02:22:52,318 --> 02:22:56,559
+secondary
+
+3917
+02:22:54,239 --> 02:22:57,680
+sample and that one was basically then
+
+3918
+02:22:56,559 --> 02:23:00,719
+used to
+
+3919
+02:22:57,680 --> 02:23:01,40
+exfiltrate data from from the system yes
+
+3920
+02:23:00,719 --> 02:23:03,519
+so
+
+3921
+02:23:01,40 --> 02:23:05,200
+this was a new railway download the
+
+3922
+02:23:03,520 --> 02:23:08,479
+interest files okay
+
+3923
+02:23:05,200 --> 02:23:09,600
+then i will add a yeah just another file
+
+3924
+02:23:08,478 --> 02:23:11,599
+and we just
+
+3925
+02:23:09,600 --> 02:23:13,200
+pretend it's the one that we were
+
+3926
+02:23:11,600 --> 02:23:14,239
+supposed to use why is this one it makes
+
+3927
+02:23:13,200 --> 02:23:17,280
+sense it's an emote that's one
+
+3928
+02:23:14,239 --> 02:23:17,280
+downloaded form in your eyes
+
+3929
+02:23:17,439 --> 02:23:20,159
+that makes sense
+
+3930
+02:23:21,359 --> 02:23:24,399
+so now we have all these different
+
+3931
+02:23:22,959 --> 02:23:25,919
+objects in our event and it's time to
+
+3932
+02:23:24,398 --> 02:23:27,439
+build the story out of it as alex has
+
+3933
+02:23:25,920 --> 02:23:33,840
+mentioned so it's time to go back to our
+
+3934
+02:23:27,439 --> 02:23:33,840
+event graph
+
+3935
+02:23:34,879 --> 02:23:38,0
+8614.88 --> 8618
+and basically uh so far the story is
+
+3936
+02:23:37,200 --> 02:23:39,920
+that we got
+
+3937
+02:23:38,0 --> 02:23:42,559
+8618 --> 8622.56
+an email the email was impersonating a
+
+3938
+02:23:39,920 --> 02:23:44,799
+person and we basically got
+
+3939
+02:23:42,559 --> 02:23:45,840
+a primary sample out of the that primary
+
+3940
+02:23:44,799 --> 02:23:50,398
+sample then reaches
+
+3941
+02:23:45,840 --> 02:23:50,398
+out to evilprovider.com
+
+3942
+02:23:50,559 --> 02:23:55,600
+to download a secondary sample so we
+
+3943
+02:23:53,680 --> 02:23:59,120
+have a relationship
+
+3944
+02:23:55,600 --> 02:24:02,239
+between the file
+
+3945
+02:23:59,120 --> 02:24:02,240
+which downloads from
+
+3946
+02:24:02,318 --> 02:24:09,119
+downloads from yeah perfect
+
+3947
+02:24:06,959 --> 02:24:10,799
+from evil provider and then evil
+
+3948
+02:24:09,120 --> 02:24:15,840
+provider downloads
+
+3949
+02:24:10,799 --> 02:24:15,840
+the secondary sample
+
+3950
+02:24:19,200 --> 02:24:29,840
+which is in this case index dot html one
+
+3951
+02:24:33,359 --> 02:24:43,840
+and this one then exfiltrates to the
+
+3952
+02:24:36,398 --> 02:24:43,840
+another evil provider url
+
+3953
+02:24:52,239 --> 02:24:55,600
+now there's one thing we missed in the
+
+3954
+02:24:53,520 --> 02:24:57,40
+story here is that the first one try so
+
+3955
+02:24:55,600 --> 02:25:00,159
+in this case trilogy
+
+3956
+02:24:57,40 --> 02:25:03,40
+was actually abusing the cve that uh
+
+3957
+02:25:00,159 --> 02:25:04,398
+that alex has already expanded so we
+
+3958
+02:25:03,40 --> 02:25:08,560
+have an abuser's
+
+3959
+02:25:04,398 --> 02:25:08,559
+relationship from trilogothexa to
+
+3960
+02:25:08,840 --> 02:25:11,840
+vulnerability
+
+3961
+02:25:13,680 --> 02:25:17,359
+so and once we're done with this we
+
+3962
+02:25:15,760 --> 02:25:19,439
+already see the entire store in this car
+
+3963
+02:25:17,359 --> 02:25:20,800
+so even if you if you have no idea about
+
+3964
+02:25:19,439 --> 02:25:22,800
+what happened in the report and you
+
+3965
+02:25:20,799 --> 02:25:24,318
+don't read the original report
+
+3966
+02:25:22,799 --> 02:25:26,478
+by just looking at this graph you can
+
+3967
+02:25:24,318 --> 02:25:29,519
+clearly read it out
+
+3968
+02:25:26,478 --> 02:25:31,519
+in in in simple sentences we see email
+
+3969
+02:25:29,520 --> 02:25:34,960
+in person later first and john
+
+3970
+02:25:31,520 --> 02:25:36,159
+email contains trilogy exploits
+
+3971
+02:25:34,959 --> 02:25:39,159
+vulnerability
+
+3972
+02:25:36,159 --> 02:25:40,318
+downloads from evoprovider.com
+
+3973
+02:25:39,159 --> 02:25:43,680
+index.html1
+
+3974
+02:25:40,318 --> 02:25:45,760
+which exfiltrates to a url so it's a
+
+3975
+02:25:43,680 --> 02:25:46,79
+very simple story to comprehend without
+
+3976
+02:25:45,760 --> 02:25:48,239
+us
+
+3977
+02:25:46,79 --> 02:25:50,0
+8746.08 --> 8750
+knowing the original data information
+
+3978
+02:25:48,239 --> 02:25:50,318
+and without us having even having to
+
+3979
+02:25:50,0 --> 02:25:52,0
+8750 --> 8752
+look
+
+3980
+02:25:50,318 --> 02:25:53,359
+at the individual indicators further
+
+3981
+02:25:52,0 --> 02:25:55,760
+8752 --> 8755.76
+below
+
+3982
+02:25:53,359 --> 02:25:56,800
+so this is when we're talking about
+
+3983
+02:25:55,760 --> 02:25:59,40
+information sharing
+
+3984
+02:25:56,799 --> 02:26:00,478
+we're basically sharing on two layers
+
+3985
+02:25:59,40 --> 02:26:02,640
+one of the layers is sharing with
+
+3986
+02:26:00,478 --> 02:26:04,79
+machines so informing an ids about
+
+3987
+02:26:02,639 --> 02:26:05,599
+things to alert on
+
+3988
+02:26:04,79 --> 02:26:07,280
+and at the same time we're sharing with
+
+3989
+02:26:05,600 --> 02:26:09,40
+analysts that want to really understand
+
+3990
+02:26:07,280 --> 02:26:09,600
+what the introductory was doing in this
+
+3991
+02:26:09,40 --> 02:26:11,760
+case
+
+3992
+02:26:09,600 --> 02:26:13,120
+and what happened during the incident
+
+3993
+02:26:11,760 --> 02:26:15,600
+however at this stage
+
+3994
+02:26:13,120 --> 02:26:17,520
+we have described our event but we're
+
+3995
+02:26:15,600 --> 02:26:20,479
+still missing something at this point
+
+3996
+02:26:17,520 --> 02:26:21,760
+we still haven't actually contextualized
+
+3997
+02:26:20,478 --> 02:26:23,39
+the information with everything else
+
+3998
+02:26:21,760 --> 02:26:26,159
+that we know about it
+
+3999
+02:26:23,40 --> 02:26:27,40
+so we have we have vocabularies at our
+
+4000
+02:26:26,159 --> 02:26:28,879
+disposal
+
+4001
+02:26:27,40 --> 02:26:30,399
+we have at the attack matrix at our
+
+4002
+02:26:28,879 --> 02:26:31,679
+disposal so let's
+
+4003
+02:26:30,398 --> 02:26:33,760
+start going through the individual
+
+4004
+02:26:31,680 --> 02:26:34,559
+attributes and let's start to attach
+
+4005
+02:26:33,760 --> 02:26:37,520
+those different
+
+4006
+02:26:34,559 --> 02:26:38,79
+labels to the data so first of all if we
+
+4007
+02:26:37,520 --> 02:26:41,120
+look at
+
+4008
+02:26:38,79 --> 02:26:42,318
+uh perhaps which one which one should we
+
+4009
+02:26:41,120 --> 02:26:44,79
+start with
+
+4010
+02:26:42,318 --> 02:26:45,760
+let's not do everything let's look at
+
+4011
+02:26:44,79 --> 02:26:47,520
+the original email for example
+
+4012
+02:26:45,760 --> 02:26:49,120
+we know that the original email deals
+
+4013
+02:26:47,520 --> 02:26:51,120
+with fishing now
+
+4014
+02:26:49,120 --> 02:26:52,720
+attack has a pattern that describes
+
+4015
+02:26:51,120 --> 02:26:55,760
+fishing so we can just attach
+
+4016
+02:26:52,719 --> 02:26:59,279
+the galaxy cluster of attack to
+
+4017
+02:26:55,760 --> 02:27:02,960
+and to the attributes in there so
+
+4018
+02:26:59,280 --> 02:27:04,800
+we use cluster yeah and we can just use
+
+4019
+02:27:02,959 --> 02:27:07,759
+the text
+
+4020
+02:27:04,799 --> 02:27:08,318
+magic perfect and we can click on attack
+
+4021
+02:27:07,760 --> 02:27:11,200
+pattern
+
+4022
+02:27:08,318 --> 02:27:12,79
+then we get the attack matrix and here
+
+4023
+02:27:11,200 --> 02:27:16,290
+we can select
+
+4024
+02:27:12,79 --> 02:27:19,120
+uh phishing it should be in
+
+4025
+02:27:16,290 --> 02:27:20,880
+[Music]
+
+4026
+02:27:19,120 --> 02:27:23,359
+you see yeah there it is perfect so we
+
+4027
+02:27:20,879 --> 02:27:23,358
+attach it
+
+4028
+02:27:23,840 --> 02:27:27,359
+we refresh and there we see it is now
+
+4029
+02:27:26,318 --> 02:27:30,0
+8846.319 --> 8850
+attached to the
+
+4030
+02:27:27,359 --> 02:27:31,680
+attribute and if we if we generate a
+
+4031
+02:27:30,0 --> 02:27:32,879
+8850 --> 8852.88
+heat pack now out of the events if we
+
+4032
+02:27:31,680 --> 02:27:35,680
+scroll up
+
+4033
+02:27:32,879 --> 02:27:37,39
+we have an attack matrix view next to
+
+4034
+02:27:35,680 --> 02:27:39,520
+the event graph
+
+4035
+02:27:37,40 --> 02:27:40,399
+if we click on that one now we now see
+
+4036
+02:27:39,520 --> 02:27:43,200
+that
+
+4037
+02:27:40,398 --> 02:27:44,0
+8860.399 --> 8864
+as a first overview already we know
+
+4038
+02:27:43,200 --> 02:27:45,520
+without looking
+
+4039
+02:27:44,0 --> 02:27:47,359
+8864 --> 8867.359
+at any of the details we see that we're
+
+4040
+02:27:45,520 --> 02:27:48,800
+dealing with positioning here so this is
+
+4041
+02:27:47,359 --> 02:27:49,600
+one of the attack patterns that we've
+
+4042
+02:27:48,799 --> 02:27:50,879
+described
+
+4043
+02:27:49,600 --> 02:27:52,399
+let's see what other attack patterns
+
+4044
+02:27:50,879 --> 02:27:53,920
+from attack we can describe you also see
+
+4045
+02:27:52,398 --> 02:27:55,599
+that there is automated
+
+4046
+02:27:53,920 --> 02:27:57,520
+exfiltration happening so if we go to
+
+4047
+02:27:55,600 --> 02:28:01,840
+the secondary url
+
+4048
+02:27:57,520 --> 02:28:01,840
+so another evilprovider.com
+
+4049
+02:28:03,280 --> 02:28:06,960
+we can attach the pattern there as well
+
+4050
+02:28:05,520 --> 02:28:08,560
+now we can choose to do
+
+4051
+02:28:06,959 --> 02:28:10,159
+a single attribute what we're doing or
+
+4052
+02:28:08,559 --> 02:28:11,760
+we can just select all four and attach
+
+4053
+02:28:10,159 --> 02:28:12,0
+8890.16 --> 8892
+the cluster tool for let's just do one
+
+4054
+02:28:11,760 --> 02:28:15,120
+for
+
+4055
+02:28:12,0 --> 02:28:19,760
+8892 --> 8899.76
+now it's it's it's enough
+
+4056
+02:28:15,120 --> 02:28:19,760
+uh watch out it's uh yeah perfect
+
+4057
+02:28:21,40 --> 02:28:24,399
+and just pick automated exfiltration
+
+4058
+02:28:23,600 --> 02:28:27,840
+it's the
+
+4059
+02:28:24,398 --> 02:28:27,840
+first one on the yeah
+
+4060
+02:28:30,79 --> 02:28:33,120
+okay so now we've attached some attack
+
+4061
+02:28:32,0 --> 02:28:35,280
+8912 --> 8915.28
+patterns uh
+
+4062
+02:28:33,120 --> 02:28:36,720
+we we could attach it to the sample as
+
+4063
+02:28:35,280 --> 02:28:38,479
+well what the sample is doing but we're
+
+4064
+02:28:36,719 --> 02:28:40,478
+not going to go through
+
+4065
+02:28:38,478 --> 02:28:42,239
+all that effort let's look at some type
+
+4066
+02:28:40,478 --> 02:28:45,679
+of contextualization
+
+4067
+02:28:42,239 --> 02:28:47,119
+for example maybe this
+
+4068
+02:28:45,680 --> 02:28:49,200
+then it's a matter of test again
+
+4069
+02:28:47,120 --> 02:28:50,560
+regarding the at which level you want to
+
+4070
+02:28:49,200 --> 02:28:53,840
+attach
+
+4071
+02:28:50,559 --> 02:28:54,959
+the galaxy there is the topic is a
+
+4072
+02:28:53,840 --> 02:28:57,439
+matter of fishing
+
+4073
+02:28:54,959 --> 02:29:00,398
+at a global level usually we can add a
+
+4074
+02:28:57,439 --> 02:29:04,239
+galaxy there and then for example
+
+4075
+02:29:00,398 --> 02:29:07,519
+add my tray attack directly there
+
+4076
+02:29:04,239 --> 02:29:09,840
+and select the pattern fishing then
+
+4077
+02:29:07,520 --> 02:29:11,600
+the techniques there directly so you
+
+4078
+02:29:09,840 --> 02:29:13,760
+have different options
+
+4079
+02:29:11,600 --> 02:29:15,760
+usually we recommend to make it as
+
+4080
+02:29:13,760 --> 02:29:17,200
+attribute level
+
+4081
+02:29:15,760 --> 02:29:18,880
+but in some case you don't even know
+
+4082
+02:29:17,200 --> 02:29:22,79
+which attribute level it applies
+
+4083
+02:29:18,879 --> 02:29:24,318
+then you select the even level exactly
+
+4084
+02:29:22,79 --> 02:29:25,840
+so so that's indeed a good point if you
+
+4085
+02:29:24,318 --> 02:29:26,959
+know that the entire chain of what
+
+4086
+02:29:25,840 --> 02:29:29,680
+you're describing
+
+4087
+02:29:26,959 --> 02:29:32,0
+8966.96 --> 8972
+referring to the single uh
+
+4088
+02:29:29,680 --> 02:29:34,559
+contextualization beta label be it a
+
+4089
+02:29:32,0 --> 02:29:36,398
+8972 --> 8976.399
+galaxy cluster then indeed what we
+
+4090
+02:29:34,559 --> 02:29:38,719
+assume is anything that you label on the
+
+4091
+02:29:36,398 --> 02:29:41,439
+event level is inherited by all
+
+4092
+02:29:38,719 --> 02:29:42,398
+uh data contained in unless explicitly
+
+4093
+02:29:41,439 --> 02:29:45,760
+overwritten by
+
+4094
+02:29:42,398 --> 02:29:48,478
+the opposite tag basically so
+
+4095
+02:29:45,760 --> 02:29:49,439
+so indeed that's the case uh in this
+
+4096
+02:29:48,478 --> 02:29:51,39
+case
+
+4097
+02:29:49,439 --> 02:29:52,720
+we're kind of in a weird situation
+
+4098
+02:29:51,40 --> 02:29:54,560
+because we're describing the full chain
+
+4099
+02:29:52,719 --> 02:29:56,719
+of the attack which includes initial
+
+4100
+02:29:54,559 --> 02:29:58,559
+phishing attempt but also includes the
+
+4101
+02:29:56,719 --> 02:29:59,358
+secondary payload and the exfiltration
+
+4102
+02:29:58,559 --> 02:30:00,959
+and so on
+
+4103
+02:29:59,359 --> 02:30:02,479
+and if we if you do this on the
+
+4104
+02:30:00,959 --> 02:30:03,39
+attribute level i suppose the event
+
+4105
+02:30:02,478 --> 02:30:05,519
+level
+
+4106
+02:30:03,40 --> 02:30:06,560
+then you're really really only
+
+4107
+02:30:05,520 --> 02:30:08,479
+describing
+
+4108
+02:30:06,559 --> 02:30:10,398
+which part deals with the fishing which
+
+4109
+02:30:08,478 --> 02:30:11,39
+part deals with the actual exfiltration
+
+4110
+02:30:10,398 --> 02:30:12,799
+and so on
+
+4111
+02:30:11,40 --> 02:30:14,640
+so this is really up to you what we
+
+4112
+02:30:12,799 --> 02:30:16,398
+generally recommend is
+
+4113
+02:30:14,639 --> 02:30:18,398
+don't just do it on the event level so
+
+4114
+02:30:16,398 --> 02:30:19,439
+if you're describing more concepts in a
+
+4115
+02:30:18,398 --> 02:30:20,719
+single event
+
+4116
+02:30:19,439 --> 02:30:22,559
+make sure that you contextualize
+
+4117
+02:30:20,719 --> 02:30:23,920
+individual parts of it
+
+4118
+02:30:22,559 --> 02:30:25,840
+because one of one of the things that we
+
+4119
+02:30:23,920 --> 02:30:27,359
+use these labels for as well is searches
+
+4120
+02:30:25,840 --> 02:30:28,318
+so if i were to search for all
+
+4121
+02:30:27,359 --> 02:30:30,800
+indicators
+
+4122
+02:30:28,318 --> 02:30:32,159
+that relate to phishing i might not want
+
+4123
+02:30:30,799 --> 02:30:35,920
+to get the secondary
+
+4124
+02:30:32,159 --> 02:30:37,760
+payloads effects uh included in that
+
+4125
+02:30:35,920 --> 02:30:39,359
+response because that was just the
+
+4126
+02:30:37,760 --> 02:30:41,200
+initial vector of getting into the
+
+4127
+02:30:39,359 --> 02:30:42,880
+network of the victim
+
+4128
+02:30:41,200 --> 02:30:44,720
+whatever happens afterwards is not
+
+4129
+02:30:42,879 --> 02:30:46,959
+directly related to the phishing
+
+4130
+02:30:44,719 --> 02:30:48,478
+so keep that in mind as well something
+
+4131
+02:30:46,959 --> 02:30:50,559
+else
+
+4132
+02:30:48,478 --> 02:30:52,799
+yeah so some just just something that
+
+4133
+02:30:50,559 --> 02:30:54,639
+you have to keep in mind too it's about
+
+4134
+02:30:52,799 --> 02:30:56,79
+which classification to choose or which
+
+4135
+02:30:54,639 --> 02:30:56,799
+contractualization source you have to
+
+4136
+02:30:56,79 --> 02:30:59,600
+want to
+
+4137
+02:30:56,799 --> 02:31:00,79
+to use um on this instance we have
+
+4138
+02:30:59,600 --> 02:31:02,800
+already
+
+4139
+02:31:00,79 --> 02:31:04,639
+a lot of things enabled and if for
+
+4140
+02:31:02,799 --> 02:31:06,79
+example you go for taxonomy
+
+4141
+02:31:04,639 --> 02:31:08,478
+you have a lot of taxonomy that is
+
+4142
+02:31:06,79 --> 02:31:10,719
+describing fishing
+
+4143
+02:31:08,478 --> 02:31:11,760
+for for example you have even a complete
+
+4144
+02:31:10,719 --> 02:31:14,959
+taxonomy
+
+4145
+02:31:11,760 --> 02:31:15,680
+about the kind of fishing you have and
+
+4146
+02:31:14,959 --> 02:31:18,639
+so on
+
+4147
+02:31:15,680 --> 02:31:21,280
+so when you install your miss pinstance
+
+4148
+02:31:18,639 --> 02:31:23,358
+and you start to make it operational
+
+4149
+02:31:21,280 --> 02:31:24,800
+you really have to decide what kind of
+
+4150
+02:31:23,359 --> 02:31:26,720
+taxonomy you want to use
+
+4151
+02:31:24,799 --> 02:31:29,920
+in this case we have already a lot of
+
+4152
+02:31:26,719 --> 02:31:32,478
+things are available by default
+
+4153
+02:31:29,920 --> 02:31:35,200
+so the fishing taxonomy itself is a
+
+4154
+02:31:32,478 --> 02:31:37,358
+complete one coming from a finger
+
+4155
+02:31:35,200 --> 02:31:39,840
+towards academic paper where we have all
+
+4156
+02:31:37,359 --> 02:31:41,600
+the techniques that are used so
+
+4157
+02:31:39,840 --> 02:31:44,239
+for example you can say that this one is
+
+4158
+02:31:41,600 --> 02:31:44,239
+coming from a
+
+4159
+02:31:44,559 --> 02:31:51,439
+spearfishing which was described there
+
+4160
+02:31:48,318 --> 02:31:54,0
+9108.319 --> 9114
+and you have the different techniques
+
+4161
+02:31:51,439 --> 02:31:55,520
+so in this case it's email spoofing and
+
+4162
+02:31:54,0 --> 02:31:57,760
+9114 --> 9117.76
+you can go deeper there
+
+4163
+02:31:55,520 --> 02:31:58,720
+into the description of what is exactly
+
+4164
+02:31:57,760 --> 02:32:01,840
+the decision
+
+4165
+02:31:58,719 --> 02:32:04,0
+9118.72 --> 9124
+and you can mix match both i mean under
+
+4166
+02:32:01,840 --> 02:32:06,478
+selectively attack
+
+4167
+02:32:04,0 --> 02:32:07,200
+9124 --> 9127.2
+fishing techniques at specific indicator
+
+4168
+02:32:06,478 --> 02:32:09,438
+level
+
+4169
+02:32:07,200 --> 02:32:10,560
+maybe another analyst would want to
+
+4170
+02:32:09,439 --> 02:32:12,239
+classify it
+
+4171
+02:32:10,559 --> 02:32:14,559
+and and maybe the objectives might be
+
+4172
+02:32:12,239 --> 02:32:16,719
+different maybe on one for example
+
+4173
+02:32:14,559 --> 02:32:18,719
+it's more specific for tools but if you
+
+4174
+02:32:16,719 --> 02:32:20,639
+want to run out statistics
+
+4175
+02:32:18,719 --> 02:32:22,0
+9138.72 --> 9142
+at the end of i don't know quite early
+
+4176
+02:32:20,639 --> 02:32:23,840
+meetings and say okay
+
+4177
+02:32:22,0 --> 02:32:25,600
+9142 --> 9145.6
+how many spearfishing that you receive
+
+4178
+02:32:23,840 --> 02:32:27,200
+or many emails proofing
+
+4179
+02:32:25,600 --> 02:32:29,840
+for example if you can control better
+
+4180
+02:32:27,200 --> 02:32:30,720
+emails proofing uh the spf record and so
+
+4181
+02:32:29,840 --> 02:32:32,960
+on you can
+
+4182
+02:32:30,719 --> 02:32:34,719
+just look at the current uh technique
+
+4183
+02:32:32,959 --> 02:32:35,599
+that are used by by the attacker so you
+
+4184
+02:32:34,719 --> 02:32:38,239
+see that
+
+4185
+02:32:35,600 --> 02:32:40,79
+those kind of it's full of taxonomies
+
+4186
+02:32:38,239 --> 02:32:42,799
+that are can be used
+
+4187
+02:32:40,79 --> 02:32:44,559
+and obviously we usually recommend to
+
+4188
+02:32:42,799 --> 02:32:46,639
+not enable everything but just
+
+4189
+02:32:44,559 --> 02:32:47,680
+pick what you really want and some are
+
+4190
+02:32:46,639 --> 02:32:50,79
+very generic
+
+4191
+02:32:47,680 --> 02:32:51,40
+some are more advanced but that's maybe
+
+4192
+02:32:50,79 --> 02:32:54,559
+something that you
+
+4193
+02:32:51,40 --> 02:32:56,319
+we dig into more afterwards but
+
+4194
+02:32:54,559 --> 02:32:57,840
+just be careful of which kind of
+
+4195
+02:32:56,318 --> 02:32:58,799
+taxonomy you want to use because it will
+
+4196
+02:32:57,840 --> 02:33:01,280
+be the language
+
+4197
+02:32:58,799 --> 02:33:02,478
+that you use with the community and your
+
+4198
+02:33:01,280 --> 02:33:07,840
+partners
+
+4199
+02:33:02,478 --> 02:33:07,840
+for sharing this information
+
+4200
+02:33:09,200 --> 02:33:12,640
+maybe something interesting to look into
+
+4201
+02:33:10,879 --> 02:33:14,478
+the email and that's linked to
+
+4202
+02:33:12,639 --> 02:33:16,0
+9192.64 --> 9196
+classifications but there's this comment
+
+4203
+02:33:14,478 --> 02:33:17,840
+there please
+
+4204
+02:33:16,0 --> 02:33:19,520
+9196 --> 9199.52
+please be mindful that this is an
+
+4205
+02:33:17,840 --> 02:33:22,0
+9197.84 --> 9202
+ongoing investigation and we would like
+
+4206
+02:33:19,520 --> 02:33:23,920
+to avoid
+
+4207
+02:33:22,0 --> 02:33:25,439
+9202 --> 9205.439
+informing the attacker or the detection
+
+4208
+02:33:23,920 --> 02:33:28,478
+and can we ask you to
+
+4209
+02:33:25,439 --> 02:33:32,318
+to only use the content information
+
+4210
+02:33:28,478 --> 02:33:34,0
+9208.479 --> 9214
+to to protect your constituents so
+
+4211
+02:33:32,318 --> 02:33:35,519
+this is kind of that you are language
+
+4212
+02:33:34,0 --> 02:33:37,600
+9214 --> 9217.6
+describing to you what kind of
+
+4213
+02:33:35,520 --> 02:33:40,640
+classification it is
+
+4214
+02:33:37,600 --> 02:33:44,479
+um and so no
+
+4215
+02:33:40,639 --> 02:33:46,799
+which one should we use so um if we are
+
+4216
+02:33:44,478 --> 02:33:48,639
+first members if we are using the first
+
+4217
+02:33:46,799 --> 02:33:50,159
+community obviously the classification
+
+4218
+02:33:48,639 --> 02:33:52,398
+that we will use
+
+4219
+02:33:50,159 --> 02:33:53,600
+is not the nato one or the ministry of
+
+4220
+02:33:52,398 --> 02:33:57,920
+defense in whatever
+
+4221
+02:33:53,600 --> 02:34:01,840
+country it's really tlp so then again
+
+4222
+02:33:57,920 --> 02:34:05,920
+based on that we will look into
+
+4223
+02:34:01,840 --> 02:34:09,200
+different taxonomy that we have
+
+4224
+02:34:05,920 --> 02:34:12,719
+we can look for for tlp
+
+4225
+02:34:09,200 --> 02:34:15,280
+and i should not do that like that
+
+4226
+02:34:12,719 --> 02:34:17,39
+i go for the tlp library and then i have
+
+4227
+02:34:15,280 --> 02:34:21,120
+the
+
+4228
+02:34:17,40 --> 02:34:22,240
+specific taxonomy tlp and then you have
+
+4229
+02:34:21,120 --> 02:34:24,560
+the different one
+
+4230
+02:34:22,239 --> 02:34:27,280
+in this case they say you have to share
+
+4231
+02:34:24,559 --> 02:34:29,840
+it with your confusion only so
+
+4232
+02:34:27,280 --> 02:34:30,800
+tlp amber seems to be the most
+
+4233
+02:34:29,840 --> 02:34:33,280
+appropriate
+
+4234
+02:34:30,799 --> 02:34:34,879
+one we say that the lpm bill information
+
+4235
+02:34:33,280 --> 02:34:36,399
+is given to organization
+
+4236
+02:34:34,879 --> 02:34:38,0
+9274.88 --> 9278
+sharing limited within organization to
+
+4237
+02:34:36,398 --> 02:34:40,639
+basically act upon
+
+4238
+02:34:38,0 --> 02:34:41,439
+9278 --> 9281.439
+if we have the extended classifications
+
+4239
+02:34:40,639 --> 02:34:44,478
+from first
+
+4240
+02:34:41,439 --> 02:34:47,200
+it includes the constituent
+
+4241
+02:34:44,478 --> 02:34:48,559
+too so i will just use a tmp but i
+
+4242
+02:34:47,200 --> 02:34:50,159
+mentioned something else that is
+
+4243
+02:34:48,559 --> 02:34:52,959
+interesting
+
+4244
+02:34:50,159 --> 02:34:53,600
+in the email they mentioned that this is
+
+4245
+02:34:52,959 --> 02:34:57,199
+an ongoing
+
+4246
+02:34:53,600 --> 02:35:00,479
+association to avoid
+
+4247
+02:34:57,200 --> 02:35:02,479
+informing the attacker in this case
+
+4248
+02:35:00,478 --> 02:35:03,760
+or would you inform the attacker but if
+
+4249
+02:35:02,478 --> 02:35:06,79
+you do actions
+
+4250
+02:35:03,760 --> 02:35:08,79
+on specific indicators and attributes
+
+4251
+02:35:06,79 --> 02:35:10,239
+you might want to restrict that
+
+4252
+02:35:08,79 --> 02:35:13,200
+so there is a another classification i
+
+4253
+02:35:10,239 --> 02:35:16,398
+don't know if this one is enabled
+
+4254
+02:35:13,200 --> 02:35:19,840
+it's called pap which is exactly that
+
+4255
+02:35:16,398 --> 02:35:22,559
+it's similar to tlp but describing
+
+4256
+02:35:19,840 --> 02:35:24,159
+what you can do with this information if
+
+4257
+02:35:22,559 --> 02:35:26,799
+we don't want to
+
+4258
+02:35:24,159 --> 02:35:27,439
+at least notify the attacker that we are
+
+4259
+02:35:26,799 --> 02:35:29,679
+doing some
+
+4260
+02:35:27,439 --> 02:35:31,40
+further investigations maybe we want to
+
+4261
+02:35:29,680 --> 02:35:34,0
+9329.68 --> 9334
+restrict that
+
+4262
+02:35:31,40 --> 02:35:35,840
+and the prp is really telling you what
+
+4263
+02:35:34,0 --> 02:35:37,200
+9334 --> 9337.2
+are the permissive action that you can
+
+4264
+02:35:35,840 --> 02:35:40,239
+do
+
+4265
+02:35:37,200 --> 02:35:42,479
+in our case for example
+
+4266
+02:35:40,239 --> 02:35:43,520
+non-detectable actions only and that's
+
+4267
+02:35:42,478 --> 02:35:46,398
+really what he wants
+
+4268
+02:35:43,520 --> 02:35:48,239
+because the supporters say okay we have
+
+4269
+02:35:46,398 --> 02:35:49,519
+an ongoing investigation so you don't
+
+4270
+02:35:48,239 --> 02:35:51,600
+want to be here
+
+4271
+02:35:49,520 --> 02:35:53,120
+um other parties are informed so in this
+
+4272
+02:35:51,600 --> 02:35:56,800
+case i will use
+
+4273
+02:35:53,120 --> 02:35:58,800
+red and again this is used at even level
+
+4274
+02:35:56,799 --> 02:36:00,478
+and that's something quite important
+
+4275
+02:35:58,799 --> 02:36:02,719
+because myth will take care of that
+
+4276
+02:36:00,478 --> 02:36:04,639
+um you don't need to set pp rate on
+
+4277
+02:36:02,719 --> 02:36:07,920
+every single attribute
+
+4278
+02:36:04,639 --> 02:36:09,279
+behind it's really at even level so it's
+
+4279
+02:36:07,920 --> 02:36:12,239
+automatically
+
+4280
+02:36:09,280 --> 02:36:14,0
+9369.28 --> 9374
+irritating on all attributes we don't
+
+4281
+02:36:12,239 --> 02:36:16,0
+9372.24 --> 9376
+show it on the interface
+
+4282
+02:36:14,0 --> 02:36:18,239
+9374 --> 9378.24
+because it will be two clamps to you
+
+4283
+02:36:16,0 --> 02:36:21,600
+9376 --> 9381.6
+know overload it with information
+
+4284
+02:36:18,239 --> 02:36:23,280
+but we do it in a way that's on the api
+
+4285
+02:36:21,600 --> 02:36:26,0
+9381.6 --> 9386
+level if you do section of search for
+
+4286
+02:36:23,280 --> 02:36:28,319
+example on even level or attribute level
+
+4287
+02:36:26,0 --> 02:36:30,318
+9386 --> 9390.319
+pip red will be included there if you
+
+4288
+02:36:28,318 --> 02:36:32,318
+have an attribute
+
+4289
+02:36:30,318 --> 02:36:34,799
+containing some information
+
+4290
+02:36:32,318 --> 02:36:38,559
+automatically tags like papers will be
+
+4291
+02:36:34,799 --> 02:36:40,0
+9394.8 --> 9400
+then included into the information so
+
+4292
+02:36:38,559 --> 02:36:41,840
+that's something to keep in mind when we
+
+4293
+02:36:40,0 --> 02:36:43,359
+9400 --> 9403.359
+have information from third party
+
+4294
+02:36:41,840 --> 02:36:45,439
+is to to wonder okay what is a
+
+4295
+02:36:43,359 --> 02:36:46,559
+classification scheme so sometimes they
+
+4296
+02:36:45,439 --> 02:36:48,398
+don't say
+
+4297
+02:36:46,559 --> 02:36:50,478
+a specific classification to use that
+
+4298
+02:36:48,398 --> 02:36:53,439
+you just use natural language or
+
+4299
+02:36:50,478 --> 02:36:56,159
+just a normal sentence to describe all
+
+4300
+02:36:53,439 --> 02:36:57,760
+the information should be shared
+
+4301
+02:36:56,159 --> 02:36:59,200
+so the interesting thing here is that
+
+4302
+02:36:57,760 --> 02:37:00,800
+what we've seen now is we've
+
+4303
+02:36:59,200 --> 02:37:02,399
+contextualized information in many
+
+4304
+02:37:00,799 --> 02:37:05,519
+different aspects and this is just
+
+4305
+02:37:02,398 --> 02:37:08,159
+scraping the uh
+
+4306
+02:37:05,520 --> 02:37:09,760
+the top layer basically we could go much
+
+4307
+02:37:08,159 --> 02:37:11,680
+much further with contextualization
+
+4308
+02:37:09,760 --> 02:37:13,359
+imagine for example describing
+
+4309
+02:37:11,680 --> 02:37:15,120
+how this information is relevant to
+
+4310
+02:37:13,359 --> 02:37:16,239
+whether it's used what sort of
+
+4311
+02:37:15,120 --> 02:37:17,920
+mechanisms they should
+
+4312
+02:37:16,239 --> 02:37:19,760
+have in place to be able to block this
+
+4313
+02:37:17,920 --> 02:37:20,879
+information how can you make this useful
+
+4314
+02:37:19,760 --> 02:37:22,159
+think of different maturity
+
+4315
+02:37:20,879 --> 02:37:23,679
+organizations as well when you're
+
+4316
+02:37:22,159 --> 02:37:25,280
+sharing information
+
+4317
+02:37:23,680 --> 02:37:26,639
+you could also describe information
+
+4318
+02:37:25,280 --> 02:37:27,840
+about who's behind it what the
+
+4319
+02:37:26,639 --> 02:37:29,920
+motivations are
+
+4320
+02:37:27,840 --> 02:37:31,760
+so we did not describe the threat actor
+
+4321
+02:37:29,920 --> 02:37:33,359
+because we we haven't done any analysis
+
+4322
+02:37:31,760 --> 02:37:34,318
+yet this is the initial information we
+
+4323
+02:37:33,359 --> 02:37:36,640
+got from
+
+4324
+02:37:34,318 --> 02:37:38,959
+a cser that just reported an incident to
+
+4325
+02:37:36,639 --> 02:37:41,39
+us but we could go further and we
+
+4326
+02:37:38,959 --> 02:37:42,799
+if we did our analysis we would find
+
+4327
+02:37:41,40 --> 02:37:44,960
+who's behind this we could go for it
+
+4328
+02:37:42,799 --> 02:37:47,119
+for uh for information with threat actor
+
+4329
+02:37:44,959 --> 02:37:49,279
+we could look at target sectors
+
+4330
+02:37:47,120 --> 02:37:51,600
+we could look at a lot of different
+
+4331
+02:37:49,280 --> 02:37:52,960
+information in regards to
+
+4332
+02:37:51,600 --> 02:37:55,439
+to further contextualizing the
+
+4333
+02:37:52,959 --> 02:37:55,438
+information
+
+4334
+02:37:58,239 --> 02:38:01,439
+so in this case we could also for
+
+4335
+02:37:59,600 --> 02:38:02,479
+example say that's in the truth where
+
+4336
+02:38:01,439 --> 02:38:03,680
+because we we know that this is
+
+4337
+02:38:02,478 --> 02:38:05,119
+something that was targeting an
+
+4338
+02:38:03,680 --> 02:38:07,760
+organization luxembourg
+
+4339
+02:38:05,120 --> 02:38:08,720
+we know it was there is also a sector uh
+
+4340
+02:38:07,760 --> 02:38:11,359
+taxonomy
+
+4341
+02:38:08,719 --> 02:38:12,639
+that you can use so that's not a galaxy
+
+4342
+02:38:11,359 --> 02:38:14,720
+but the taxonomy
+
+4343
+02:38:12,639 --> 02:38:16,398
+so we can also add uh for example
+
+4344
+02:38:14,719 --> 02:38:17,438
+information about the financial sector
+
+4345
+02:38:16,398 --> 02:38:20,79
+we know the ceo
+
+4346
+02:38:17,439 --> 02:38:21,600
+is a ceo financial sector organization
+
+4347
+02:38:20,79 --> 02:38:23,760
+so we could also say that it's
+
+4348
+02:38:21,600 --> 02:38:25,120
+it probably has to do with that as well
+
+4349
+02:38:23,760 --> 02:38:29,840
+maybe it's not enabled
+
+4350
+02:38:25,120 --> 02:38:29,840
+sorry about that yeah this is
+
+4351
+02:38:31,200 --> 02:38:35,200
+exactly there if you just search for
+
+4352
+02:38:33,840 --> 02:38:37,680
+sector it should be there
+
+4353
+02:38:35,200 --> 02:38:38,319
+yeah but i'm i'm yeah there's something
+
+4354
+02:38:37,680 --> 02:38:41,600
+that you can do
+
+4355
+02:38:38,318 --> 02:38:46,79
+talk about about later but it's uh
+
+4356
+02:38:41,600 --> 02:38:48,159
+just a sector so we have different one
+
+4357
+02:38:46,79 --> 02:38:49,680
+you did find that so if you there was
+
+4358
+02:38:48,159 --> 02:38:51,840
+one for finance you can just pick that
+
+4359
+02:38:49,680 --> 02:38:51,840
+yeah
+
+4360
+02:38:52,639 --> 02:38:57,519
+something else you can you can do and
+
+4361
+02:38:54,879 --> 02:38:59,39
+this one is important too it's it's
+
+4362
+02:38:57,520 --> 02:39:01,280
+going a bit further than the email so
+
+4363
+02:38:59,40 --> 02:39:02,560
+for example as a source we receive
+
+4364
+02:39:01,280 --> 02:39:04,79
+emails from various people
+
+4365
+02:39:02,559 --> 02:39:05,359
+i mean if i receive an email from i
+
+4366
+02:39:04,79 --> 02:39:05,920
+don't know from an analyst from i don't
+
+4367
+02:39:05,359 --> 02:39:08,720
+know
+
+4368
+02:39:05,920 --> 02:39:10,478
+he set mcafee and found that i'm working
+
+4369
+02:39:08,719 --> 02:39:12,719
+with them for years
+
+4370
+02:39:10,478 --> 02:39:13,679
+my confidence on this information is
+
+4371
+02:39:12,719 --> 02:39:16,79
+quite high
+
+4372
+02:39:13,680 --> 02:39:17,600
+on the other hand if i receive an email
+
+4373
+02:39:16,79 --> 02:39:19,39
+from someone unknown
+
+4374
+02:39:17,600 --> 02:39:20,880
+maybe my confidence will be a bit
+
+4375
+02:39:19,40 --> 02:39:22,479
+different so
+
+4376
+02:39:20,879 --> 02:39:24,478
+in myths you have plenty of taxonomies
+
+4377
+02:39:22,478 --> 02:39:26,239
+to express confidence
+
+4378
+02:39:24,478 --> 02:39:28,799
+for example the one that is actively
+
+4379
+02:39:26,239 --> 02:39:32,0
+9566.24 --> 9572
+used for empowering the military
+
+4380
+02:39:28,799 --> 02:39:34,799
+network is scale or nato scale
+
+4381
+02:39:32,0 --> 02:39:35,920
+9572 --> 9575.92
+where you can basically define the
+
+4382
+02:39:34,799 --> 02:39:37,438
+credibility of the
+
+4383
+02:39:35,920 --> 02:39:39,600
+of the source in this case we can say
+
+4384
+02:39:37,439 --> 02:39:40,639
+that we are we know the source and is
+
+4385
+02:39:39,600 --> 02:39:43,40
+usually really
+
+4386
+02:39:40,639 --> 02:39:45,358
+reliable so that's the source itself and
+
+4387
+02:39:43,40 --> 02:39:46,80
+we can say for this specific information
+
+4388
+02:39:45,359 --> 02:39:49,280
+that is
+
+4389
+02:39:46,79 --> 02:39:51,39
+um probably true
+
+4390
+02:39:49,280 --> 02:39:53,439
+because they send us some evidence now
+
+4391
+02:39:51,40 --> 02:39:53,760
+if i have like three emails taking about
+
+4392
+02:39:53,439 --> 02:39:57,840
+this
+
+4393
+02:39:53,760 --> 02:39:59,760
+talking about the same case maybe my
+
+4394
+02:39:57,840 --> 02:40:01,120
+level of credibility will increase
+
+4395
+02:39:59,760 --> 02:40:03,359
+because we have multiple people that
+
+4396
+02:40:01,120 --> 02:40:04,640
+have seen exactly the same kind of thing
+
+4397
+02:40:03,359 --> 02:40:07,120
+so in this case i will have those kind
+
+4398
+02:40:04,639 --> 02:40:07,920
+of information there again it's it's a
+
+4399
+02:40:07,120 --> 02:40:10,0
+9607.12 --> 9610
+way to
+
+4400
+02:40:07,920 --> 02:40:12,639
+really contextualize information and the
+
+4401
+02:40:10,0 --> 02:40:15,760
+9610 --> 9615.76
+quality of the information
+
+4402
+02:40:12,639 --> 02:40:17,599
+and you have for example
+
+4403
+02:40:15,760 --> 02:40:19,760
+additional one like for example we have
+
+4404
+02:40:17,600 --> 02:40:22,720
+one called estimative language
+
+4405
+02:40:19,760 --> 02:40:23,520
+so this one is more coming from dna and
+
+4406
+02:40:22,719 --> 02:40:25,599
+the cias
+
+4407
+02:40:23,520 --> 02:40:27,439
+it's like the likelihood of probability
+
+4408
+02:40:25,600 --> 02:40:28,960
+that this happen
+
+4409
+02:40:27,439 --> 02:40:30,720
+so we can say that this one has been
+
+4410
+02:40:28,959 --> 02:40:31,599
+almost certain and then we can even
+
+4411
+02:40:30,719 --> 02:40:34,639
+qualify
+
+4412
+02:40:31,600 --> 02:40:36,880
+or own an analytic judgment on this
+
+4413
+02:40:34,639 --> 02:40:37,680
+and i can say that it was like quickly
+
+4414
+02:40:36,879 --> 02:40:39,920
+done and it's
+
+4415
+02:40:37,680 --> 02:40:40,880
+not perfect i will just say low for
+
+4416
+02:40:39,920 --> 02:40:42,318
+example
+
+4417
+02:40:40,879 --> 02:40:43,920
+so then you can have this kind of
+
+4418
+02:40:42,318 --> 02:40:46,318
+information and you can
+
+4419
+02:40:43,920 --> 02:40:48,159
+either use it as an even level again or
+
+4420
+02:40:46,318 --> 02:40:50,0
+9646.319 --> 9650
+a specific review so for example if one
+
+4421
+02:40:48,159 --> 02:40:52,239
+of the emails it was like
+
+4422
+02:40:50,0 --> 02:40:54,159
+9650 --> 9654.16
+not properly collected or it was skirts
+
+4423
+02:40:52,239 --> 02:40:55,840
+or someone modified leather and so on
+
+4424
+02:40:54,159 --> 02:40:58,959
+maybe you can reduce
+
+4425
+02:40:55,840 --> 02:41:00,0
+9655.84 --> 9660
+the summative language of the confidence
+
+4426
+02:40:58,959 --> 02:41:02,0
+9658.96 --> 9662
+level that you have
+
+4427
+02:41:00,0 --> 02:41:03,359
+9660 --> 9663.359
+in the analytic judgment of the specific
+
+4428
+02:41:02,0 --> 02:41:06,79
+9662 --> 9666.08
+evidence or element
+
+4429
+02:41:03,359 --> 02:41:06,960
+by tagging that at attribute level so
+
+4430
+02:41:06,79 --> 02:41:08,239
+again
+
+4431
+02:41:06,959 --> 02:41:10,0
+9666.96 --> 9670
+those kind of information that we are
+
+4432
+02:41:08,239 --> 02:41:10,639
+putting there are factors and so on are
+
+4433
+02:41:10,0 --> 02:41:12,799
+9670 --> 9672.8
+more like
+
+4434
+02:41:10,639 --> 02:41:15,199
+even level but if you have really
+
+4435
+02:41:12,799 --> 02:41:17,278
+specific things that need to be changed
+
+4436
+02:41:15,200 --> 02:41:19,439
+or that are specific to the attribute or
+
+4437
+02:41:17,279 --> 02:41:24,239
+object then you can
+
+4438
+02:41:19,439 --> 02:41:24,239
+change it in the at the absolute level
+
+4439
+02:41:26,79 --> 02:41:29,200
+just some other thing on the user
+
+4440
+02:41:27,520 --> 02:41:31,120
+interface that might be useful too that
+
+4441
+02:41:29,200 --> 02:41:33,520
+we skipped
+
+4442
+02:41:31,120 --> 02:41:35,840
+on the metadata of the event you have
+
+4443
+02:41:33,520 --> 02:41:37,359
+plenty of information there
+
+4444
+02:41:35,840 --> 02:41:39,359
+why that is interesting regarding
+
+4445
+02:41:37,359 --> 02:41:40,960
+organization only and distribution
+
+4446
+02:41:39,359 --> 02:41:42,399
+in this case we just distribute to the
+
+4447
+02:41:40,959 --> 02:41:44,239
+organization but
+
+4448
+02:41:42,398 --> 02:41:45,920
+if you have pretty large even at some
+
+4449
+02:41:44,239 --> 02:41:47,760
+point in time and you want to distribute
+
+4450
+02:41:45,920 --> 02:41:49,359
+you have this kind of overview there
+
+4451
+02:41:47,760 --> 02:41:51,40
+which is helping you to
+
+4452
+02:41:49,359 --> 02:41:53,359
+see at which level you share this
+
+4453
+02:41:51,40 --> 02:41:55,200
+information in this case it's super easy
+
+4454
+02:41:53,359 --> 02:41:56,960
+we just distribute it to the training
+
+4455
+02:41:55,200 --> 02:41:58,960
+organization that's fine
+
+4456
+02:41:56,959 --> 02:42:00,879
+but if you have a pretty large instance
+
+4457
+02:41:58,959 --> 02:42:02,959
+with a lot of organization and so on
+
+4458
+02:42:00,879 --> 02:42:04,719
+it will display you a full graph of
+
+4459
+02:42:02,959 --> 02:42:07,759
+where the information will flow
+
+4460
+02:42:04,719 --> 02:42:07,760
+and will be distributed
+
+4461
+02:42:08,478 --> 02:42:12,239
+okay now going back to our event uh
+
+4462
+02:42:11,439 --> 02:42:13,840
+basically
+
+4463
+02:42:12,239 --> 02:42:15,520
+the reason why we went so deeply into
+
+4464
+02:42:13,840 --> 02:42:16,318
+the contextualization part is looking at
+
+4465
+02:42:15,520 --> 02:42:20,0
+9735.52 --> 9740
+this event
+
+4466
+02:42:16,318 --> 02:42:21,680
+we can already uh use this right away
+
+4467
+02:42:20,0 --> 02:42:22,639
+9740 --> 9742.64
+when feeding our tools when doing our
+
+4468
+02:42:21,680 --> 02:42:24,159
+searches
+
+4469
+02:42:22,639 --> 02:42:25,760
+to basically search for anything
+
+4470
+02:42:24,159 --> 02:42:26,478
+targeting the financial sector for
+
+4471
+02:42:25,760 --> 02:42:29,439
+example
+
+4472
+02:42:26,478 --> 02:42:30,159
+we can search for anything related to
+
+4473
+02:42:29,439 --> 02:42:33,359
+phishing
+
+4474
+02:42:30,159 --> 02:42:35,119
+and find the data contained in this
+
+4475
+02:42:33,359 --> 02:42:37,600
+particular event so this already helps
+
+4476
+02:42:35,120 --> 02:42:41,40
+us with our filtering mechanisms
+
+4477
+02:42:37,600 --> 02:42:42,960
+as for pap and tlp those
+
+4478
+02:42:41,40 --> 02:42:45,120
+tags we can use when we make decisions
+
+4479
+02:42:42,959 --> 02:42:47,438
+on which tools we feed
+
+4480
+02:42:45,120 --> 02:42:49,279
+the data to or which partners we share
+
+4481
+02:42:47,439 --> 02:42:49,840
+the information within the case of tlp
+
+4482
+02:42:49,279 --> 02:42:51,200
+so
+
+4483
+02:42:49,840 --> 02:42:52,719
+we're going to see that more tomorrow
+
+4484
+02:42:51,200 --> 02:42:54,319
+when we're creating synchronization
+
+4485
+02:42:52,719 --> 02:42:57,278
+links with other instances
+
+4486
+02:42:54,318 --> 02:42:57,920
+we can for example set restrictions on
+
+4487
+02:42:57,279 --> 02:43:00,79
+tlp
+
+4488
+02:42:57,920 --> 02:43:01,600
+when we're pushing data to another node
+
+4489
+02:43:00,79 --> 02:43:04,159
+and we can say okay
+
+4490
+02:43:01,600 --> 02:43:06,0
+9781.6 --> 9786
+no matter what distribution setting
+
+4491
+02:43:04,159 --> 02:43:07,520
+don't send anything tlp amber in this
+
+4492
+02:43:06,0 --> 02:43:09,439
+9786 --> 9789.439
+direction for example
+
+4493
+02:43:07,520 --> 02:43:11,279
+yeah as an example as an example there's
+
+4494
+02:43:09,439 --> 02:43:12,398
+a very good open source tool um called
+
+4495
+02:43:11,279 --> 02:43:15,520
+the hive
+
+4496
+02:43:12,398 --> 02:43:17,119
+for serending and they use pap to
+
+4497
+02:43:15,520 --> 02:43:19,120
+know which kind of actions they can do
+
+4498
+02:43:17,120 --> 02:43:22,560
+on the data so if you synchronize them
+
+4499
+02:43:19,120 --> 02:43:25,680
+with the hive instance you can
+
+4500
+02:43:22,559 --> 02:43:28,318
+really be sure that what you set
+
+4501
+02:43:25,680 --> 02:43:29,120
+as pep for example red on the lisp
+
+4502
+02:43:28,318 --> 02:43:30,959
+instance
+
+4503
+02:43:29,120 --> 02:43:33,120
+will not generate issues when you are
+
+4504
+02:43:30,959 --> 02:43:35,438
+starting to expansion within
+
+4505
+02:43:33,120 --> 02:43:37,359
+cortex on the ice to be sure that the
+
+4506
+02:43:35,439 --> 02:43:40,559
+information is not basically flowing
+
+4507
+02:43:37,359 --> 02:43:42,880
+somewhere else so at this point
+
+4508
+02:43:40,559 --> 02:43:43,840
+something that we didn't do so far is we
+
+4509
+02:43:42,879 --> 02:43:45,839
+did not include the
+
+4510
+02:43:43,840 --> 02:43:47,680
+on the initial email so what we're going
+
+4511
+02:43:45,840 --> 02:43:48,960
+to do now is we're going to use another
+
+4512
+02:43:47,680 --> 02:43:51,200
+functionality of this that we haven't
+
+4513
+02:43:48,959 --> 02:43:54,79
+talked much about called the report
+
+4514
+02:43:51,200 --> 02:43:55,760
+the event report we can also include
+
+4515
+02:43:54,79 --> 02:43:58,639
+clear text
+
+4516
+02:43:55,760 --> 02:44:00,398
+information such as a report description
+
+4517
+02:43:58,639 --> 02:44:01,599
+and so on together with the event
+
+4518
+02:44:00,398 --> 02:44:03,439
+so what we're going to do now is
+
+4519
+02:44:01,600 --> 02:44:05,200
+something very simple we're not going to
+
+4520
+02:44:03,439 --> 02:44:06,720
+write our own report we have a report
+
+4521
+02:44:05,200 --> 02:44:07,439
+already available from the original
+
+4522
+02:44:06,719 --> 02:44:09,119
+source
+
+4523
+02:44:07,439 --> 02:44:11,439
+so we're just going to paste that entire
+
+4524
+02:44:09,120 --> 02:44:11,439
+email
+
+4525
+02:44:14,398 --> 02:44:19,840
+okay just submit for now
+
+4526
+02:44:21,579 --> 02:44:24,770
+[Music]
+
+4527
+02:44:26,239 --> 02:44:29,920
+so now if you look at our email
+
+4528
+02:44:30,318 --> 02:44:34,0
+9870.319 --> 9874
+report we just have a simple report
+
+4529
+02:44:31,920 --> 02:44:35,359
+during gear text we're going to see an
+
+4530
+02:44:34,0 --> 02:44:36,879
+9874 --> 9876.88
+example what you can do with this so
+
+4531
+02:44:35,359 --> 02:44:39,359
+this is all in markdown
+
+4532
+02:44:36,879 --> 02:44:41,438
+so you could go into edit mode and
+
+4533
+02:44:39,359 --> 02:44:41,920
+pretty it up add additional information
+
+4534
+02:44:41,439 --> 02:44:43,600
+there
+
+4535
+02:44:41,920 --> 02:44:45,40
+we're not going to do that now because
+
+4536
+02:44:43,600 --> 02:44:46,0
+9883.6 --> 9886
+we're going to just look at an example
+
+4537
+02:44:45,40 --> 02:44:47,920
+that already has that
+
+4538
+02:44:46,0 --> 02:44:49,520
+9886 --> 9889.52
+but before we do that let's get back to
+
+4539
+02:44:47,920 --> 02:44:51,279
+our event and let's assume that we're
+
+4540
+02:44:49,520 --> 02:44:51,680
+done with it with this entire process we
+
+4541
+02:44:51,279 --> 02:44:53,520
+have our
+
+4542
+02:44:51,680 --> 02:44:54,800
+report we have our event we have
+
+4543
+02:44:53,520 --> 02:44:56,560
+contextualized all
+
+4544
+02:44:54,799 --> 02:44:57,920
+our data and let's publish it now to the
+
+4545
+02:44:56,559 --> 02:44:59,840
+community
+
+4546
+02:44:57,920 --> 02:45:01,520
+so when it comes to publishing we have
+
+4547
+02:44:59,840 --> 02:45:05,120
+different uh
+
+4548
+02:45:01,520 --> 02:45:06,720
+uh ways of achieving that ms by default
+
+4549
+02:45:05,120 --> 02:45:08,640
+when we create an event like this at
+
+4550
+02:45:06,719 --> 02:45:10,159
+this stage we have all the data
+
+4551
+02:45:08,639 --> 02:45:11,439
+contained that we want to share out and
+
+4552
+02:45:10,159 --> 02:45:13,520
+that we want to use
+
+4553
+02:45:11,439 --> 02:45:14,639
+however misconsiders this to be
+
+4554
+02:45:13,520 --> 02:45:17,279
+non-final
+
+4555
+02:45:14,639 --> 02:45:19,358
+it is not to be used by automation tools
+
+4556
+02:45:17,279 --> 02:45:20,960
+connected to this
+
+4557
+02:45:19,359 --> 02:45:22,479
+it is not going to be synchronized out
+
+4558
+02:45:20,959 --> 02:45:25,759
+to other instances
+
+4559
+02:45:22,478 --> 02:45:28,959
+and uh and so on
+
+4560
+02:45:25,760 --> 02:45:31,279
+what we can do now is first of all
+
+4561
+02:45:28,959 --> 02:45:34,318
+we need to decide how we shared it out
+
+4562
+02:45:31,279 --> 02:45:35,840
+it is the organization only for now
+
+4563
+02:45:34,318 --> 02:45:38,639
+so even if we were to publish it it
+
+4564
+02:45:35,840 --> 02:45:40,719
+would still only be pushed to our own
+
+4565
+02:45:38,639 --> 02:45:42,239
+tools that connect to our miss but it
+
+4566
+02:45:40,719 --> 02:45:44,159
+would not be made visible to other
+
+4567
+02:45:42,239 --> 02:45:45,119
+organizations but we want to change this
+
+4568
+02:45:44,159 --> 02:45:48,0
+9944.16 --> 9948
+in this case
+
+4569
+02:45:45,120 --> 02:45:49,520
+however let's assume that uh that when
+
+4570
+02:45:48,0 --> 02:45:52,398
+9948 --> 9952.399
+we're an organization
+
+4571
+02:45:49,520 --> 02:45:53,840
+that does not wish to reveal who we uh
+
+4572
+02:45:52,398 --> 02:45:56,159
+that we were involved in
+
+4573
+02:45:53,840 --> 02:45:58,239
+in this entire incident we just want to
+
+4574
+02:45:56,159 --> 02:46:00,318
+entrust the third party with doing it
+
+4575
+02:45:58,239 --> 02:46:01,600
+so as you see there where alex is
+
+4576
+02:46:00,318 --> 02:46:02,318
+hovering we basically have several
+
+4577
+02:46:01,600 --> 02:46:03,840
+options here
+
+4578
+02:46:02,318 --> 02:46:06,559
+we can either publish the event which
+
+4579
+02:46:03,840 --> 02:46:08,79
+means we initiate the entire exchange
+
+4580
+02:46:06,559 --> 02:46:10,559
+with other instances if the
+
+4581
+02:46:08,79 --> 02:46:12,159
+distribution allows it it will it will
+
+4582
+02:46:10,559 --> 02:46:12,719
+alert everyone that we have published
+
+4583
+02:46:12,159 --> 02:46:14,799
+this
+
+4584
+02:46:12,719 --> 02:46:16,478
+or alternatively we can we can delegate
+
+4585
+02:46:14,799 --> 02:46:18,159
+the publishing to third party and stay
+
+4586
+02:46:16,478 --> 02:46:20,879
+anonymous ourselves so let's do that
+
+4587
+02:46:18,159 --> 02:46:22,159
+option for now
+
+4588
+02:46:20,879 --> 02:46:24,0
+9980.88 --> 9984
+so what we're doing now is we're
+
+4589
+02:46:22,159 --> 02:46:26,478
+entrusting a third party to take over
+
+4590
+02:46:24,0 --> 02:46:28,559
+9984 --> 9988.56
+this event for us so let's say that we
+
+4591
+02:46:26,478 --> 02:46:30,478
+would entrust for example circle to take
+
+4592
+02:46:28,559 --> 02:46:32,398
+over this event
+
+4593
+02:46:30,478 --> 02:46:34,79
+and we tell circle that we want to share
+
+4594
+02:46:32,398 --> 02:46:36,840
+this event to be shared with
+
+4595
+02:46:34,79 --> 02:46:39,840
+uh the entire community so we've
+
+4596
+02:46:36,840 --> 02:46:39,840
+collected
+
+4597
+02:46:45,600 --> 02:46:49,359
+yeah you can see this community only for
+
+4598
+02:46:47,359 --> 02:46:50,840
+example or a sharing group whatever you
+
+4599
+02:46:49,359 --> 02:46:53,520
+prefer
+
+4600
+02:46:50,840 --> 02:46:55,279
+okay so this is again a suggestion to
+
+4601
+02:46:53,520 --> 02:46:56,960
+the other organization saying okay we
+
+4602
+02:46:55,279 --> 02:46:57,760
+want you to share this out and we want
+
+4603
+02:46:56,959 --> 02:47:00,959
+you to share this
+
+4604
+02:46:57,760 --> 02:47:02,0
+10017.76 --> 10022
+to this community once we click yes
+
+4605
+02:47:00,959 --> 02:47:04,0
+10020.96 --> 10024
+even though the event was your
+
+4606
+02:47:02,0 --> 02:47:05,439
+10022 --> 10025.439
+organizational and only visible to us
+
+4607
+02:47:04,0 --> 02:47:07,680
+10024 --> 10027.68
+it now becomes visible to two
+
+4608
+02:47:05,439 --> 02:47:08,960
+organizations ourselves
+
+4609
+02:47:07,680 --> 02:47:10,720
+and the other organization that we
+
+4610
+02:47:08,959 --> 02:47:12,0
+10028.96 --> 10032
+entrust in this case circle so circle
+
+4611
+02:47:10,719 --> 02:47:14,318
+would get an email
+
+4612
+02:47:12,0 --> 02:47:16,79
+10032 --> 10036.08
+saying okay there's this delegation
+
+4613
+02:47:14,318 --> 02:47:17,119
+request someone wants you to take over
+
+4614
+02:47:16,79 --> 02:47:18,398
+their event
+
+4615
+02:47:17,120 --> 02:47:19,920
+are you willing to take it over and
+
+4616
+02:47:18,398 --> 02:47:21,199
+publish it under your name this will
+
+4617
+02:47:19,920 --> 02:47:23,120
+look something like this with slightly
+
+4618
+02:47:21,200 --> 02:47:25,920
+different text we're cheating here now
+
+4619
+02:47:23,120 --> 02:47:27,600
+since we're doing a training we're site
+
+4620
+02:47:25,920 --> 02:47:28,478
+administrators and we see both sides of
+
+4621
+02:47:27,600 --> 02:47:30,239
+the story
+
+4622
+02:47:28,478 --> 02:47:31,599
+so we can either accept or discard this
+
+4623
+02:47:30,239 --> 02:47:33,920
+request keep in mind
+
+4624
+02:47:31,600 --> 02:47:35,200
+if you accept such a request the event
+
+4625
+02:47:33,920 --> 02:47:38,559
+becomes your event
+
+4626
+02:47:35,200 --> 02:47:40,960
+a copy of it is created under your name
+
+4627
+02:47:38,559 --> 02:47:42,639
+and basically you are taking
+
+4628
+02:47:40,959 --> 02:47:44,239
+responsibility for the event from down
+
+4629
+02:47:42,639 --> 02:47:46,719
+so also make sure that you're not
+
+4630
+02:47:44,239 --> 02:47:49,39
+pushing junk under your name so in this
+
+4631
+02:47:46,719 --> 02:47:50,799
+case let's just discard it
+
+4632
+02:47:49,40 --> 02:47:53,920
+but we could have accepted it and then
+
+4633
+02:47:50,799 --> 02:47:57,358
+it would have become our event
+
+4634
+02:47:53,920 --> 02:47:57,359
+okay let's go back to the event
+
+4635
+02:48:00,79 --> 02:48:04,719
+okay so now the other alternative is if
+
+4636
+02:48:03,200 --> 02:48:06,240
+you want to publish it under our name
+
+4637
+02:48:04,719 --> 02:48:07,840
+what you would need to do is you would
+
+4638
+02:48:06,239 --> 02:48:08,398
+need to raise the distribution level
+
+4639
+02:48:07,840 --> 02:48:10,639
+first
+
+4640
+02:48:08,398 --> 02:48:11,599
+if you wanted to uh to involve any other
+
+4641
+02:48:10,639 --> 02:48:13,39
+parties
+
+4642
+02:48:11,600 --> 02:48:15,680
+so we need to edit the event in that
+
+4643
+02:48:13,40 --> 02:48:18,240
+case and raise the distribution level to
+
+4644
+02:48:15,680 --> 02:48:19,439
+say this community or connected
+
+4645
+02:48:18,239 --> 02:48:20,318
+communities let's go with connected
+
+4646
+02:48:19,439 --> 02:48:22,639
+communities
+
+4647
+02:48:20,318 --> 02:48:24,639
+connected communities means anyone that
+
+4648
+02:48:22,639 --> 02:48:26,478
+has access to my miss pinsons
+
+4649
+02:48:24,639 --> 02:48:28,478
+and all the directly interconnected
+
+4650
+02:48:26,478 --> 02:48:29,199
+instances including all their members as
+
+4651
+02:48:28,478 --> 02:48:32,478
+well
+
+4652
+02:48:29,200 --> 02:48:33,920
+so in the case for example
+
+4653
+02:48:32,478 --> 02:48:36,239
+of us publishing something like this in
+
+4654
+02:48:33,920 --> 02:48:37,439
+the first instance we as circle have our
+
+4655
+02:48:36,239 --> 02:48:39,439
+instance connected to it
+
+4656
+02:48:37,439 --> 02:48:40,960
+so all the members of the circle
+
+4657
+02:48:39,439 --> 02:48:42,800
+instance will automatically also be
+
+4658
+02:48:40,959 --> 02:48:46,79
+included in the exchange here we see a
+
+4659
+02:48:42,799 --> 02:48:47,759
+graph of that so we see the event would
+
+4660
+02:48:46,79 --> 02:48:49,279
+be also visible to all the directly
+
+4661
+02:48:47,760 --> 02:48:51,120
+connected instances
+
+4662
+02:48:49,279 --> 02:48:53,40
+which we only have one of which is a
+
+4663
+02:48:51,120 --> 02:48:56,640
+loopback
+
+4664
+02:48:53,40 --> 02:48:57,520
+connection to exchange so not that
+
+4665
+02:48:56,639 --> 02:48:59,119
+interesting
+
+4666
+02:48:57,520 --> 02:49:00,960
+and to everyone that has access to this
+
+4667
+02:48:59,120 --> 02:49:04,160
+current instance
+
+4668
+02:49:00,959 --> 02:49:04,639
+okay once we're done we can click
+
+4669
+02:49:04,159 --> 02:49:08,159
+publish
+
+4670
+02:49:04,639 --> 02:49:08,159
+and then the event gets synchronized
+
+4671
+02:49:08,639 --> 02:49:12,0
+10148.64 --> 10152
+so what happens at this stage is first
+
+4672
+02:49:10,639 --> 02:49:14,799
+of all the event will jump
+
+4673
+02:49:12,0 --> 02:49:16,559
+10152 --> 10156.56
+over to directly connected instances
+
+4674
+02:49:14,799 --> 02:49:18,239
+miss will send out a bunch of emails to
+
+4675
+02:49:16,559 --> 02:49:20,559
+everyone that subscribes to
+
+4676
+02:49:18,239 --> 02:49:22,959
+publish alerts that there is a new event
+
+4677
+02:49:20,559 --> 02:49:25,760
+with all the data contained within
+
+4678
+02:49:22,959 --> 02:49:27,759
+it will push the event down various
+
+4679
+02:49:25,760 --> 02:49:32,478
+local channels to other tools
+
+4680
+02:49:27,760 --> 02:49:34,0
+10167.76 --> 10174
+using xeromq kafka and so on and syslog
+
+4681
+02:49:32,478 --> 02:49:35,679
+so if you have any tools that are
+
+4682
+02:49:34,0 --> 02:49:37,600
+10174 --> 10177.6
+subscribed to these
+
+4683
+02:49:35,680 --> 02:49:38,800
+published feeds and they will ingest the
+
+4684
+02:49:37,600 --> 02:49:40,559
+data
+
+4685
+02:49:38,799 --> 02:49:42,478
+and it will also make it available to
+
+4686
+02:49:40,559 --> 02:49:44,0
+10180.56 --> 10184
+the api and to make it available to all
+
+4687
+02:49:42,478 --> 02:49:47,119
+the integration
+
+4688
+02:49:44,0 --> 02:49:49,359
+10184 --> 10189.359
+tools out there so if you have your
+
+4689
+02:49:47,120 --> 02:49:51,359
+your scene connected to miss it will now
+
+4690
+02:49:49,359 --> 02:49:54,559
+be able to fetch the data
+
+4691
+02:49:51,359 --> 02:49:55,200
+contained in this event so this is
+
+4692
+02:49:54,559 --> 02:49:57,600
+basically
+
+4693
+02:49:55,200 --> 02:49:58,319
+the publishing process however there is
+
+4694
+02:49:57,600 --> 02:50:00,79
+uh
+
+4695
+02:49:58,318 --> 02:50:01,840
+if at this point we noticed that okay
+
+4696
+02:50:00,79 --> 02:50:03,600
+we've now shared this event out
+
+4697
+02:50:01,840 --> 02:50:06,840
+but we've actually made a typo in the
+
+4698
+02:50:03,600 --> 02:50:10,0
+10203.6 --> 10210
+title we we wanted to include
+
+4699
+02:50:06,840 --> 02:50:13,760
+uh um i don't know
+
+4700
+02:50:10,0 --> 02:50:16,239
+10210 --> 10216.24
+a trailing period at the end of the
+
+4701
+02:50:13,760 --> 02:50:16,239
+sentence
+
+4702
+02:50:19,279 --> 02:50:23,279
+in the title and we edit the event what
+
+4703
+02:50:21,439 --> 02:50:24,639
+happens now is there is a modification
+
+4704
+02:50:23,279 --> 02:50:26,800
+to the event so even though it was
+
+4705
+02:50:24,639 --> 02:50:30,79
+published it becomes unpublished again
+
+4706
+02:50:26,799 --> 02:50:31,920
+and it needs to be to be republished now
+
+4707
+02:50:30,79 --> 02:50:33,760
+the reason why we do this is
+
+4708
+02:50:31,920 --> 02:50:37,680
+uh whenever there is a change we need to
+
+4709
+02:50:33,760 --> 02:50:39,920
+synchronize it out to
+
+4710
+02:50:37,680 --> 02:50:40,720
+and if you have a publishing process in
+
+4711
+02:50:39,920 --> 02:50:42,478
+place where
+
+4712
+02:50:40,719 --> 02:50:44,159
+so only certain users have access to
+
+4713
+02:50:42,478 --> 02:50:45,760
+publishing rights for example
+
+4714
+02:50:44,159 --> 02:50:47,359
+then anytime your organization is
+
+4715
+02:50:45,760 --> 02:50:49,120
+pushing out information
+
+4716
+02:50:47,359 --> 02:50:50,800
+it can go through the irregular vetting
+
+4717
+02:50:49,120 --> 02:50:52,319
+process so any change will unset the
+
+4718
+02:50:50,799 --> 02:50:54,318
+publishing of the event
+
+4719
+02:50:52,318 --> 02:50:55,840
+now in this case this is a very small
+
+4720
+02:50:54,318 --> 02:50:57,519
+change that we've made so we don't want
+
+4721
+02:50:55,840 --> 02:50:59,920
+to actually send out events to all their
+
+4722
+02:50:57,520 --> 02:51:03,40
+users we don't want to spam them with
+
+4723
+02:50:59,920 --> 02:51:03,920
+data that is pretty relevant for them so
+
+4724
+02:51:03,40 --> 02:51:05,520
+we can publish
+
+4725
+02:51:03,920 --> 02:51:09,279
+do the publishing again but this time
+
+4726
+02:51:05,520 --> 02:51:11,40
+using the publish no email option
+
+4727
+02:51:09,279 --> 02:51:12,640
+so it will also synchronize the data it
+
+4728
+02:51:11,40 --> 02:51:13,439
+will again make it available to all
+
+4729
+02:51:12,639 --> 02:51:16,318
+different
+
+4730
+02:51:13,439 --> 02:51:19,600
+means of ingesting the data but it will
+
+4731
+02:51:16,318 --> 02:51:22,159
+not spam our users with emails
+
+4732
+02:51:19,600 --> 02:51:23,120
+okay so that's basically it for the
+
+4733
+02:51:22,159 --> 02:51:24,398
+publishing
+
+4734
+02:51:23,120 --> 02:51:26,399
+and perhaps one thing that is
+
+4735
+02:51:24,398 --> 02:51:27,680
+interesting and that we didn't talk much
+
+4736
+02:51:26,398 --> 02:51:29,119
+about is
+
+4737
+02:51:27,680 --> 02:51:30,479
+we have now raised the distribution
+
+4738
+02:51:29,120 --> 02:51:31,520
+level of this event to connected
+
+4739
+02:51:30,478 --> 02:51:34,79
+communities
+
+4740
+02:51:31,520 --> 02:51:35,439
+so the event is synchronized out but we
+
+4741
+02:51:34,79 --> 02:51:36,398
+actually had an attribute if you look
+
+4742
+02:51:35,439 --> 02:51:37,760
+further down
+
+4743
+02:51:36,398 --> 02:51:40,398
+that's had a different distribution
+
+4744
+02:51:37,760 --> 02:51:41,840
+level uh so that one is actually going
+
+4745
+02:51:40,398 --> 02:51:43,39
+to be removed from the synchronized
+
+4746
+02:51:41,840 --> 02:51:45,520
+button
+
+4747
+02:51:43,40 --> 02:51:49,279
+uh so we had one that the the
+
+4748
+02:51:45,520 --> 02:51:49,279
+impersonated person's email address
+
+4749
+02:51:49,359 --> 02:51:52,0
+10309.359 --> 10312
+that was set to organization only so
+
+4750
+02:51:51,40 --> 02:51:53,120
+whenever we're talking about
+
+4751
+02:51:52,0 --> 02:51:54,639
+10312 --> 10314.64
+synchronization
+
+4752
+02:51:53,120 --> 02:51:56,479
+that thing will in this case not
+
+4753
+02:51:54,639 --> 02:51:59,39
+synchronize out so that will be redacted
+
+4754
+02:51:56,478 --> 02:51:59,39
+from the event
+
+4755
+02:51:59,279 --> 02:52:03,680
+okay something else that we can do at
+
+4756
+02:52:02,239 --> 02:52:05,520
+this point once we have created our
+
+4757
+02:52:03,680 --> 02:52:06,960
+event is we can also extract it in
+
+4758
+02:52:05,520 --> 02:52:09,40
+different formats so if you click on
+
+4759
+02:52:06,959 --> 02:52:10,398
+download s on the left side
+
+4760
+02:52:09,40 --> 02:52:12,80
+you will see that we can basically
+
+4761
+02:52:10,398 --> 02:52:13,519
+convert this automatically to a bunch of
+
+4762
+02:52:12,79 --> 02:52:14,799
+different formats and extract it in
+
+4763
+02:52:13,520 --> 02:52:16,560
+those formats directly
+
+4764
+02:52:14,799 --> 02:52:18,639
+this is also what we would be accessing
+
+4765
+02:52:16,559 --> 02:52:20,959
+by the api if you were to search for
+
+4766
+02:52:18,639 --> 02:52:23,519
+this event we can also mark whatever
+
+4767
+02:52:20,959 --> 02:52:25,199
+response format we want just very
+
+4768
+02:52:23,520 --> 02:52:26,560
+briefly we won't go very deeply into
+
+4769
+02:52:25,200 --> 02:52:30,0
+10345.2 --> 10350
+this these formats
+
+4770
+02:52:26,559 --> 02:52:31,600
+are coming partially from our predefined
+
+4771
+02:52:30,0 --> 02:52:33,520
+10350 --> 10353.52
+hard-coded list of formats that we
+
+4772
+02:52:31,600 --> 02:52:35,600
+support in miss
+
+4773
+02:52:33,520 --> 02:52:36,800
+but some of these formats also come from
+
+4774
+02:52:35,600 --> 02:52:40,0
+10355.6 --> 10360
+the different exp
+
+4775
+02:52:36,799 --> 02:52:41,920
+export modules that we have so if you
+
+4776
+02:52:40,0 --> 02:52:43,439
+10360 --> 10363.439
+want you can either build your own
+
+4777
+02:52:41,920 --> 02:52:44,799
+native modules for exporting and
+
+4778
+02:52:43,439 --> 02:52:47,840
+converting data
+
+4779
+02:52:44,799 --> 02:52:50,159
+or you can build modules
+
+4780
+02:52:47,840 --> 02:52:51,279
+that are sitting in another tool called
+
+4781
+02:52:50,159 --> 02:52:53,39
+miss modules
+
+4782
+02:52:51,279 --> 02:52:54,560
+side by side with mist that will ingest
+
+4783
+02:52:53,40 --> 02:52:55,439
+the data and then convert it to other
+
+4784
+02:52:54,559 --> 02:52:58,159
+formats
+
+4785
+02:52:55,439 --> 02:53:00,0
+10375.439 --> 10380
+so here's a pdf report that was created
+
+4786
+02:52:58,159 --> 02:53:03,439
+directly out of the event
+
+4787
+02:53:00,0 --> 02:53:05,680
+10380 --> 10385.68
+uh and that you can just
+
+4788
+02:53:03,439 --> 02:53:07,40
+share out directly from the event
+
+4789
+02:53:05,680 --> 02:53:09,600
+something else that you can do
+
+4790
+02:53:07,40 --> 02:53:11,520
+is uh anything that we do in misp so all
+
+4791
+02:53:09,600 --> 02:53:13,760
+the process of adding attributes
+
+4792
+02:53:11,520 --> 02:53:14,720
+all the process of viewing data you can
+
+4793
+02:53:13,760 --> 02:53:16,478
+also do uh
+
+4794
+02:53:14,719 --> 02:53:18,318
+so do that in a machine partial way by
+
+4795
+02:53:16,478 --> 02:53:19,920
+just spending.json at the end of any of
+
+4796
+02:53:18,318 --> 02:53:21,278
+the url
+
+4797
+02:53:19,920 --> 02:53:23,120
+so in that case in this event we're
+
+4798
+02:53:21,279 --> 02:53:23,680
+going to get the json representation of
+
+4799
+02:53:23,120 --> 02:53:27,760
+the
+
+4800
+02:53:23,680 --> 02:53:27,760
+event okay
+
+4801
+02:53:28,79 --> 02:53:32,318
+so that's basically for creating an
+
+4802
+02:53:30,0 --> 02:53:32,318
+10410 --> 10412.319
+event
+
+4803
+02:53:33,359 --> 02:53:36,720
+just maybe one thing that is interesting
+
+4804
+02:53:35,40 --> 02:53:40,80
+we have a very good question from
+
+4805
+02:53:36,719 --> 02:53:43,119
+martin it's a
+
+4806
+02:53:40,79 --> 02:53:46,239
+quite complex one but maybe we can
+
+4807
+02:53:43,120 --> 02:53:49,520
+already partially answer it
+
+4808
+02:53:46,239 --> 02:53:50,959
+so when you create an event and in this
+
+4809
+02:53:49,520 --> 02:53:54,79
+case a creator or
+
+4810
+02:53:50,959 --> 02:53:55,199
+is the training people can contribute on
+
+4811
+02:53:54,79 --> 02:53:57,680
+that one
+
+4812
+02:53:55,200 --> 02:53:59,520
+but if you have an isaac and you want to
+
+4813
+02:53:57,680 --> 02:54:00,318
+distribute back the information and so
+
+4814
+02:53:59,520 --> 02:54:02,560
+on
+
+4815
+02:54:00,318 --> 02:54:04,559
+one of the options that you have is to
+
+4816
+02:54:02,559 --> 02:54:05,760
+try to create extended events for
+
+4817
+02:54:04,559 --> 02:54:08,879
+example out of it
+
+4818
+02:54:05,760 --> 02:54:10,398
+so you can um out of an event you can
+
+4819
+02:54:08,879 --> 02:54:13,358
+create a new one
+
+4820
+02:54:10,398 --> 02:54:14,478
+um which would be for example with
+
+4821
+02:54:13,359 --> 02:54:18,0
+10453.359 --> 10458
+additional information
+
+4822
+02:54:14,478 --> 02:54:18,959
+like validations uh additional things
+
+4823
+02:54:18,0 --> 02:54:21,520
+10458 --> 10461.52
+that you want you
+
+4824
+02:54:18,959 --> 02:54:22,799
+you want to add so you have this kind of
+
+4825
+02:54:21,520 --> 02:54:24,159
+extend even and you will create
+
+4826
+02:54:22,799 --> 02:54:27,358
+automatically a
+
+4827
+02:54:24,159 --> 02:54:33,920
+new event based on that
+
+4828
+02:54:27,359 --> 02:54:34,800
+um thing that is interesting there um
+
+4829
+02:54:33,920 --> 02:54:36,559
+the
+
+4830
+02:54:34,799 --> 02:54:38,398
+the thing is you can really create
+
+4831
+02:54:36,559 --> 02:54:40,398
+something completely new
+
+4832
+02:54:38,398 --> 02:54:42,239
+out of it and then see so for example
+
+4833
+02:54:40,398 --> 02:54:45,358
+for this case i can say that we
+
+4834
+02:54:42,239 --> 02:54:47,279
+uh we did a kind of session with
+
+4835
+02:54:45,359 --> 02:54:50,0
+10485.359 --> 10490
+additional information
+
+4836
+02:54:47,279 --> 02:54:52,960
+um there the distribution is your
+
+4837
+02:54:50,0 --> 02:54:52,959
+10490 --> 10492.96
+organization only
+
+4838
+02:54:53,120 --> 02:54:57,680
+and i would add for example a specific
+
+4839
+02:54:55,600 --> 02:55:02,159
+attribute
+
+4840
+02:54:57,680 --> 02:55:05,600
+which is for example targeting data
+
+4841
+02:55:02,159 --> 02:55:09,359
+and i can say target user uh the son
+
+4842
+02:55:05,600 --> 02:55:11,439
+of the prime minister
+
+4843
+02:55:09,359 --> 02:55:12,479
+so it may be information that you really
+
+4844
+02:55:11,439 --> 02:55:16,159
+don't want to share
+
+4845
+02:55:12,478 --> 02:55:18,159
+with others so this one is basically
+
+4846
+02:55:16,159 --> 02:55:19,200
+a normal event with additional
+
+4847
+02:55:18,159 --> 02:55:21,760
+information there
+
+4848
+02:55:19,200 --> 02:55:24,79
+and it's only shared within your
+
+4849
+02:55:21,760 --> 02:55:26,239
+organization
+
+4850
+02:55:24,79 --> 02:55:27,600
+nevertheless if you go to the original
+
+4851
+02:55:26,239 --> 02:55:29,119
+event
+
+4852
+02:55:27,600 --> 02:55:31,279
+you have this kind of extended view
+
+4853
+02:55:29,120 --> 02:55:35,279
+there and we can have
+
+4854
+02:55:31,279 --> 02:55:38,560
+what we call an extended view and not an
+
+4855
+02:55:35,279 --> 02:55:41,600
+atomic view and the two information
+
+4856
+02:55:38,559 --> 02:55:43,760
+so the is combined and you can see there
+
+4857
+02:55:41,600 --> 02:55:46,159
+that we have one with the information
+
+4858
+02:55:43,760 --> 02:55:49,760
+about the son of the prime minister
+
+4859
+02:55:46,159 --> 02:55:52,478
+which is the extended event there so
+
+4860
+02:55:49,760 --> 02:55:53,200
+just to answer the question of martin
+
+4861
+02:55:52,478 --> 02:55:56,559
+about
+
+4862
+02:55:53,200 --> 02:55:58,880
+the question about
+
+4863
+02:55:56,559 --> 02:56:00,239
+adding information on existing event is
+
+4864
+02:55:58,879 --> 02:56:03,278
+one way of doing it
+
+4865
+02:56:00,239 --> 02:56:05,840
+so using extended event is a way to
+
+4866
+02:56:03,279 --> 02:56:07,200
+qualify or extend even with additional
+
+4867
+02:56:05,840 --> 02:56:09,600
+information and so on
+
+4868
+02:56:07,200 --> 02:56:10,479
+um it's actively used for example for
+
+4869
+02:56:09,600 --> 02:56:12,559
+when you have
+
+4870
+02:56:10,478 --> 02:56:14,318
+two different view of the information
+
+4871
+02:56:12,559 --> 02:56:15,519
+because one is distributed and another
+
+4872
+02:56:14,318 --> 02:56:17,920
+one is like
+
+4873
+02:56:15,520 --> 02:56:19,120
+likely like the private information like
+
+4874
+02:56:17,920 --> 02:56:21,120
+the forensic evidence
+
+4875
+02:56:19,120 --> 02:56:22,800
+that you cannot share for example you
+
+4876
+02:56:21,120 --> 02:56:24,399
+can create this kind of thing
+
+4877
+02:56:22,799 --> 02:56:25,599
+it's one way of doing it it's not
+
+4878
+02:56:24,398 --> 02:56:26,959
+answering companies the question of
+
+4879
+02:56:25,600 --> 02:56:29,439
+martin but we can
+
+4880
+02:56:26,959 --> 02:56:31,358
+even go deeper later on that but it's
+
+4881
+02:56:29,439 --> 02:56:32,559
+it's one way of
+
+4882
+02:56:31,359 --> 02:56:34,559
+because tomorrow we talk about
+
+4883
+02:56:32,559 --> 02:56:36,0
+10592.56 --> 10596
+synchronization there are some specific
+
+4884
+02:56:34,559 --> 02:56:37,920
+options for isaac like
+
+4885
+02:56:36,0 --> 02:56:39,359
+10596 --> 10599.359
+and publishing events if we do
+
+4886
+02:56:37,920 --> 02:56:41,439
+synchronization and so on
+
+4887
+02:56:39,359 --> 02:56:43,200
+that can be used in some some cases for
+
+4888
+02:56:41,439 --> 02:56:45,520
+isaac's
+
+4889
+02:56:43,200 --> 02:56:47,760
+there are many options but that's one
+
+4890
+02:56:45,520 --> 02:56:50,319
+way of of partially solving
+
+4891
+02:56:47,760 --> 02:56:51,279
+this kind of issues of not owning the
+
+4892
+02:56:50,318 --> 02:56:55,600
+data
+
+4893
+02:56:51,279 --> 02:56:57,359
+is to extend the information
+
+4894
+02:56:55,600 --> 02:56:59,200
+so i know you have something you want to
+
+4895
+02:56:57,359 --> 02:57:02,640
+add on rashford
+
+4896
+02:56:59,200 --> 02:57:02,640
+no no that makes sense
+
+4897
+02:57:04,239 --> 02:57:08,639
+again for the collaboration on this one
+
+4898
+02:57:07,40 --> 02:57:11,279
+we can do various things so
+
+4899
+02:57:08,639 --> 02:57:13,760
+in the case of um you have a typo for
+
+4900
+02:57:11,279 --> 02:57:15,920
+example in the specifications and so on
+
+4901
+02:57:13,760 --> 02:57:17,439
+you can make proposal another thing with
+
+4902
+02:57:15,920 --> 02:57:19,920
+uh
+
+4903
+02:57:17,439 --> 02:57:21,120
+on the interface here you see that you
+
+4904
+02:57:19,920 --> 02:57:23,680
+can
+
+4905
+02:57:21,120 --> 02:57:24,880
+basically make either an edit or you see
+
+4906
+02:57:23,680 --> 02:57:28,398
+that you can make
+
+4907
+02:57:24,879 --> 02:57:28,879
+a proposed edit so what is the use case
+
+4908
+02:57:28,398 --> 02:57:30,719
+of that
+
+4909
+02:57:28,879 --> 02:57:32,398
+it's it's not like for fundamental
+
+4910
+02:57:30,719 --> 02:57:34,959
+changes but for i would say minor
+
+4911
+02:57:32,398 --> 02:57:37,119
+challenges on a specific import
+
+4912
+02:57:34,959 --> 02:57:38,879
+imagine that you don't agree on this one
+
+4913
+02:57:37,120 --> 02:57:42,720
+on this idea of season
+
+4914
+02:57:38,879 --> 02:57:46,398
+there's a typo and it's not d5 but e5
+
+4915
+02:57:42,719 --> 02:57:48,639
+in the ipv6 rs so you propose the change
+
+4916
+02:57:46,398 --> 02:57:49,680
+in this case i'm playing both holes here
+
+4917
+02:57:48,639 --> 02:57:51,920
+but
+
+4918
+02:57:49,680 --> 02:57:53,120
+what do i have here it's basically an
+
+4919
+02:57:51,920 --> 02:57:55,520
+attribute
+
+4920
+02:57:53,120 --> 02:57:56,800
+with a proposal of the church and i'm
+
+4921
+02:57:55,520 --> 02:57:59,439
+playing the boss roles for the
+
+4922
+02:57:56,799 --> 02:58:02,799
+contributor roles and
+
+4923
+02:57:59,439 --> 02:58:05,760
+the original creator then i can say okay
+
+4924
+02:58:02,799 --> 02:58:07,679
+i accept the change indeed this this
+
+4925
+02:58:05,760 --> 02:58:10,960
+proposal makes sense
+
+4926
+02:58:07,680 --> 02:58:14,0
+10687.68 --> 10694
+or are basically discounted and this is
+
+4927
+02:58:10,959 --> 02:58:18,0
+10690.96 --> 10698
+a way to get updates from
+
+4928
+02:58:14,0 --> 02:58:19,439
+10694 --> 10699.439
+um from supportive other members other
+
+4929
+02:58:18,0 --> 02:58:21,40
+10698 --> 10701.04
+organizations and so on
+
+4930
+02:58:19,439 --> 02:58:22,880
+it's one way to to update the
+
+4931
+02:58:21,40 --> 02:58:26,960
+information in this case i will
+
+4932
+02:58:22,879 --> 02:58:28,879
+discuss it because it's not correct
+
+4933
+02:58:26,959 --> 02:58:30,879
+we were talking about contributions this
+
+4934
+02:58:28,879 --> 02:58:32,79
+another way of contributing is the site
+
+4935
+02:58:30,879 --> 02:58:35,679
+things itself
+
+4936
+02:58:32,79 --> 02:58:37,39
+so for example for this specifications
+
+4937
+02:58:35,680 --> 02:58:38,398
+if for example we have an expression
+
+4938
+02:58:37,40 --> 02:58:39,40
+detection system and we have seen it
+
+4939
+02:58:38,398 --> 02:58:42,719
+like
+
+4940
+02:58:39,40 --> 02:58:47,279
+three times in a row we can add
+
+4941
+02:58:42,719 --> 02:58:48,639
+on on the interface with the api
+
+4942
+02:58:47,279 --> 02:58:50,640
+through the user interface and so on
+
+4943
+02:58:48,639 --> 02:58:53,920
+that you have seen that um
+
+4944
+02:58:50,639 --> 02:58:55,920
+multiple times and like that you can
+
+4945
+02:58:53,920 --> 02:58:59,200
+share this kind of details about
+
+4946
+02:58:55,920 --> 02:59:01,200
+the sharing aspect
+
+4947
+02:58:59,200 --> 02:59:02,800
+so we what we have seen that at this
+
+4948
+02:59:01,200 --> 02:59:05,359
+specific amount of times we have
+
+4949
+02:59:02,799 --> 02:59:06,239
+the three counts saying this uh this is
+
+4950
+02:59:05,359 --> 02:59:07,920
+a site
+
+4951
+02:59:06,239 --> 02:59:09,520
+and you have seen it and you can do it
+
+4952
+02:59:07,920 --> 02:59:11,840
+per organization
+
+4953
+02:59:09,520 --> 02:59:13,439
+or it could be even anonymously you get
+
+4954
+02:59:11,840 --> 02:59:15,439
+different configuration in the model of
+
+4955
+02:59:13,439 --> 02:59:18,159
+cycling in mist
+
+4956
+02:59:15,439 --> 02:59:19,279
+but it's a way to see that an indicator
+
+4957
+02:59:18,159 --> 02:59:22,799
+has been seen
+
+4958
+02:59:19,279 --> 02:59:23,680
+or not if one specific are generating
+
+4959
+02:59:22,799 --> 02:59:25,599
+for example a
+
+4960
+02:59:23,680 --> 02:59:28,318
+false positive you can see the negative
+
+4961
+02:59:25,600 --> 02:59:30,960
+one negative sightings which
+
+4962
+02:59:28,318 --> 02:59:33,840
+basically tell others that okay this one
+
+4963
+02:59:30,959 --> 02:59:35,839
+is generating a lot of false positives
+
+4964
+02:59:33,840 --> 02:59:37,200
+sometimes not every organization agrees
+
+4965
+02:59:35,840 --> 02:59:38,719
+on the first positive because they have
+
+4966
+02:59:37,200 --> 02:59:40,800
+different views
+
+4967
+02:59:38,719 --> 02:59:42,799
+coming from different networks and so on
+
+4968
+02:59:40,799 --> 02:59:46,318
+that's a way to
+
+4969
+02:59:42,799 --> 02:59:49,358
+provide feedback so one is delegations
+
+4970
+02:59:46,318 --> 02:59:57,519
+proposals or another way is to
+
+4971
+02:59:49,359 --> 02:59:59,760
+basically get affected
+
+4972
+02:59:57,520 --> 02:59:59,760
+okay
+
+4973
+03:00:01,439 --> 03:00:04,479
+i'm just trying to go through the
+
+4974
+03:00:02,719 --> 03:00:07,278
+questions yeah
+
+4975
+03:00:04,478 --> 03:00:08,478
+maybe yes maybe there are some yeah
+
+4976
+03:00:07,279 --> 03:00:10,560
+there are some that are repeating so
+
+4977
+03:00:08,478 --> 03:00:12,799
+perhaps it's good to call them out
+
+4978
+03:00:10,559 --> 03:00:13,680
+uh so there was a bit of confusion about
+
+4979
+03:00:12,799 --> 03:00:16,0
+10812.8 --> 10816
+how to add the
+
+4980
+03:00:13,680 --> 03:00:17,40
+uh the email object so it uh checked it
+
+4981
+03:00:16,0 --> 03:00:19,200
+10816 --> 10819.2
+is a little bit
+
+4982
+03:00:17,40 --> 03:00:20,880
+uh confusing so when you're in an event
+
+4983
+03:00:19,200 --> 03:00:22,960
+and you click on add objects first you
+
+4984
+03:00:20,879 --> 03:00:24,559
+need to select the scope
+
+4985
+03:00:22,959 --> 03:00:26,478
+from which you choose from so it's going
+
+4986
+03:00:24,559 --> 03:00:28,559
+to be climate file and so on just click
+
+4987
+03:00:26,478 --> 03:00:30,159
+on all objects if you're unsure
+
+4988
+03:00:28,559 --> 03:00:31,680
+and then you can search for whatever so
+
+4989
+03:00:30,159 --> 03:00:32,398
+after you click on all objects and you
+
+4990
+03:00:31,680 --> 03:00:35,920
+type email
+
+4991
+03:00:32,398 --> 03:00:38,0
+10832.399 --> 10838
+it's going to show your email object
+
+4992
+03:00:35,920 --> 03:00:39,520
+here the first step is more like finding
+
+4993
+03:00:38,0 --> 03:00:41,680
+10838 --> 10841.68
+out the category of an object
+
+4994
+03:00:39,520 --> 03:00:43,200
+yeah so so some sometimes you just know
+
+4995
+03:00:41,680 --> 03:00:44,880
+the category but you don't know what is
+
+4996
+03:00:43,200 --> 03:00:46,800
+really available there for you
+
+4997
+03:00:44,879 --> 03:00:48,719
+so you you want to see okay what sort of
+
+4998
+03:00:46,799 --> 03:00:50,398
+objects can i use in network contacts
+
+4999
+03:00:48,719 --> 03:00:52,799
+and i would click on network first
+
+5000
+03:00:50,398 --> 03:00:54,159
+and then you get a list of of all
+
+5001
+03:00:52,799 --> 03:00:55,438
+tangently related
+
+5002
+03:00:54,159 --> 03:00:57,279
+objects that will have to do with
+
+5003
+03:00:55,439 --> 03:01:00,159
+network connectivity but
+
+5004
+03:00:57,279 --> 03:01:01,520
+not necessarily describing the same
+
+5005
+03:01:00,159 --> 03:01:04,639
+concept at all
+
+5006
+03:01:01,520 --> 03:01:06,319
+uh but if you don't know or
+
+5007
+03:01:04,639 --> 03:01:08,239
+which the domain you want to pick it
+
+5008
+03:01:06,318 --> 03:01:10,0
+10866.319 --> 10870
+from or if you know
+
+5009
+03:01:08,239 --> 03:01:11,600
+exactly already what you want and you
+
+5010
+03:01:10,0 --> 03:01:13,120
+10870 --> 10873.12
+just want to search by name just click
+
+5011
+03:01:11,600 --> 03:01:14,159
+on all objects first
+
+5012
+03:01:13,120 --> 03:01:17,680
+and then you will find what you're
+
+5013
+03:01:14,159 --> 03:01:20,879
+looking for by just typing it so email
+
+5014
+03:01:17,680 --> 03:01:25,40
+is easy to find that way
+
+5015
+03:01:20,879 --> 03:01:25,39
+okay so just type email and that's it
+
+5016
+03:01:25,359 --> 03:01:33,359
+okay um other questions
+
+5017
+03:01:28,639 --> 03:01:35,920
+that were there okay perfect
+
+5018
+03:01:33,359 --> 03:01:37,359
+and there there were a few other
+
+5019
+03:01:35,920 --> 03:01:38,398
+questions that i answered in the
+
+5020
+03:01:37,359 --> 03:01:41,40
+meanwhile maybe it's
+
+5021
+03:01:38,398 --> 03:01:42,318
+a good idea to read soft about yeah
+
+5022
+03:01:41,40 --> 03:01:44,240
+indeed there was a good one
+
+5023
+03:01:42,318 --> 03:01:45,680
+about correlation graph and and
+
+5024
+03:01:44,239 --> 03:01:47,199
+filtering on it
+
+5025
+03:01:45,680 --> 03:01:49,40
+indeed we don't have a way to filter the
+
+5026
+03:01:47,200 --> 03:01:50,479
+correlation graph but it's something
+
+5027
+03:01:49,40 --> 03:01:52,0
+10909.04 --> 10912
+that we that we've discussed for a while
+
+5028
+03:01:50,478 --> 03:01:52,398
+already and we want to do it at one
+
+5029
+03:01:52,0 --> 03:01:54,79
+10912 --> 10914.08
+point
+
+5030
+03:01:52,398 --> 03:01:56,0
+10912.399 --> 10916
+so that you can add some filter rules in
+
+5031
+03:01:54,79 --> 03:01:58,79
+there yes
+
+5032
+03:01:56,0 --> 03:01:59,760
+10916 --> 10919.76
+the only way to to do it here at least
+
+5033
+03:01:58,79 --> 03:02:01,39
+through the api so that means you you
+
+5034
+03:01:59,760 --> 03:02:03,840
+done the
+
+5035
+03:02:01,40 --> 03:02:04,640
+decorating one and then you have to do a
+
+5036
+03:02:03,840 --> 03:02:07,279
+filtering
+
+5037
+03:02:04,639 --> 03:02:07,920
+priority but it needs something that's
+
+5038
+03:02:07,279 --> 03:02:11,279
+uh
+
+5039
+03:02:07,920 --> 03:02:12,719
+yeah it will be to be added i don't know
+
+5040
+03:02:11,279 --> 03:02:17,40
+if you have an issue on that one
+
+5041
+03:02:12,719 --> 03:02:19,199
+um yeah i think we do yes yes
+
+5042
+03:02:17,40 --> 03:02:21,760
+so maybe you know what sometimes what we
+
+5043
+03:02:19,200 --> 03:02:21,760
+do is
+
+5044
+03:02:21,840 --> 03:02:26,159
+just just to add the one on this one um
+
+5045
+03:02:24,559 --> 03:02:27,359
+if i'm finding his back
+
+5046
+03:02:26,159 --> 03:02:29,359
+so i guess you can see what kind of
+
+5047
+03:02:27,359 --> 03:02:31,40
+issue that we have and so on
+
+5048
+03:02:29,359 --> 03:02:32,880
+a lot of the issue that we have is more
+
+5049
+03:02:31,40 --> 03:02:34,960
+like i mean
+
+5050
+03:02:32,879 --> 03:02:36,318
+around 25 percent 30 percent our basic
+
+5051
+03:02:34,959 --> 03:02:38,719
+installation problem
+
+5052
+03:02:36,318 --> 03:02:39,920
+um that's something that you can discuss
+
+5053
+03:02:38,719 --> 03:02:42,559
+maybe tomorrow about
+
+5054
+03:02:39,920 --> 03:02:43,359
+about recommendation on on on the
+
+5055
+03:02:42,559 --> 03:02:45,199
+systems
+
+5056
+03:02:43,359 --> 03:02:46,559
+we don't need a lot of requirements but
+
+5057
+03:02:45,200 --> 03:02:48,240
+at least um
+
+5058
+03:02:46,559 --> 03:02:49,760
+you need to have a lamp system working
+
+5059
+03:02:48,239 --> 03:02:52,879
+for mariadb
+
+5060
+03:02:49,760 --> 03:02:56,318
+linux systems and ready running
+
+5061
+03:02:52,879 --> 03:02:57,759
+so obviously for example an ubuntu
+
+5062
+03:02:56,318 --> 03:02:59,439
+distribution out of the box is working
+
+5063
+03:02:57,760 --> 03:03:02,79
+without any problems
+
+5064
+03:02:59,439 --> 03:03:02,800
+now if you try to install a missponder
+
+5065
+03:03:02,79 --> 03:03:05,359
+mac os
+
+5066
+03:03:02,799 --> 03:03:05,920
+you might turn into troubles obviously
+
+5067
+03:03:05,359 --> 03:03:07,920
+but
+
+5068
+03:03:05,920 --> 03:03:09,840
+what we recommend is we have install
+
+5069
+03:03:07,920 --> 03:03:12,159
+automatic install script for
+
+5070
+03:03:09,840 --> 03:03:14,239
+for ubuntu for example and this one
+
+5071
+03:03:12,159 --> 03:03:18,239
+works works quite well
+
+5072
+03:03:14,239 --> 03:03:18,239
+i wanted to search the issue for
+
+5073
+03:03:18,398 --> 03:03:22,559
+you just search your correlation for
+
+5074
+03:03:20,79 --> 03:03:25,840
+correlation yeah
+
+5075
+03:03:22,559 --> 03:03:26,239
+creation filtering now that will be a
+
+5076
+03:03:25,840 --> 03:03:29,279
+bit
+
+5077
+03:03:26,239 --> 03:03:31,439
+too specific i think no really not
+
+5078
+03:03:29,279 --> 03:03:40,640
+maybe yes we're filtering by correlation
+
+5079
+03:03:31,439 --> 03:03:43,520
+on feedback
+
+5080
+03:03:40,639 --> 03:03:43,519
+yeah that's easy
+
+5081
+03:03:44,719 --> 03:03:55,840
+oh this one maybe yes yeah yeah okay
+
+5082
+03:03:47,840 --> 03:03:55,840
+this one okay so
+
+5083
+03:04:03,200 --> 03:04:06,960
+so that's how we work so if you see a
+
+5084
+03:04:05,200 --> 03:04:08,560
+component issue that
+
+5085
+03:04:06,959 --> 03:04:10,239
+or a feature that is really interesting
+
+5086
+03:04:08,559 --> 03:04:11,359
+for you don't hesitate to take an
+
+5087
+03:04:10,239 --> 03:04:13,600
+existing issue
+
+5088
+03:04:11,359 --> 03:04:14,479
+about specific requests and add some
+
+5089
+03:04:13,600 --> 03:04:16,318
+comments there
+
+5090
+03:04:14,478 --> 03:04:18,0
+11054.479 --> 11058
+like for example it's really the issue
+
+5091
+03:04:16,318 --> 03:04:20,159
+the feature that you want
+
+5092
+03:04:18,0 --> 03:04:22,79
+11058 --> 11062.08
+uh is it important for you why and so on
+
+5093
+03:04:20,159 --> 03:04:25,200
+and then we use that as a source of
+
+5094
+03:04:22,79 --> 03:04:26,959
+of doing a pd request as an example we
+
+5095
+03:04:25,200 --> 03:04:29,40
+do
+
+5096
+03:04:26,959 --> 03:04:30,559
+a release of miss every three weeks
+
+5097
+03:04:29,40 --> 03:04:34,560
+usually
+
+5098
+03:04:30,559 --> 03:04:35,359
+and there are many new features on each
+
+5099
+03:04:34,559 --> 03:04:38,398
+release
+
+5100
+03:04:35,359 --> 03:04:40,318
+as an example we had a request like that
+
+5101
+03:04:38,398 --> 03:04:43,599
+sami just fixed uh
+
+5102
+03:04:40,318 --> 03:04:44,559
+two days ago about the events oh we
+
+5103
+03:04:43,600 --> 03:04:48,640
+didn't even show it
+
+5104
+03:04:44,559 --> 03:04:50,398
+even timeline and then
+
+5105
+03:04:48,639 --> 03:04:52,159
+we wanted to have something that is easy
+
+5106
+03:04:50,398 --> 03:04:52,478
+to set the number of days and then he
+
+5107
+03:04:52,159 --> 03:04:54,719
+has
+
+5108
+03:04:52,478 --> 03:04:56,318
+the new feature so sometimes it makes a
+
+5109
+03:04:54,719 --> 03:04:57,39
+lot of sense so don't hesitate to create
+
+5110
+03:04:56,318 --> 03:05:00,79
+a
+
+5111
+03:04:57,40 --> 03:05:01,359
+an issue and and propose a new new
+
+5112
+03:05:00,79 --> 03:05:05,600
+feature
+
+5113
+03:05:01,359 --> 03:05:08,79
+which remind me of showing you the even
+
+5114
+03:05:05,600 --> 03:05:09,520
+timeline because we didn't really show
+
+5115
+03:05:08,79 --> 03:05:13,359
+it
+
+5116
+03:05:09,520 --> 03:05:17,840
+so you see that on on this one
+
+5117
+03:05:13,359 --> 03:05:20,239
+we we have nearly everything
+
+5118
+03:05:17,840 --> 03:05:21,120
+same time which is basically the time
+
+5119
+03:05:20,239 --> 03:05:24,79
+when we
+
+5120
+03:05:21,120 --> 03:05:27,760
+create a different object we just set
+
+5121
+03:05:24,79 --> 03:05:31,439
+the time for four for one
+
+5122
+03:05:27,760 --> 03:05:33,120
+so and then i can
+
+5123
+03:05:31,439 --> 03:05:35,120
+basically look at this one and this one
+
+5124
+03:05:33,120 --> 03:05:37,760
+is like the
+
+5125
+03:05:35,120 --> 03:05:40,319
+yeah i don't know why we don't have the
+
+5126
+03:05:37,760 --> 03:05:41,600
+expansion on that one
+
+5127
+03:05:40,318 --> 03:05:43,359
+so for you for example if you have a
+
+5128
+03:05:41,600 --> 03:05:44,960
+specific time we can
+
+5129
+03:05:43,359 --> 03:05:46,318
+expand it and even change it in the
+
+5130
+03:05:44,959 --> 03:05:47,679
+graph so that means if we have for
+
+5131
+03:05:46,318 --> 03:05:50,559
+example this email
+
+5132
+03:05:47,680 --> 03:05:51,120
+a thing with that we can we can expand
+
+5133
+03:05:50,559 --> 03:05:54,0
+11150.56 --> 11154
+it
+
+5134
+03:05:51,120 --> 03:05:56,240
+and change when when this has been seen
+
+5135
+03:05:54,0 --> 03:05:58,559
+11154 --> 11158.56
+and we can even uh
+
+5136
+03:05:56,239 --> 03:06:00,239
+change at which time this specific
+
+5137
+03:05:58,559 --> 03:06:04,79
+specifically
+
+5138
+03:06:00,239 --> 03:06:07,439
+but that's again a good point to do
+
+5139
+03:06:04,79 --> 03:06:10,959
+is to automatically create
+
+5140
+03:06:07,439 --> 03:06:13,200
+a first thing last scene on your element
+
+5141
+03:06:10,959 --> 03:06:14,959
+because every time you do that you will
+
+5142
+03:06:13,200 --> 03:06:16,880
+get an automatic timeline
+
+5143
+03:06:14,959 --> 03:06:20,478
+and actually a quick i would say quick
+
+5144
+03:06:16,879 --> 03:06:20,478
+win when you do analysis
+
+5145
+03:06:21,510 --> 03:06:25,439
+[Music]
+
+5146
+03:06:23,760 --> 03:06:27,120
+so if there are no more questions about
+
+5147
+03:06:25,439 --> 03:06:28,800
+event creation perhaps one of the things
+
+5148
+03:06:27,120 --> 03:06:33,200
+we can do is show the searching
+
+5149
+03:06:28,799 --> 03:06:33,199
+how to search for stuff in your risk
+
+5150
+03:06:36,398 --> 03:06:40,239
+okay so this is something that we're
+
+5151
+03:06:38,799 --> 03:06:42,398
+going to show very briefly now and we're
+
+5152
+03:06:40,239 --> 03:06:43,199
+going to go a bit more detail into this
+
+5153
+03:06:42,398 --> 03:06:44,959
+tomorrow
+
+5154
+03:06:43,200 --> 03:06:47,40
+when we're also going to look at the api
+
+5155
+03:06:44,959 --> 03:06:47,679
+but generally whenever you're searching
+
+5156
+03:06:47,40 --> 03:06:49,40
+in miss
+
+5157
+03:06:47,680 --> 03:06:50,800
+the main question you need to ask
+
+5158
+03:06:49,40 --> 03:06:52,960
+yourself is
+
+5159
+03:06:50,799 --> 03:06:54,719
+what scope am i searching on am i
+
+5160
+03:06:52,959 --> 03:06:56,879
+searching for individual attributes
+
+5161
+03:06:54,719 --> 03:06:58,559
+or am i searching for events the search
+
+5162
+03:06:56,879 --> 03:07:01,278
+filters very often overlapping
+
+5163
+03:06:58,559 --> 03:07:02,318
+or aren't necessarily almost the same
+
+5164
+03:07:01,279 --> 03:07:04,79
+but one of the things you need to keep
+
+5165
+03:07:02,318 --> 03:07:04,398
+in mind is for example if i'm searching
+
+5166
+03:07:04,79 --> 03:07:06,879
+for
+
+5167
+03:07:04,398 --> 03:07:09,39
+bitcoin addresses in my miss vincent's
+
+5168
+03:07:06,879 --> 03:07:11,278
+bitcoin wallets
+
+5169
+03:07:09,40 --> 03:07:12,640
+am i searching for any event that
+
+5170
+03:07:11,279 --> 03:07:16,0
+11231.279 --> 11236
+contains at least one
+
+5171
+03:07:12,639 --> 03:07:18,239
+bitcoin address or am i searching for
+
+5172
+03:07:16,0 --> 03:07:19,920
+11236 --> 11239.92
+just the bitcoin addresses themselves
+
+5173
+03:07:18,239 --> 03:07:21,439
+so this is when we decide between
+
+5174
+03:07:19,920 --> 03:07:23,520
+different scopes so
+
+5175
+03:07:21,439 --> 03:07:25,200
+generally attribute scope will only give
+
+5176
+03:07:23,520 --> 03:07:26,399
+you the individual attributes that match
+
+5177
+03:07:25,200 --> 03:07:27,840
+the criteria
+
+5178
+03:07:26,398 --> 03:07:29,439
+and the event scope will give you
+
+5179
+03:07:27,840 --> 03:07:32,239
+everything that contains
+
+5180
+03:07:29,439 --> 03:07:34,318
+at least one matching value so here what
+
+5181
+03:07:32,239 --> 03:07:36,639
+what alex did he just searched
+
+5182
+03:07:34,318 --> 03:07:37,760
+using the attribute search for all the
+
+5183
+03:07:36,639 --> 03:07:39,519
+bitcoin addresses
+
+5184
+03:07:37,760 --> 03:07:40,880
+in the air in the instance and we see we
+
+5185
+03:07:39,520 --> 03:07:42,560
+get a bunch of them from different
+
+5186
+03:07:40,879 --> 03:07:44,559
+sources we see which events there
+
+5187
+03:07:42,559 --> 03:07:46,239
+they're from which organization has
+
+5188
+03:07:44,559 --> 03:07:47,439
+created that information and so on and
+
+5189
+03:07:46,239 --> 03:07:49,199
+so forth
+
+5190
+03:07:47,439 --> 03:07:51,520
+uh if we're happy with the search
+
+5191
+03:07:49,200 --> 03:07:53,600
+results and we've set up all our
+
+5192
+03:07:51,520 --> 03:07:55,120
+features and we're getting exactly what
+
+5193
+03:07:53,600 --> 03:07:57,279
+we were looking for
+
+5194
+03:07:55,120 --> 03:07:59,120
+maybe even several pages of it like here
+
+5195
+03:07:57,279 --> 03:08:01,200
+we can download the results in any of
+
+5196
+03:07:59,120 --> 03:08:02,640
+these supported formats so we could say
+
+5197
+03:08:01,200 --> 03:08:04,560
+okay now we have all these bitcoin
+
+5198
+03:08:02,639 --> 03:08:05,278
+addresses out there generate the csv out
+
+5199
+03:08:04,559 --> 03:08:08,398
+of it
+
+5200
+03:08:05,279 --> 03:08:10,640
+and it will generate a massive csv
+
+5201
+03:08:08,398 --> 03:08:13,199
+with all the attribute information for
+
+5202
+03:08:10,639 --> 03:08:13,199
+each of these
+
+5203
+03:08:13,840 --> 03:08:18,559
+i hope you're not running my timings
+
+5204
+03:08:15,760 --> 03:08:18,559
+inside of memory
+
+5205
+03:08:19,520 --> 03:08:23,120
+there it is
+
+5206
+03:08:21,760 --> 03:08:26,159
+[Music]
+
+5207
+03:08:23,120 --> 03:08:28,0
+11303.12 --> 11308
+so if you open it just to see the
+
+5208
+03:08:26,159 --> 03:08:31,279
+results quickly
+
+5209
+03:08:28,0 --> 03:08:34,159
+11308 --> 11314.16
+there we go so in this case uh
+
+5210
+03:08:31,279 --> 03:08:34,960
+we now downloaded our search results as
+
+5211
+03:08:34,159 --> 03:08:36,559
+csv
+
+5212
+03:08:34,959 --> 03:08:39,119
+now keep in mind whenever you're dealing
+
+5213
+03:08:36,559 --> 03:08:39,439
+with integration of mis with other tools
+
+5214
+03:08:39,120 --> 03:08:41,439
+or
+
+5215
+03:08:39,439 --> 03:08:43,680
+exports keep in mind that certain
+
+5216
+03:08:41,439 --> 03:08:45,200
+formats don't really cater to exporting
+
+5217
+03:08:43,680 --> 03:08:47,600
+certain types of data so
+
+5218
+03:08:45,200 --> 03:08:49,439
+if you're searching for ransomware
+
+5219
+03:08:47,600 --> 03:08:51,920
+payout
+
+5220
+03:08:49,439 --> 03:08:52,800
+wallets you could for example specify as
+
+5221
+03:08:51,920 --> 03:08:55,120
+a tag
+
+5222
+03:08:52,799 --> 03:08:56,398
+all the different ransomware related
+
+5223
+03:08:55,120 --> 03:08:58,880
+tags that you have
+
+5224
+03:08:56,398 --> 03:09:00,559
+and uh as a type select btc like what
+
+5225
+03:08:58,879 --> 03:09:02,239
+alex has done here and exported
+
+5226
+03:09:00,559 --> 03:09:03,920
+information now when you're deciding
+
+5227
+03:09:02,239 --> 03:09:05,760
+what format to download in
+
+5228
+03:09:03,920 --> 03:09:07,920
+again some don't make any sense so don't
+
+5229
+03:09:05,760 --> 03:09:10,239
+download bitcoin addresses in sticks
+
+5230
+03:09:07,920 --> 03:09:11,920
+format because sticks doesn't have a
+
+5231
+03:09:10,239 --> 03:09:13,359
+way to express bitcoin addresses for
+
+5232
+03:09:11,920 --> 03:09:15,439
+example
+
+5233
+03:09:13,359 --> 03:09:17,120
+so just make sure that you also take
+
+5234
+03:09:15,439 --> 03:09:19,760
+that into consideration and exporting
+
+5235
+03:09:17,120 --> 03:09:22,160
+data so that it's not wasting
+
+5236
+03:09:19,760 --> 03:09:23,680
+uh besides that we can do the same on
+
+5237
+03:09:22,159 --> 03:09:24,559
+the event level we can also do searches
+
+5238
+03:09:23,680 --> 03:09:26,800
+on the event level
+
+5239
+03:09:24,559 --> 03:09:29,39
+if we go back to our event index we have
+
+5240
+03:09:26,799 --> 03:09:29,358
+a little magnifying glass icon where you
+
+5241
+03:09:29,40 --> 03:09:31,600
+can
+
+5242
+03:09:29,359 --> 03:09:32,479
+add additional filter options to the
+
+5243
+03:09:31,600 --> 03:09:34,720
+index
+
+5244
+03:09:32,478 --> 03:09:35,519
+and filter the database on that so let's
+
+5245
+03:09:34,719 --> 03:09:38,159
+just do
+
+5246
+03:09:35,520 --> 03:09:39,520
+simple we're going to just filter on
+
+5247
+03:09:38,159 --> 03:09:41,200
+events coming from circle
+
+5248
+03:09:39,520 --> 03:09:42,960
+and we can also add for example events
+
+5249
+03:09:41,200 --> 03:09:45,439
+that are not published
+
+5250
+03:09:42,959 --> 03:09:47,358
+if you wanted to do some final checks on
+
+5251
+03:09:45,439 --> 03:09:50,960
+whether
+
+5252
+03:09:47,359 --> 03:09:52,399
+uh we need to add the organization again
+
+5253
+03:09:50,959 --> 03:09:54,79
+whether we have any events that need to
+
+5254
+03:09:52,398 --> 03:09:55,840
+be vetted for example for our own
+
+5255
+03:09:54,79 --> 03:09:57,39
+organization then we could use this
+
+5256
+03:09:55,840 --> 03:09:58,799
+filter for it
+
+5257
+03:09:57,40 --> 03:10:00,479
+on the event index all of these search
+
+5258
+03:09:58,799 --> 03:10:02,559
+filters that you apply
+
+5259
+03:10:00,478 --> 03:10:03,519
+generate a specific url and you can
+
+5260
+03:10:02,559 --> 03:10:05,359
+bookmark it
+
+5261
+03:10:03,520 --> 03:10:06,560
+so if you have recurring queries that
+
+5262
+03:10:05,359 --> 03:10:08,399
+you want to monitor
+
+5263
+03:10:06,559 --> 03:10:09,680
+then you can just bookmark the url and
+
+5264
+03:10:08,398 --> 03:10:11,358
+you can go back to it
+
+5265
+03:10:09,680 --> 03:10:12,960
+later on and see if there is anything
+
+5266
+03:10:11,359 --> 03:10:16,880
+that popped up that matches your
+
+5267
+03:10:12,959 --> 03:10:19,839
+search criteria now generally
+
+5268
+03:10:16,879 --> 03:10:21,199
+like i think 90 of our searches do not
+
+5269
+03:10:19,840 --> 03:10:23,600
+actually happen via the ui
+
+5270
+03:10:21,200 --> 03:10:25,200
+they happen via the api so very often
+
+5271
+03:10:23,600 --> 03:10:26,79
+you have tools that you search through
+
+5272
+03:10:25,200 --> 03:10:28,479
+so if you have a
+
+5273
+03:10:26,79 --> 03:10:30,238
+tool that acts as a front-end for your
+
+5274
+03:10:28,478 --> 03:10:32,0
+11428.479 --> 11432
+miss for certain searches that works as
+
+5275
+03:10:30,238 --> 03:10:33,439
+well
+
+5276
+03:10:32,0 --> 03:10:34,959
+11432 --> 11434.96
+we're going to talk more about those
+
+5277
+03:10:33,439 --> 03:10:37,120
+type of searches and how you integrate
+
+5278
+03:10:34,959 --> 03:10:39,599
+with other tools tomorrow more
+
+5279
+03:10:37,120 --> 03:10:41,279
+when we go into the api a bit is a
+
+5280
+03:10:39,600 --> 03:10:42,960
+question about soft delete attribute
+
+5281
+03:10:41,279 --> 03:10:45,600
+search
+
+5282
+03:10:42,959 --> 03:10:47,199
+i just lost the q and a so some martin
+
+5283
+03:10:45,600 --> 03:10:48,559
+asks is there a way to do a global
+
+5284
+03:10:47,200 --> 03:10:51,840
+search for software
+
+5285
+03:10:48,559 --> 03:10:54,318
+attributes yes sorry where is it
+
+5286
+03:10:51,840 --> 03:10:56,478
+there for software attachments yes there
+
+5287
+03:10:54,318 --> 03:10:59,359
+is
+
+5288
+03:10:56,478 --> 03:11:00,879
+uh so not via the ui but via the api uh
+
+5289
+03:10:59,359 --> 03:11:02,238
+which you can also access
+
+5290
+03:11:00,879 --> 03:11:03,759
+by the way we have two we have a
+
+5291
+03:11:02,238 --> 03:11:04,799
+built-in tool we can even show it show
+
+5292
+03:11:03,760 --> 03:11:08,639
+this example there
+
+5293
+03:11:04,799 --> 03:11:08,639
+we didn't show the delete i
+
+5294
+03:11:10,639 --> 03:11:15,39
+and let's start with the question first
+
+5295
+03:11:12,639 --> 03:11:16,639
+and then we go to the delete
+
+5296
+03:11:15,40 --> 03:11:18,560
+so we have this built-in tool called the
+
+5297
+03:11:16,639 --> 03:11:22,478
+rest client that allows us to run
+
+5298
+03:11:18,559 --> 03:11:24,318
+searches directly from the interface so
+
+5299
+03:11:22,478 --> 03:11:26,0
+11482.479 --> 11486
+generally indeed we have a software
+
+5300
+03:11:24,318 --> 03:11:29,119
+delete mechanism in bisp
+
+5301
+03:11:26,0 --> 03:11:30,79
+11486 --> 11490.08
+that allows you to to not fully remove
+
+5302
+03:11:29,120 --> 03:11:32,239
+an attribute but
+
+5303
+03:11:30,79 --> 03:11:33,920
+mark is for it for deletion the reason
+
+5304
+03:11:32,238 --> 03:11:36,159
+why we do this in general is
+
+5305
+03:11:33,920 --> 03:11:37,439
+whenever we're synchronizing information
+
+5306
+03:11:36,159 --> 03:11:38,799
+and we delete an attribute
+
+5307
+03:11:37,439 --> 03:11:40,880
+we want to inform all the leather
+
+5308
+03:11:38,799 --> 03:11:42,159
+instances attribute needs to be removed
+
+5309
+03:11:40,879 --> 03:11:44,238
+it is revoked
+
+5310
+03:11:42,159 --> 03:11:45,680
+so this is why we do the soft delete
+
+5311
+03:11:44,238 --> 03:11:48,478
+when we hide it from the interface
+
+5312
+03:11:45,680 --> 03:11:50,639
+behind it from the exports
+
+5313
+03:11:48,478 --> 03:11:52,0
+11508.479 --> 11512
+but we still keep the data and we inform
+
+5314
+03:11:50,639 --> 03:11:54,0
+11510.64 --> 11514
+the other instances that they need to
+
+5315
+03:11:52,0 --> 03:11:57,120
+11512 --> 11517.12
+also market for deletion
+
+5316
+03:11:54,0 --> 03:11:58,799
+11514 --> 11518.8
+now if the question is how do we do a
+
+5317
+03:11:57,120 --> 03:12:00,319
+global search for all the soft deleted
+
+5318
+03:11:58,799 --> 03:12:00,799
+attributes so first of all what we need
+
+5319
+03:12:00,318 --> 03:12:04,478
+to do
+
+5320
+03:12:00,799 --> 03:12:06,799
+yeah using our little research too
+
+5321
+03:12:04,478 --> 03:12:08,719
+is by the way we have the modern apis
+
+5322
+03:12:06,799 --> 03:12:11,438
+here to create a new api unless you know
+
+5323
+03:12:08,719 --> 03:12:11,438
+yours by heart
+
+5324
+03:12:12,0 --> 03:12:17,200
+11532 --> 11537.2
+so alex because you it's very good
+
+5325
+03:12:17,359 --> 03:12:20,479
+so so just quickly that's so uh so in
+
+5326
+03:12:19,439 --> 03:12:22,318
+the meanwhile what
+
+5327
+03:12:20,478 --> 03:12:24,238
+alex is doing now is uh he's going to
+
+5328
+03:12:22,318 --> 03:12:26,959
+generate a new api key for himself
+
+5329
+03:12:24,238 --> 03:12:29,359
+so that we can actually test the api uh
+
+5330
+03:12:26,959 --> 03:12:33,839
+queries
+
+5331
+03:12:29,359 --> 03:12:33,840
+oh that's one word yeah
+
+5332
+03:12:35,279 --> 03:12:47,840
+yeah you can add enough key from here as
+
+5333
+03:12:36,719 --> 03:12:47,840
+well this will work yeah that works
+
+5334
+03:12:54,129 --> 03:12:57,279
+[Music]
+
+5335
+03:12:59,680 --> 03:13:16,238
+a global action my profile by the way if
+
+5336
+03:13:01,520 --> 03:13:16,238
+you want to find your profile okay
+
+5337
+03:13:17,359 --> 03:13:21,760
+so now we have our api key now we go to
+
+5338
+03:13:20,159 --> 03:13:22,398
+rest client we just paste it in there
+
+5339
+03:13:21,760 --> 03:13:25,680
+now
+
+5340
+03:13:22,398 --> 03:13:25,680
+in the authorization field
+
+5341
+03:13:27,439 --> 03:13:30,639
+here we go and now what we're going to
+
+5342
+03:13:28,799 --> 03:13:32,79
+do is we're going to uh to run a search
+
+5343
+03:13:30,639 --> 03:13:32,478
+for all software attributes so we're
+
+5344
+03:13:32,79 --> 03:13:35,680
+going to
+
+5345
+03:13:32,478 --> 03:13:37,519
+search for attribute rest search so that
+
+5346
+03:13:35,680 --> 03:13:38,960
+is a scope that allows us to search on
+
+5347
+03:13:37,520 --> 03:13:41,120
+the attribute level we'll do we'll see
+
+5348
+03:13:38,959 --> 03:13:44,0
+11618.96 --> 11624
+more of this tomorrow
+
+5349
+03:13:41,120 --> 03:13:47,600
+just a small example for return format
+
+5350
+03:13:44,0 --> 03:13:47,600
+11624 --> 11627.6
+let's pick something like json
+
+5351
+03:13:53,520 --> 03:13:59,520
+and perhaps set a page under limit or
+
+5352
+03:13:56,719 --> 03:14:01,119
+date one limit 100 or something like
+
+5353
+03:13:59,520 --> 03:14:02,479
+that
+
+5354
+03:14:01,120 --> 03:14:04,640
+i don't know how much was deleted here
+
+5355
+03:14:02,478 --> 03:14:07,199
+but it might be a lot and uh
+
+5356
+03:14:04,639 --> 03:14:11,840
+then just uh add another key deleted
+
+5357
+03:14:07,200 --> 03:14:11,840
+there we go
+
+5358
+03:14:12,159 --> 03:14:15,439
+and then deleted september
+
+5359
+03:14:16,398 --> 03:14:19,680
+and we don't need anything else
+
+5360
+03:14:20,318 --> 03:14:24,478
+and this will return the first 100 hits
+
+5361
+03:14:23,279 --> 03:14:28,238
+from the instance
+
+5362
+03:14:24,478 --> 03:14:28,238
+of attributes that are deleted
+
+5363
+03:14:30,398 --> 03:14:35,278
+there we go and now if you if you wanted
+
+5364
+03:14:33,600 --> 03:14:36,720
+to paginate through all these attributes
+
+5365
+03:14:35,279 --> 03:14:37,359
+you would have to just raise the page
+
+5366
+03:14:36,719 --> 03:14:40,0
+11676.72 --> 11680
+number
+
+5367
+03:14:37,359 --> 03:14:40,800
+go back and and get page 2 page 3 page 4
+
+5368
+03:14:40,0 --> 03:14:42,799
+11680 --> 11682.8
+and so on
+
+5369
+03:14:40,799 --> 03:14:44,959
+or if we have enough memory certainly my
+
+5370
+03:14:42,799 --> 03:14:46,318
+training instance definitely doesn't
+
+5371
+03:14:44,959 --> 03:14:49,278
+then we could just say give us
+
+5372
+03:14:46,318 --> 03:14:49,278
+everything in one shot
+
+5373
+03:14:49,600 --> 03:14:53,840
+okay so i hope that answers your
+
+5374
+03:14:52,79 --> 03:14:56,559
+question martin
+
+5375
+03:14:53,840 --> 03:14:58,559
+um there is also a question is there an
+
+5376
+03:14:56,559 --> 03:15:01,600
+official miss docker image
+
+5377
+03:14:58,559 --> 03:15:04,318
+um and there are actually several uh
+
+5378
+03:15:01,600 --> 03:15:05,439
+they're not maintained by us but by
+
+5379
+03:15:04,318 --> 03:15:08,0
+11704.319 --> 11708
+contributors
+
+5380
+03:15:05,439 --> 03:15:09,200
+that are very active and working closely
+
+5381
+03:15:08,0 --> 03:15:11,680
+11708 --> 11711.68
+with us
+
+5382
+03:15:09,200 --> 03:15:13,279
+so i've pasted one example in the zoom
+
+5383
+03:15:11,680 --> 03:15:14,960
+group chat
+
+5384
+03:15:13,279 --> 03:15:16,560
+i don't know if maybe it's not visible
+
+5385
+03:15:14,959 --> 03:15:19,119
+to everyone
+
+5386
+03:15:16,559 --> 03:15:20,719
+i can just drop it as an answer here
+
+5387
+03:15:19,120 --> 03:15:24,160
+yeah it's better
+
+5388
+03:15:20,719 --> 03:15:26,79
+so this one is done by cool acid so why
+
+5389
+03:15:24,159 --> 03:15:29,600
+there are so many docker myths
+
+5390
+03:15:26,79 --> 03:15:32,398
+that's i think the the
+
+5391
+03:15:29,600 --> 03:15:35,200
+speciality of docker not everyone agrees
+
+5392
+03:15:32,398 --> 03:15:37,760
+on a model with docker so there are
+
+5393
+03:15:35,200 --> 03:15:39,520
+at least as far as i know four or five
+
+5394
+03:15:37,760 --> 03:15:41,760
+different dockers there's one managed by
+
+5395
+03:15:39,520 --> 03:15:45,40
+dcso one by cool assist
+
+5396
+03:15:41,760 --> 03:15:47,359
+one by xavier mcpens and one by
+
+5397
+03:15:45,40 --> 03:15:48,479
+harvard security and i'm sure i'm
+
+5398
+03:15:47,359 --> 03:15:51,520
+missing some
+
+5399
+03:15:48,478 --> 03:15:54,159
+um so the thing is um for
+
+5400
+03:15:51,520 --> 03:15:55,840
+for the docker images it's depending of
+
+5401
+03:15:54,159 --> 03:15:57,600
+i would say your test
+
+5402
+03:15:55,840 --> 03:15:59,439
+so have a look at what the different
+
+5403
+03:15:57,600 --> 03:16:02,0
+11757.6 --> 11762
+contributors are doing
+
+5404
+03:15:59,439 --> 03:16:02,800
+and you'll see that you pick the one
+
+5405
+03:16:02,0 --> 03:16:05,200
+11762 --> 11765.2
+that is
+
+5406
+03:16:02,799 --> 03:16:06,159
+matching what you really want to do with
+
+5407
+03:16:05,200 --> 03:16:08,720
+docker
+
+5408
+03:16:06,159 --> 03:16:09,359
+some are really more separated container
+
+5409
+03:16:08,719 --> 03:16:11,199
+wise
+
+5410
+03:16:09,359 --> 03:16:12,800
+some are more like one single container
+
+5411
+03:16:11,200 --> 03:16:14,399
+with everything um
+
+5412
+03:16:12,799 --> 03:16:16,79
+again it's a maker of taste and all you
+
+5413
+03:16:14,398 --> 03:16:18,398
+want to to operate one
+
+5414
+03:16:16,79 --> 03:16:19,359
+we don't maintain one as this project
+
+5415
+03:16:18,398 --> 03:16:21,519
+but there are
+
+5416
+03:16:19,359 --> 03:16:24,399
+some that are under our missed project
+
+5417
+03:16:21,520 --> 03:16:24,399
+guitar position
+
+5418
+03:16:27,200 --> 03:16:33,120
+someone is asking about api key to
+
+5419
+03:16:29,920 --> 03:16:33,120
+invoke cortex analyzer
+
+5420
+03:16:33,520 --> 03:16:37,40
+for the cortex analyzer it's a separate
+
+5421
+03:16:36,398 --> 03:16:40,398
+tool set
+
+5422
+03:16:37,40 --> 03:16:44,319
+of part of of the i've project
+
+5423
+03:16:40,398 --> 03:16:46,799
+and then you have specific api keys
+
+5424
+03:16:44,318 --> 03:16:48,879
+cortex extension is like this module so
+
+5425
+03:16:46,799 --> 03:16:51,39
+it works for the expansion services
+
+5426
+03:16:48,879 --> 03:16:52,238
+uh beaker full cortex analyzer are not
+
+5427
+03:16:51,40 --> 03:16:53,840
+supporting
+
+5428
+03:16:52,238 --> 03:16:55,600
+objects and stuff like that which is the
+
+5429
+03:16:53,840 --> 03:16:57,600
+case for its modules
+
+5430
+03:16:55,600 --> 03:16:59,120
+so you might have expansion on the
+
+5431
+03:16:57,600 --> 03:17:01,120
+interface but if you want full-blown
+
+5432
+03:16:59,120 --> 03:17:03,520
+expansion with relationship and so on
+
+5433
+03:17:01,120 --> 03:17:05,359
+then you can use these modules a lot of
+
+5434
+03:17:03,520 --> 03:17:06,800
+organizations are mixing both so you can
+
+5435
+03:17:05,359 --> 03:17:09,359
+have cortex-enabled and
+
+5436
+03:17:06,799 --> 03:17:10,238
+it's modulus enabled on the same missed
+
+5437
+03:17:09,359 --> 03:17:11,680
+instance
+
+5438
+03:17:10,238 --> 03:17:13,920
+but going back to the question if you
+
+5439
+03:17:11,680 --> 03:17:16,159
+already have the cortex api encoded in
+
+5440
+03:17:13,920 --> 03:17:18,960
+your misspen you want to invoke
+
+5441
+03:17:16,159 --> 03:17:20,959
+a lookup uh through the api through misp
+
+5442
+03:17:18,959 --> 03:17:22,238
+then you can use your misspik to tell
+
+5443
+03:17:20,959 --> 03:17:27,438
+your misp to
+
+5444
+03:17:22,238 --> 03:17:29,520
+run a query against cortex
+
+5445
+03:17:27,439 --> 03:17:33,200
+but with the new api key models usually
+
+5446
+03:17:29,520 --> 03:17:33,200
+it's better to have dedicated api
+
+5447
+03:17:35,600 --> 03:17:42,569
+okay um there is something else easy
+
+5448
+03:17:39,680 --> 03:17:44,479
+you know that we had it already um
+
+5449
+03:17:42,569 --> 03:17:46,159
+[Music]
+
+5450
+03:17:44,478 --> 03:17:48,159
+could you touch on how we could use one
+
+5451
+03:17:46,159 --> 03:17:50,639
+event to add multiple attributes and how
+
+5452
+03:17:48,159 --> 03:17:52,398
+would correlation work here uh configure
+
+5453
+03:17:50,639 --> 03:17:53,358
+event one to fetch all records from a
+
+5454
+03:17:52,398 --> 03:17:54,799
+fishing feed
+
+5455
+03:17:53,359 --> 03:17:56,800
+would this work with correlation show
+
+5456
+03:17:54,799 --> 03:17:58,719
+all instances where any of those
+
+5457
+03:17:56,799 --> 03:17:59,759
+attributes match with other events from
+
+5458
+03:17:58,719 --> 03:18:02,799
+other organization
+
+5459
+03:17:59,760 --> 03:18:03,760
+events well okay if i understand it
+
+5460
+03:18:02,799 --> 03:18:06,318
+correctly indeed
+
+5461
+03:18:03,760 --> 03:18:08,318
+so if you if you do that you create an
+
+5462
+03:18:06,318 --> 03:18:09,920
+event for a fishing feed
+
+5463
+03:18:08,318 --> 03:18:11,920
+and you have those attributes in there
+
+5464
+03:18:09,920 --> 03:18:14,879
+and you have cross you have cached
+
+5465
+03:18:11,920 --> 03:18:16,879
+other instances then within that that
+
+5466
+03:18:14,879 --> 03:18:17,519
+feeds event you will see correlations
+
+5467
+03:18:16,879 --> 03:18:19,278
+both to
+
+5468
+03:18:17,520 --> 03:18:21,359
+other events created locally on your
+
+5469
+03:18:19,279 --> 03:18:23,359
+instance by other organizations
+
+5470
+03:18:21,359 --> 03:18:24,720
+as well as links to other instances that
+
+5471
+03:18:23,359 --> 03:18:26,960
+have the
+
+5472
+03:18:24,719 --> 03:18:27,760
+data as long as you have cached those
+
+5473
+03:18:26,959 --> 03:18:29,438
+events
+
+5474
+03:18:27,760 --> 03:18:31,120
+so we're going to talk more about that
+
+5475
+03:18:29,439 --> 03:18:31,840
+tomorrow about the synchronization but
+
+5476
+03:18:31,120 --> 03:18:33,439
+when you're
+
+5477
+03:18:31,840 --> 03:18:34,880
+interconnecting with another instance
+
+5478
+03:18:33,439 --> 03:18:36,639
+you can do it in two ways
+
+5479
+03:18:34,879 --> 03:18:38,398
+one i want to start exchanging data
+
+5480
+03:18:36,639 --> 03:18:40,639
+pushing data pooling data
+
+5481
+03:18:38,398 --> 03:18:42,318
+or two i can just tell my mist to go
+
+5482
+03:18:40,639 --> 03:18:44,799
+crawl that other instance
+
+5483
+03:18:42,318 --> 03:18:46,559
+uh hash all the values that they have
+
+5484
+03:18:44,799 --> 03:18:48,559
+and if i ever get the correlation
+
+5485
+03:18:46,559 --> 03:18:50,79
+then it flags it for me that it shows me
+
+5486
+03:18:48,559 --> 03:18:52,79
+and then that the
+
+5487
+03:18:50,79 --> 03:18:54,238
+instance already knows about this value
+
+5488
+03:18:52,79 --> 03:18:55,920
+and i can pivot over to previewing the
+
+5489
+03:18:54,238 --> 03:18:58,398
+data
+
+5490
+03:18:55,920 --> 03:19:00,79
+so i hope that answers that yeah and
+
+5491
+03:18:58,398 --> 03:19:01,358
+then the correlation of
+
+5492
+03:19:00,79 --> 03:19:03,600
+for example if you just enable the
+
+5493
+03:19:01,359 --> 03:19:05,760
+caching you just see that it's
+
+5494
+03:19:03,600 --> 03:19:08,479
+correlating with specific values without
+
+5495
+03:19:05,760 --> 03:19:09,279
+providing the full fit sometimes it's
+
+5496
+03:19:08,478 --> 03:19:11,519
+it's quite
+
+5497
+03:19:09,279 --> 03:19:13,40
+handy when you have for example see that
+
+5498
+03:19:11,520 --> 03:19:15,920
+you cannot show the data but you can
+
+5499
+03:19:13,40 --> 03:19:15,920
+show the correlation
+
+5500
+03:19:16,159 --> 03:19:19,680
+there's another one do you recommend
+
+5501
+03:19:17,439 --> 03:19:22,398
+using miss palone or using the hive
+
+5502
+03:19:19,680 --> 03:19:22,800
+miss cortex integration i mean generally
+
+5503
+03:19:22,398 --> 03:19:24,478
+yeah
+
+5504
+03:19:22,799 --> 03:19:26,318
+if you need a case management tool then
+
+5505
+03:19:24,478 --> 03:19:29,920
+then using the hive for that is great
+
+5506
+03:19:26,318 --> 03:19:31,439
+and so it makes absolute sense to you to
+
+5507
+03:19:29,920 --> 03:19:33,920
+use them together
+
+5508
+03:19:31,439 --> 03:19:34,880
+and integration is really smoothly done
+
+5509
+03:19:33,920 --> 03:19:36,639
+so that means that
+
+5510
+03:19:34,879 --> 03:19:38,238
+that no matter where you start your your
+
+5511
+03:19:36,639 --> 03:19:40,398
+process whether you start
+
+5512
+03:19:38,238 --> 03:19:41,840
+by creating an event in misp or whether
+
+5513
+03:19:40,398 --> 03:19:44,79
+you start by creating a
+
+5514
+03:19:41,840 --> 03:19:46,0
+11981.84 --> 11986
+case in the hive you can basically
+
+5515
+03:19:44,79 --> 03:19:46,639
+propagate the data to the other tool and
+
+5516
+03:19:46,0 --> 03:19:49,200
+11986 --> 11989.2
+work on
+
+5517
+03:19:46,639 --> 03:19:50,79
+on both tools and data so so yeah
+
+5518
+03:19:49,200 --> 03:19:52,79
+absolutely
+
+5519
+03:19:50,79 --> 03:19:54,559
+yeah absolutely it's pretty smooth just
+
+5520
+03:19:52,79 --> 03:19:56,159
+just be careful if you use the expansion
+
+5521
+03:19:54,559 --> 03:19:58,799
+on mist and you have miss modules
+
+5522
+03:19:56,159 --> 03:20:00,318
+enabled i would prefer to have
+
+5523
+03:19:58,799 --> 03:20:03,199
+modules enabled because you you
+
+5524
+03:20:00,318 --> 03:20:06,318
+basically have all the features of mixed
+
+5525
+03:20:03,200 --> 03:20:08,159
+like relationship objects and so on
+
+5526
+03:20:06,318 --> 03:20:09,439
+with the cortex integration is basically
+
+5527
+03:20:08,159 --> 03:20:11,600
+just the over with
+
+5528
+03:20:09,439 --> 03:20:12,559
+the vortex yeah but one of the things
+
+5529
+03:20:11,600 --> 03:20:14,79
+that you can do is
+
+5530
+03:20:12,559 --> 03:20:16,0
+12012.56 --> 12016
+if you start for example from the hive
+
+5531
+03:20:14,79 --> 03:20:17,279
+perspective and you push the data
+
+5532
+03:20:16,0 --> 03:20:18,799
+12016 --> 12018.8
+afterwards to misp
+
+5533
+03:20:17,279 --> 03:20:20,640
+you can then go through this process
+
+5534
+03:20:18,799 --> 03:20:21,759
+like what we've done here with enriching
+
+5535
+03:20:20,639 --> 03:20:24,159
+the information
+
+5536
+03:20:21,760 --> 03:20:25,760
+creating objects that affect attributes
+
+5537
+03:20:24,159 --> 03:20:27,200
+so you can do it as a secondary step
+
+5538
+03:20:25,760 --> 03:20:28,0
+12025.76 --> 12028
+before you share it out to community to
+
+5539
+03:20:27,200 --> 03:20:30,79
+refine the data
+
+5540
+03:20:28,0 --> 03:20:31,920
+12028 --> 12031.92
+in mis that you've created in the i for
+
+5541
+03:20:30,79 --> 03:20:33,439
+example and the same thing if you've
+
+5542
+03:20:31,920 --> 03:20:34,719
+used cortex to fetch additional
+
+5543
+03:20:33,439 --> 03:20:36,398
+information in the hive
+
+5544
+03:20:34,719 --> 03:20:38,0
+12034.72 --> 12038
+you can then take that data and further
+
+5545
+03:20:36,398 --> 03:20:38,959
+enrich it with miss modules once it's a
+
+5546
+03:20:38,0 --> 03:20:40,959
+12038 --> 12040.96
+message
+
+5547
+03:20:38,959 --> 03:20:42,79
+yeah this is a good question from
+
+5548
+03:20:40,959 --> 03:20:45,278
+muammar
+
+5549
+03:20:42,79 --> 03:20:47,120
+junaid about when i try to import the
+
+5550
+03:20:45,279 --> 03:20:49,40
+data from six to five it's called
+
+5551
+03:20:47,120 --> 03:20:50,880
+lazy like can you please explain that a
+
+5552
+03:20:49,40 --> 03:20:52,640
+bit and this one is interesting
+
+5553
+03:20:50,879 --> 03:20:54,398
+because it's it's i was saying a long
+
+5554
+03:20:52,639 --> 03:20:57,358
+long long discussion and that
+
+5555
+03:20:54,398 --> 03:21:00,0
+12054.399 --> 12060
+that's even influence or miss people
+
+5556
+03:20:57,359 --> 03:21:03,40
+than the standard behind missed
+
+5557
+03:21:00,0 --> 03:21:04,0
+12060 --> 12064
+so sticks is really uh focusing on cyber
+
+5558
+03:21:03,40 --> 03:21:07,279
+security and
+
+5559
+03:21:04,0 --> 03:21:10,318
+12064 --> 12070.319
+cyber studies religion and
+
+5560
+03:21:07,279 --> 03:21:11,920
+the the problem is you might have at
+
+5561
+03:21:10,318 --> 03:21:13,760
+some point in time
+
+5562
+03:21:11,920 --> 03:21:15,120
+data that are basically not defined
+
+5563
+03:21:13,760 --> 03:21:17,760
+anywhere
+
+5564
+03:21:15,120 --> 03:21:20,160
+so it's more for the export of data so
+
+5565
+03:21:17,760 --> 03:21:23,40
+for example if you export in a mixed
+
+5566
+03:21:20,159 --> 03:21:23,439
+event and you have for example an object
+
+5567
+03:21:23,40 --> 03:21:25,520
+with
+
+5568
+03:21:23,439 --> 03:21:28,479
+the person and stuff like that it won't
+
+5569
+03:21:25,520 --> 03:21:31,600
+be in the sticks to export for example
+
+5570
+03:21:28,478 --> 03:21:33,519
+so it means that in misprevent you get
+
+5571
+03:21:31,600 --> 03:21:35,200
+all the information but it's bound to
+
+5572
+03:21:33,520 --> 03:21:36,238
+the limitation of the standards and the
+
+5573
+03:21:35,200 --> 03:21:37,600
+format
+
+5574
+03:21:36,238 --> 03:21:39,520
+where you export and it's exactly the
+
+5575
+03:21:37,600 --> 03:21:42,238
+same for any format i mean if you
+
+5576
+03:21:39,520 --> 03:21:43,760
+um export a person in theory cata format
+
+5577
+03:21:42,238 --> 03:21:46,799
+obviously you don't have any
+
+5578
+03:21:43,760 --> 03:21:47,600
+um field or things like that with person
+
+5579
+03:21:46,799 --> 03:21:49,438
+and so on so
+
+5580
+03:21:47,600 --> 03:21:51,439
+that's why we call it losing because uh
+
+5581
+03:21:49,439 --> 03:21:55,840
+sometimes when you import data
+
+5582
+03:21:51,439 --> 03:21:55,840
+it's bound to a specific set of
+
+5583
+03:21:55,920 --> 03:21:58,960
+fields that are supported and so on
+
+5584
+03:21:58,0 --> 03:22:01,359
+12118 --> 12121.359
+another thing that is
+
+5585
+03:21:58,959 --> 03:22:02,719
+quite important with sticks you might
+
+5586
+03:22:01,359 --> 03:22:05,279
+have a lot of
+
+5587
+03:22:02,719 --> 03:22:06,639
+peculiarities or specialities depending
+
+5588
+03:22:05,279 --> 03:22:08,479
+on the vendor
+
+5589
+03:22:06,639 --> 03:22:09,840
+some vendors are adding some some
+
+5590
+03:22:08,478 --> 03:22:11,679
+specific custom objects
+
+5591
+03:22:09,840 --> 03:22:13,359
+things like that that are not bound to
+
+5592
+03:22:11,680 --> 03:22:15,600
+any existing one
+
+5593
+03:22:13,359 --> 03:22:16,960
+so we are importing them as kind of you
+
+5594
+03:22:15,600 --> 03:22:20,238
+know generic one but
+
+5595
+03:22:16,959 --> 03:22:22,238
+it is basically like uh lucy again so
+
+5596
+03:22:20,238 --> 03:22:23,760
+you have to be careful when you you use
+
+5597
+03:22:22,238 --> 03:22:26,318
+a specific format
+
+5598
+03:22:23,760 --> 03:22:27,40
+to be sure that you properly uh map an
+
+5599
+03:22:26,318 --> 03:22:29,199
+existing
+
+5600
+03:22:27,40 --> 03:22:31,200
+different one so it's more for the
+
+5601
+03:22:29,200 --> 03:22:33,520
+export is quite flexible on that so you
+
+5602
+03:22:31,200 --> 03:22:36,239
+can basically have any object you like
+
+5603
+03:22:33,520 --> 03:22:36,880
+but when we explore for example in 61 we
+
+5604
+03:22:36,238 --> 03:22:39,840
+just
+
+5605
+03:22:36,879 --> 03:22:41,39
+support what is existing in sticks even
+
+5606
+03:22:39,840 --> 03:22:43,359
+if we start we add
+
+5607
+03:22:41,40 --> 03:22:45,840
+some some custom objects too which are
+
+5608
+03:22:43,359 --> 03:22:47,840
+on to the missed object
+
+5609
+03:22:45,840 --> 03:22:49,680
+but some tools will not recognize
+
+5610
+03:22:47,840 --> 03:22:50,79
+obviously the custom object because they
+
+5611
+03:22:49,680 --> 03:22:52,79
+are
+
+5612
+03:22:50,79 --> 03:22:53,840
+just having a profile for a specific set
+
+5613
+03:22:52,79 --> 03:22:56,398
+of known uh updates
+
+5614
+03:22:53,840 --> 03:22:56,960
+yeah i think that's exactly the point uh
+
+5615
+03:22:56,398 --> 03:22:58,238
+that
+
+5616
+03:22:56,959 --> 03:23:00,959
+maybe is different from when we
+
+5617
+03:22:58,238 --> 03:23:02,0
+12178.239 --> 12182
+described the text in those import and
+
+5618
+03:23:00,959 --> 03:23:04,159
+export fields
+
+5619
+03:23:02,0 --> 03:23:06,159
+12182 --> 12186.16
+we say lossy but in reality what we do
+
+5620
+03:23:04,159 --> 03:23:07,119
+is we do try to capture everything and
+
+5621
+03:23:06,159 --> 03:23:08,959
+we do try to map
+
+5622
+03:23:07,120 --> 03:23:10,479
+everything but a lot of it will end up
+
+5623
+03:23:08,959 --> 03:23:13,39
+in custom objects now
+
+5624
+03:23:10,478 --> 03:23:14,959
+now what alex mentioned is the problem
+
+5625
+03:23:13,40 --> 03:23:16,399
+even if we export bitcoin
+
+5626
+03:23:14,959 --> 03:23:18,238
+addresses for example whenever we're
+
+5627
+03:23:16,398 --> 03:23:20,478
+pushing in sticks to format
+
+5628
+03:23:18,238 --> 03:23:21,359
+as custom objects no other two will pick
+
+5629
+03:23:20,478 --> 03:23:23,840
+up on it because
+
+5630
+03:23:21,359 --> 03:23:25,439
+it's if we're just using custom objects
+
+5631
+03:23:23,840 --> 03:23:27,40
+that unless the other two
+
+5632
+03:23:25,439 --> 03:23:28,720
+specifically looks for them they will
+
+5633
+03:23:27,40 --> 03:23:31,120
+just either store it as is
+
+5634
+03:23:28,719 --> 03:23:32,238
+or not know what to do with it yeah and
+
+5635
+03:23:31,120 --> 03:23:35,439
+that
+
+5636
+03:23:32,238 --> 03:23:35,680
+that's why we recommend a feed provider
+
+5637
+03:23:35,439 --> 03:23:38,79
+of
+
+5638
+03:23:35,680 --> 03:23:39,40
+anderson son to actively support the
+
+5639
+03:23:38,79 --> 03:23:41,39
+misformat
+
+5640
+03:23:39,40 --> 03:23:42,840
+then they can they can really impose a
+
+5641
+03:23:41,40 --> 03:23:44,239
+full set of objects and so that already
+
+5642
+03:23:42,840 --> 03:23:46,159
+exists
+
+5643
+03:23:44,238 --> 03:23:47,760
+yeah in some cases however you don't
+
+5644
+03:23:46,159 --> 03:23:49,439
+really care about having the full set
+
+5645
+03:23:47,760 --> 03:23:50,960
+and that's where for example specialized
+
+5646
+03:23:49,439 --> 03:23:53,40
+formats are really cool
+
+5647
+03:23:50,959 --> 03:23:55,199
+so whenever we're feeding for example an
+
+5648
+03:23:53,40 --> 03:23:56,560
+ids for example we don't care about
+
+5649
+03:23:55,200 --> 03:23:59,359
+bitcoin addresses
+
+5650
+03:23:56,559 --> 03:23:59,760
+so in those cases uh so sticks and misp
+
+5651
+03:23:59,359 --> 03:24:04,79
+both
+
+5652
+03:23:59,760 --> 03:24:05,760
+are very expressive uh exchange formats
+
+5653
+03:24:04,79 --> 03:24:07,920
+but whenever you're dealing with feeding
+
+5654
+03:24:05,760 --> 03:24:10,238
+tools for example you don't care about
+
+5655
+03:24:07,920 --> 03:24:11,200
+uh about losing ninety percent even of
+
+5656
+03:24:10,238 --> 03:24:13,680
+the data set
+
+5657
+03:24:11,200 --> 03:24:15,120
+as long as you capture those type of
+
+5658
+03:24:13,680 --> 03:24:17,680
+data points that your tool can
+
+5659
+03:24:15,120 --> 03:24:19,40
+process in the end so this is why
+
+5660
+03:24:17,680 --> 03:24:20,559
+generally what we recommend is if you
+
+5661
+03:24:19,40 --> 03:24:21,200
+have the option for example to export
+
+5662
+03:24:20,559 --> 03:24:23,39
+data from
+
+5663
+03:24:21,200 --> 03:24:24,800
+is for your ideas for your scene and so
+
+5664
+03:24:23,40 --> 03:24:27,359
+on and you have the option between for
+
+5665
+03:24:24,799 --> 03:24:29,519
+example sticks or snort or surikata
+
+5666
+03:24:27,359 --> 03:24:31,279
+go with snorter sturikata because
+
+5667
+03:24:29,520 --> 03:24:33,760
+because those are much more
+
+5668
+03:24:31,279 --> 03:24:35,40
+uh catering to what your two can
+
+5669
+03:24:33,760 --> 03:24:37,200
+actually understand
+
+5670
+03:24:35,40 --> 03:24:40,80
+yeah for example for yards the same you
+
+5671
+03:24:37,200 --> 03:24:41,680
+prefer to have like a good yara who will
+
+5672
+03:24:40,79 --> 03:24:43,279
+say that you can run into another
+
+5673
+03:24:41,680 --> 03:24:44,0
+12281.68 --> 12284
+barista or your endpoint protection
+
+5674
+03:24:43,279 --> 03:24:46,159
+device
+
+5675
+03:24:44,0 --> 03:24:49,840
+12284 --> 12289.84
+and having a generic one that will not
+
+5676
+03:24:46,159 --> 03:24:49,840
+help you to lose the detection
+
+5677
+03:24:52,559 --> 03:24:55,840
+other questions
+
+5678
+03:24:56,79 --> 03:24:59,120
+you already took that one that is there
+
+5679
+03:24:58,639 --> 03:25:00,879
+it is
+
+5680
+03:24:59,120 --> 03:25:03,920
+longer i think we took most of them
+
+5681
+03:25:00,879 --> 03:25:06,238
+unless they missed one
+
+5682
+03:25:03,920 --> 03:25:08,398
+and yeah perhaps we should show the
+
+5683
+03:25:06,238 --> 03:25:09,199
+deletions because we we didn't actually
+
+5684
+03:25:08,398 --> 03:25:11,760
+show it indeed
+
+5685
+03:25:09,200 --> 03:25:11,760
+yeah exactly
+
+5686
+03:25:13,760 --> 03:25:17,40
+okay oh and now we have some more
+
+5687
+03:25:16,79 --> 03:25:20,159
+questions
+
+5688
+03:25:17,40 --> 03:25:22,479
+but we can take those after yeah let's
+
+5689
+03:25:20,159 --> 03:25:23,920
+quickly show the deletions so if we go
+
+5690
+03:25:22,478 --> 03:25:25,199
+to an event
+
+5691
+03:25:23,920 --> 03:25:27,279
+yeah i'll take i'll take a hundred
+
+5692
+03:25:25,200 --> 03:25:30,800
+members so this is a massive
+
+5693
+03:25:27,279 --> 03:25:32,319
+gotcha basic basically missed
+
+5694
+03:25:30,799 --> 03:25:33,840
+uh which we have some protective
+
+5695
+03:25:32,318 --> 03:25:34,799
+measures in place to avoid this but one
+
+5696
+03:25:33,840 --> 03:25:37,439
+of the things that you really need to
+
+5697
+03:25:34,799 --> 03:25:39,759
+watch out for is
+
+5698
+03:25:37,439 --> 03:25:40,479
+when you when you add data to misspen
+
+5699
+03:25:39,760 --> 03:25:42,398
+you notice
+
+5700
+03:25:40,478 --> 03:25:44,238
+oh crap i should not have added a piece
+
+5701
+03:25:42,398 --> 03:25:45,920
+of information that is
+
+5702
+03:25:44,238 --> 03:25:47,359
+either confidential information
+
+5703
+03:25:45,920 --> 03:25:49,520
+information about the victim that i
+
+5704
+03:25:47,359 --> 03:25:51,760
+should share and so on
+
+5705
+03:25:49,520 --> 03:25:53,279
+the attribute that attribute might still
+
+5706
+03:25:51,760 --> 03:25:55,200
+be contained in the event in a
+
+5707
+03:25:53,279 --> 03:25:57,200
+in a soft deleted format you can always
+
+5708
+03:25:55,200 --> 03:26:00,319
+toggle and see the deleted attributes
+
+5709
+03:25:57,200 --> 03:26:00,319
+uh within an event
+
+5710
+03:26:00,879 --> 03:26:05,39
+so i will create i will create an even
+
+5711
+03:26:02,559 --> 03:26:05,39
+from scratch
+
+5712
+03:26:05,840 --> 03:26:10,799
+okay so before i move forward on that so
+
+5713
+03:26:09,200 --> 03:26:13,120
+we have two protective measures in place
+
+5714
+03:26:10,799 --> 03:26:16,799
+to avoid accidental information leakage
+
+5715
+03:26:13,120 --> 03:26:18,479
+violation one is basically that
+
+5716
+03:26:16,799 --> 03:26:20,318
+that by default we do not use the
+
+5717
+03:26:18,478 --> 03:26:21,519
+software method for anything that was
+
+5718
+03:26:20,318 --> 03:26:23,519
+unpublished uh
+
+5719
+03:26:21,520 --> 03:26:24,960
+at first so we're going to show it as an
+
+5720
+03:26:23,520 --> 03:26:25,760
+example so here's some sensitive
+
+5721
+03:26:24,959 --> 03:26:27,599
+information
+
+5722
+03:26:25,760 --> 03:26:30,559
+if alex were to delete this now this
+
+5723
+03:26:27,600 --> 03:26:32,720
+attribute this would get our deleted
+
+5724
+03:26:30,559 --> 03:26:33,920
+so this will not create a soft deletion
+
+5725
+03:26:32,719 --> 03:26:35,760
+uh miss pareto
+
+5726
+03:26:33,920 --> 03:26:37,200
+tells us are you sure you want to hard
+
+5727
+03:26:35,760 --> 03:26:38,318
+delete the attribute so when you read
+
+5728
+03:26:37,200 --> 03:26:40,79
+the text you will see the see the
+
+5729
+03:26:38,318 --> 03:26:42,0
+12398.319 --> 12402
+difference there in the wording
+
+5730
+03:26:40,79 --> 03:26:43,520
+uh the reason for that is the event it
+
+5731
+03:26:42,0 --> 03:26:44,879
+12402 --> 12404.88
+has not been published yet we know that
+
+5732
+03:26:43,520 --> 03:26:46,79
+it has not probably been propagated to
+
+5733
+03:26:44,879 --> 03:26:48,0
+12404.88 --> 12408
+other instances
+
+5734
+03:26:46,79 --> 03:26:50,318
+there is absolutely no reason to inform
+
+5735
+03:26:48,0 --> 03:26:52,159
+12408 --> 12412.16
+anyone that this has been deleted
+
+5736
+03:26:50,318 --> 03:26:54,559
+so we can immediately just hard delete
+
+5737
+03:26:52,159 --> 03:26:56,559
+it so when we do that
+
+5738
+03:26:54,559 --> 03:26:58,238
+it will get hard deleted however if the
+
+5739
+03:26:56,559 --> 03:26:59,840
+event has already been published
+
+5740
+03:26:58,238 --> 03:27:01,760
+this has already been shared out to
+
+5741
+03:26:59,840 --> 03:27:03,920
+other instances potentially
+
+5742
+03:27:01,760 --> 03:27:05,439
+so in this case if we were to delete it
+
+5743
+03:27:03,920 --> 03:27:06,799
+miss will tell us oh
+
+5744
+03:27:05,439 --> 03:27:08,720
+are you sure you want to soft delete
+
+5745
+03:27:06,799 --> 03:27:10,79
+this attribute because this is already a
+
+5746
+03:27:08,719 --> 03:27:12,639
+published event
+
+5747
+03:27:10,79 --> 03:27:14,159
+now it looks like our event is empty but
+
+5748
+03:27:12,639 --> 03:27:15,519
+if you look at the deleted flag you will
+
+5749
+03:27:14,159 --> 03:27:16,318
+see that the sensitive attribute is
+
+5750
+03:27:15,520 --> 03:27:18,479
+still there
+
+5751
+03:27:16,318 --> 03:27:20,478
+and if i were to publish the event now
+
+5752
+03:27:18,478 --> 03:27:22,0
+12438.479 --> 12442
+this sensitive attribute would
+
+5753
+03:27:20,478 --> 03:27:25,39
+it would get propagated along with the
+
+5754
+03:27:22,0 --> 03:27:27,359
+12442 --> 12447.359
+event if you want to avoid this
+
+5755
+03:27:25,40 --> 03:27:29,200
+altogether there is a way to mangle any
+
+5756
+03:27:27,359 --> 03:27:31,680
+attribute that gets self-deleted
+
+5757
+03:27:29,200 --> 03:27:32,800
+what happens in that case is a category
+
+5758
+03:27:31,680 --> 03:27:34,800
+will be set to other
+
+5759
+03:27:32,799 --> 03:27:36,639
+type will be set to other and value will
+
+5760
+03:27:34,799 --> 03:27:38,639
+be set to redacted
+
+5761
+03:27:36,639 --> 03:27:39,920
+this is a server-wide setting so your
+
+5762
+03:27:38,639 --> 03:27:41,519
+administrator or if you are the
+
+5763
+03:27:39,920 --> 03:27:44,318
+administrator and yourself can set this
+
+5764
+03:27:41,520 --> 03:27:46,159
+setting in the server settings
+
+5765
+03:27:44,318 --> 03:27:47,519
+the downside of that is if you are
+
+5766
+03:27:46,159 --> 03:27:49,200
+mangling attributes that you're soft
+
+5767
+03:27:47,520 --> 03:27:51,279
+deleting it will still inform the other
+
+5768
+03:27:49,200 --> 03:27:52,880
+instances they will still
+
+5769
+03:27:51,279 --> 03:27:55,40
+remove the data software the data
+
+5770
+03:27:52,879 --> 03:27:57,278
+because the uid is reserved
+
+5771
+03:27:55,40 --> 03:27:58,239
+however you cannot recover the attribute
+
+5772
+03:27:57,279 --> 03:28:00,238
+anymore so if
+
+5773
+03:27:58,238 --> 03:28:01,760
+so in this case right now we deleted
+
+5774
+03:28:00,238 --> 03:28:02,799
+attribute alex could now click on the
+
+5775
+03:28:01,760 --> 03:28:04,639
+recover button
+
+5776
+03:28:02,799 --> 03:28:06,79
+and the attribute will be recovered as a
+
+5777
+03:28:04,639 --> 03:28:07,920
+normal attribute so if you made a
+
+5778
+03:28:06,79 --> 03:28:11,39
+mistake you can recover it
+
+5779
+03:28:07,920 --> 03:28:12,879
+so there are two different mindsets i
+
+5780
+03:28:11,40 --> 03:28:14,960
+want to make my data recoverable
+
+5781
+03:28:12,879 --> 03:28:17,278
+versus and i want to always inform
+
+5782
+03:28:14,959 --> 03:28:20,79
+others versus i want to always
+
+5783
+03:28:17,279 --> 03:28:21,359
+hard delete data that i delete both of
+
+5784
+03:28:20,79 --> 03:28:23,520
+them have a setting
+
+5785
+03:28:21,359 --> 03:28:25,40
+so just pick and choose which whichever
+
+5786
+03:28:23,520 --> 03:28:27,680
+makes sense for your community
+
+5787
+03:28:25,40 --> 03:28:28,479
+whether you prefer secrecy or prefer
+
+5788
+03:28:27,680 --> 03:28:32,79
+convenience
+
+5789
+03:28:28,478 --> 03:28:34,159
+uh basically so it's basically
+
+5790
+03:28:32,79 --> 03:28:35,200
+yeah that's delete for that review so if
+
+5791
+03:28:34,159 --> 03:28:38,318
+we delete an
+
+5792
+03:28:35,200 --> 03:28:41,120
+event that's another story yeah and this
+
+5793
+03:28:38,318 --> 03:28:42,398
+this one is interesting because now we
+
+5794
+03:28:41,120 --> 03:28:44,640
+have these options where we say
+
+5795
+03:28:42,398 --> 03:28:46,79
+i want to delete this event and
+
+5796
+03:28:44,639 --> 03:28:46,799
+obviously it will be deleted on your
+
+5797
+03:28:46,79 --> 03:28:49,200
+instance
+
+5798
+03:28:46,799 --> 03:28:50,159
+nevertheless this even has been already
+
+5799
+03:28:49,200 --> 03:28:52,159
+synchronized
+
+5800
+03:28:50,159 --> 03:28:53,200
+copy and develop different misc
+
+5801
+03:28:52,159 --> 03:28:54,398
+instances
+
+5802
+03:28:53,200 --> 03:28:56,239
+so that means as the next
+
+5803
+03:28:54,398 --> 03:28:57,39
+synchronizations the event should be
+
+5804
+03:28:56,238 --> 03:28:59,920
+pulled
+
+5805
+03:28:57,40 --> 03:29:01,680
+but to avoid such kind of of issue mist
+
+5806
+03:28:59,920 --> 03:29:05,520
+is automatically generating
+
+5807
+03:29:01,680 --> 03:29:07,359
+a block list of all those elite events
+
+5808
+03:29:05,520 --> 03:29:09,600
+so if you are the administrator you can
+
+5809
+03:29:07,359 --> 03:29:12,238
+see at the block list of events
+
+5810
+03:29:09,600 --> 03:29:13,120
+you can see the the one that i just
+
+5811
+03:29:12,238 --> 03:29:16,238
+deleted
+
+5812
+03:29:13,120 --> 03:29:18,720
+so why we do that it's very simple
+
+5813
+03:29:16,238 --> 03:29:20,238
+we don't want to re-import the event
+
+5814
+03:29:18,719 --> 03:29:21,358
+that has been deleted because luckily we
+
+5815
+03:29:20,238 --> 03:29:23,680
+don't want this event
+
+5816
+03:29:21,359 --> 03:29:25,520
+so it's a it's a block list of all the
+
+5817
+03:29:23,680 --> 03:29:28,720
+cgas
+
+5818
+03:29:25,520 --> 03:29:30,399
+but this this catch there uh sometimes
+
+5819
+03:29:28,719 --> 03:29:31,760
+we have people oh i'm doing some tests
+
+5820
+03:29:30,398 --> 03:29:33,439
+and so on i'm synchronizing with miss
+
+5821
+03:29:31,760 --> 03:29:35,439
+but i can't see my even back
+
+5822
+03:29:33,439 --> 03:29:36,479
+and obviously yes because it's there in
+
+5823
+03:29:35,439 --> 03:29:37,840
+this block list
+
+5824
+03:29:36,478 --> 03:29:39,358
+so if you have some tests and you're
+
+5825
+03:29:37,840 --> 03:29:40,398
+running some tests don't forget to look
+
+5826
+03:29:39,359 --> 03:29:44,159
+at the block list
+
+5827
+03:29:40,398 --> 03:29:46,318
+and maybe you want to just remove
+
+5828
+03:29:44,159 --> 03:29:48,719
+the event for the block keys and then
+
+5829
+03:29:46,318 --> 03:29:50,478
+you can synchronize back the event
+
+5830
+03:29:48,719 --> 03:29:52,559
+there's something to keep in mind it's
+
+5831
+03:29:50,478 --> 03:29:54,79
+there it's done automatically but in
+
+5832
+03:29:52,559 --> 03:29:54,799
+some cases you want to manage the
+
+5833
+03:29:54,79 --> 03:29:58,0
+12594.08 --> 12598
+blockly
+
+5834
+03:29:54,799 --> 03:30:01,519
+so that's something to keep in mind
+
+5835
+03:29:58,0 --> 03:30:04,478
+12598 --> 12604.479
+yep something else
+
+5836
+03:30:01,520 --> 03:30:06,79
+that we perhaps should uh touch on here
+
+5837
+03:30:04,478 --> 03:30:08,799
+is is
+
+5838
+03:30:06,79 --> 03:30:09,760
+for the event deletions besides just a
+
+5839
+03:30:08,799 --> 03:30:11,119
+blockless part
+
+5840
+03:30:09,760 --> 03:30:12,800
+there is one thing that comes up as a
+
+5841
+03:30:11,120 --> 03:30:15,40
+question very often is how do i inform
+
+5842
+03:30:12,799 --> 03:30:16,639
+others that an event needs to be removed
+
+5843
+03:30:15,40 --> 03:30:19,40
+we don't have a mechanism in place for
+
+5844
+03:30:16,639 --> 03:30:21,519
+that so while we can revoke attributes
+
+5845
+03:30:19,40 --> 03:30:23,120
+for events uh we don't have that and
+
+5846
+03:30:21,520 --> 03:30:25,279
+there's a reason for that
+
+5847
+03:30:23,120 --> 03:30:26,239
+in general uh whenever it comes to
+
+5848
+03:30:25,279 --> 03:30:29,200
+events uh
+
+5849
+03:30:26,238 --> 03:30:30,639
+we don't want to give the power to just
+
+5850
+03:30:29,200 --> 03:30:33,439
+outright delete
+
+5851
+03:30:30,639 --> 03:30:34,719
+events uh remotely this way so this
+
+5852
+03:30:33,439 --> 03:30:36,238
+might change in the future
+
+5853
+03:30:34,719 --> 03:30:37,920
+we we're having discussions on that
+
+5854
+03:30:36,238 --> 03:30:40,79
+whether we want to enable that or not
+
+5855
+03:30:37,920 --> 03:30:41,840
+but currently that's not the case yeah
+
+5856
+03:30:40,79 --> 03:30:44,398
+and usually we take as an example
+
+5857
+03:30:41,840 --> 03:30:46,0
+12641.84 --> 12646
+emails i mean you can remove emails from
+
+5858
+03:30:44,398 --> 03:30:47,358
+your personal mailbox but from the
+
+5859
+03:30:46,0 --> 03:30:49,120
+12646 --> 12649.12
+remote mailbox if someone already
+
+5860
+03:30:47,359 --> 03:30:51,279
+receives the emails
+
+5861
+03:30:49,120 --> 03:30:53,120
+you want to have the control over third
+
+5862
+03:30:51,279 --> 03:30:58,79
+parties on the mailbox that
+
+5863
+03:30:53,120 --> 03:31:00,239
+might be one of the drawback i would say
+
+5864
+03:30:58,79 --> 03:31:01,760
+so there are two two new questions one
+
+5865
+03:31:00,238 --> 03:31:03,439
+of them is basically can you demonstrate
+
+5866
+03:31:01,760 --> 03:31:05,200
+the progressive enrichments of events
+
+5867
+03:31:03,439 --> 03:31:06,559
+by the shared communities over time with
+
+5868
+03:31:05,200 --> 03:31:08,960
+correlations
+
+5869
+03:31:06,559 --> 03:31:10,398
+this one is tough i mean i'm not sure
+
+5870
+03:31:08,959 --> 03:31:11,278
+how we could demonstrate that because
+
+5871
+03:31:10,398 --> 03:31:14,159
+we're not dealing with
+
+5872
+03:31:11,279 --> 03:31:14,560
+live instances with live data sets and
+
+5873
+03:31:14,159 --> 03:31:17,279
+act
+
+5874
+03:31:14,559 --> 03:31:17,278
+active sharing
+
+5875
+03:31:17,840 --> 03:31:23,40
+but perhaps for tomorrow we will prepare
+
+5876
+03:31:19,680 --> 03:31:25,520
+an example where we can show it off
+
+5877
+03:31:23,40 --> 03:31:28,640
+when and choose an event that we can
+
+5878
+03:31:25,520 --> 03:31:31,120
+show on one of the operational instances
+
+5879
+03:31:28,639 --> 03:31:33,119
+but i i can't show one on uh you know
+
+5880
+03:31:31,120 --> 03:31:36,560
+what i can't go on
+
+5881
+03:31:33,120 --> 03:31:38,79
+just one thing i'm i'm going on an
+
+5882
+03:31:36,559 --> 03:31:41,760
+instance
+
+5883
+03:31:38,79 --> 03:31:43,760
+okay so so it was
+
+5884
+03:31:41,760 --> 03:31:45,200
+oh we are flexible so it's not super fun
+
+5885
+03:31:43,760 --> 03:31:48,318
+to do it no but
+
+5886
+03:31:45,200 --> 03:31:49,359
+um so it's maybe some some something
+
+5887
+03:31:48,318 --> 03:31:52,0
+12708.319 --> 12712
+interesting there
+
+5888
+03:31:49,359 --> 03:31:52,720
+um so um i'm connecting an instance
+
+5889
+03:31:52,0 --> 03:31:55,760
+12712 --> 12715.76
+where i have
+
+5890
+03:31:52,719 --> 03:31:57,278
+more expansion services uh active and so
+
+5891
+03:31:55,760 --> 03:31:59,200
+on
+
+5892
+03:31:57,279 --> 03:32:01,40
+i'll just keep it for my organization
+
+5893
+03:31:59,200 --> 03:32:05,520
+only so i'm creating
+
+5894
+03:32:01,40 --> 03:32:07,600
+an event there so what happens on
+
+5895
+03:32:05,520 --> 03:32:08,960
+progressively enriching even by shared
+
+5896
+03:32:07,600 --> 03:32:10,479
+communities i mean
+
+5897
+03:32:08,959 --> 03:32:12,159
+it's going back and forth to different
+
+5898
+03:32:10,478 --> 03:32:14,559
+communities but i can i can imitate what
+
+5899
+03:32:12,159 --> 03:32:18,159
+the community is doing usually
+
+5900
+03:32:14,559 --> 03:32:21,600
+so if i'm facing an attribute
+
+5901
+03:32:18,159 --> 03:32:26,398
+for example i will i will say it
+
+5902
+03:32:21,600 --> 03:32:26,399
+hostname with some network activity
+
+5903
+03:32:32,959 --> 03:32:36,879
+so we have specifically a test that we
+
+5904
+03:32:35,680 --> 03:32:39,439
+created with this
+
+5905
+03:32:36,879 --> 03:32:40,559
+kind of thing so what would be your
+
+5906
+03:32:39,439 --> 03:32:41,920
+community and
+
+5907
+03:32:40,559 --> 03:32:43,600
+sharing so it could be for example in
+
+5908
+03:32:41,920 --> 03:32:45,680
+the same organization in my case it's
+
+5909
+03:32:43,600 --> 03:32:48,800
+just clear to the organization so
+
+5910
+03:32:45,680 --> 03:32:50,0
+12765.68 --> 12770
+if i publish event here it will be
+
+5911
+03:32:48,799 --> 03:32:51,519
+shared with
+
+5912
+03:32:50,0 --> 03:32:53,520
+12770 --> 12773.52
+all different instances maybe the
+
+5913
+03:32:51,520 --> 03:32:57,680
+different members of circle
+
+5914
+03:32:53,520 --> 03:33:01,840
+uh and um one of my colleagues
+
+5915
+03:32:57,680 --> 03:33:04,720
+is taking one of the indicators
+
+5916
+03:33:01,840 --> 03:33:05,760
+and then he's going on the far side
+
+5917
+03:33:04,719 --> 03:33:07,599
+database
+
+5918
+03:33:05,760 --> 03:33:09,120
+doing a full-blown expansion so that
+
+5919
+03:33:07,600 --> 03:33:10,159
+means he's basically doing a full-bone
+
+5920
+03:33:09,120 --> 03:33:13,760
+extension
+
+5921
+03:33:10,159 --> 03:33:16,959
+um what do i have here i have a
+
+5922
+03:33:13,760 --> 03:33:18,719
+a complete set of objects for a specific
+
+5923
+03:33:16,959 --> 03:33:22,318
+domain so you see again
+
+5924
+03:33:18,719 --> 03:33:25,39
+i'm going to the event graph
+
+5925
+03:33:22,318 --> 03:33:25,680
+now i enter my domain name and i have
+
+5926
+03:33:25,40 --> 03:33:27,359
+all the
+
+5927
+03:33:25,680 --> 03:33:28,960
+passive dns free curve associated to
+
+5928
+03:33:27,359 --> 03:33:31,760
+that one
+
+5929
+03:33:28,959 --> 03:33:33,199
+and in this one i think i will have the
+
+5930
+03:33:31,760 --> 03:33:35,520
+even timeline i have a completely
+
+5931
+03:33:33,200 --> 03:33:38,960
+different timeline of the different uh
+
+5932
+03:33:35,520 --> 03:33:42,238
+expansion and so on so then i will have
+
+5933
+03:33:38,959 --> 03:33:42,879
+one of my i will it will be published
+
+5934
+03:33:42,238 --> 03:33:45,209
+again
+
+5935
+03:33:42,879 --> 03:33:46,719
+with the uh with the data
+
+5936
+03:33:45,209 --> 03:33:48,879
+[Music]
+
+5937
+03:33:46,719 --> 03:33:50,79
+if it's a collaboration i would say in
+
+5938
+03:33:48,879 --> 03:33:52,799
+the same team
+
+5939
+03:33:50,79 --> 03:33:53,359
+that's a thing so it's sometimes it's
+
+5940
+03:33:52,799 --> 03:33:55,119
+it's
+
+5941
+03:33:53,359 --> 03:33:57,439
+people are working on the same event and
+
+5942
+03:33:55,120 --> 03:33:59,359
+publishing it sometimes they are
+
+5943
+03:33:57,439 --> 03:34:01,359
+sharing it and doing additional
+
+5944
+03:33:59,359 --> 03:34:04,880
+expansion on the uh
+
+5945
+03:34:01,359 --> 03:34:08,79
+on the um things until to reach a
+
+5946
+03:34:04,879 --> 03:34:11,39
+specific point that is like i would say
+
+5947
+03:34:08,79 --> 03:34:12,398
+accessible or at least publishable in a
+
+5948
+03:34:11,40 --> 03:34:16,0
+12851.04 --> 12856
+publishing state that is
+
+5949
+03:34:12,398 --> 03:34:18,318
+acceptable by various people
+
+5950
+03:34:16,0 --> 03:34:19,520
+12856 --> 12859.52
+now we can make proposal too so that
+
+5951
+03:34:18,318 --> 03:34:22,79
+means
+
+5952
+03:34:19,520 --> 03:34:24,880
+if we are again on a different with a
+
+5953
+03:34:22,79 --> 03:34:26,478
+different organization
+
+5954
+03:34:24,879 --> 03:34:28,79
+i don't know if in this example it will
+
+5955
+03:34:26,478 --> 03:34:30,719
+work but i can
+
+5956
+03:34:28,79 --> 03:34:32,879
+take do i have something interesting
+
+5957
+03:34:30,719 --> 03:34:32,879
+there
+
+5958
+03:34:33,760 --> 03:34:37,680
+yeah for example i see an interesting
+
+5959
+03:34:35,359 --> 03:34:37,680
+ipl
+
+5960
+03:34:37,840 --> 03:34:43,840
+this one so what i could do is
+
+5961
+03:34:41,279 --> 03:34:43,840
+i could
+
+5962
+03:34:44,398 --> 03:34:46,719
+add
+
+5963
+03:34:49,600 --> 03:34:52,479
+what's going on here
+
+5964
+03:34:53,40 --> 03:34:57,40
+i will add what
+
+5965
+03:35:04,159 --> 03:35:14,0
+12904.16 --> 12914
+okay just a demo effect
+
+5966
+03:35:10,799 --> 03:35:18,238
+it's a great typical
+
+5967
+03:35:14,0 --> 03:35:18,238
+12914 --> 12918.239
+what's going on here okay
+
+5968
+03:35:19,439 --> 03:35:25,40
+just going back to this one i just want
+
+5969
+03:35:21,600 --> 03:35:28,0
+12921.6 --> 12928
+to add a proposal
+
+5970
+03:35:25,40 --> 03:35:28,0
+12925.04 --> 12928
+yes i cannot just
+
+5971
+03:35:28,959 --> 03:35:35,839
+you wanted but your admin yeah
+
+5972
+03:35:33,200 --> 03:35:36,479
+yeah then i don't you can cheat whether
+
+5973
+03:35:35,840 --> 03:35:38,478
+you
+
+5974
+03:35:36,478 --> 03:35:40,0
+12936.479 --> 12940
+really want you can do it yeah wait fine
+
+5975
+03:35:38,478 --> 03:35:43,39
+it's just like okay so
+
+5976
+03:35:40,0 --> 03:35:44,799
+12940 --> 12944.8
+i i don't know for for hong kong if we
+
+5977
+03:35:43,40 --> 03:35:47,840
+answer your question but i mean
+
+5978
+03:35:44,799 --> 03:35:49,519
+a full-blown step would be like that if
+
+5979
+03:35:47,840 --> 03:35:50,559
+you work on an event it's not a single
+
+5980
+03:35:49,520 --> 03:35:52,399
+person obviously
+
+5981
+03:35:50,559 --> 03:35:54,238
+when you do an investigation you do like
+
+5982
+03:35:52,398 --> 03:35:54,799
+multiple steps but the question is more
+
+5983
+03:35:54,238 --> 03:35:56,879
+like
+
+5984
+03:35:54,799 --> 03:35:58,799
+if you do it within a team usually you
+
+5985
+03:35:56,879 --> 03:36:00,0
+12956.88 --> 12960
+edit the current even the same
+
+5986
+03:35:58,799 --> 03:36:03,519
+organizations
+
+5987
+03:36:00,0 --> 03:36:05,760
+12960 --> 12965.76
+if you do enter team you do proposal
+
+5988
+03:36:03,520 --> 03:36:07,680
+extend it even like we showed before and
+
+5989
+03:36:05,760 --> 03:36:09,359
+then you start to work on this uh
+
+5990
+03:36:07,680 --> 03:36:11,279
+thing so it's here depending on the case
+
+5991
+03:36:09,359 --> 03:36:13,600
+so uh
+
+5992
+03:36:11,279 --> 03:36:15,680
+so i hope you can you can you can see
+
+5993
+03:36:13,600 --> 03:36:18,318
+what are the capabilities there but it's
+
+5994
+03:36:15,680 --> 03:36:20,398
+really uh the progressive approach of
+
+5995
+03:36:18,318 --> 03:36:22,559
+collaboration usually depends of
+
+5996
+03:36:20,398 --> 03:36:24,478
+how people are working together if they
+
+5997
+03:36:22,559 --> 03:36:25,680
+are really external it's more proposal
+
+5998
+03:36:24,478 --> 03:36:28,79
+extended event
+
+5999
+03:36:25,680 --> 03:36:29,279
+if it's within the same team it could be
+
+6000
+03:36:28,79 --> 03:36:31,439
+extended event
+
+6001
+03:36:29,279 --> 03:36:33,920
+or within the same event that's usually
+
+6002
+03:36:31,439 --> 03:36:37,120
+the two way of working
+
+6003
+03:36:33,920 --> 03:36:39,680
+if you want to add something no yeah
+
+6004
+03:36:37,120 --> 03:36:39,680
+that's perfect
+
+6005
+03:36:39,760 --> 03:36:43,279
+perhaps another question if you're okay
+
+6006
+03:36:42,639 --> 03:36:46,719
+with
+
+6007
+03:36:43,279 --> 03:36:48,0
+13003.279 --> 13008
+switching yeah when speaking of feeding
+
+6008
+03:36:46,719 --> 03:36:49,840
+tools what would be the automatic
+
+6009
+03:36:48,0 --> 03:36:51,120
+13008 --> 13011.12
+way of doing it so normally when we're
+
+6010
+03:36:49,840 --> 03:36:52,639
+talking about feeding tools there are
+
+6011
+03:36:51,120 --> 03:36:54,720
+two separate ways of doing it and we'll
+
+6012
+03:36:52,639 --> 03:36:56,159
+go way way deeper into this tomorrow
+
+6013
+03:36:54,719 --> 03:36:58,238
+when we talk about integration but
+
+6014
+03:36:56,159 --> 03:36:58,959
+generally tools can either fetch data
+
+6015
+03:36:58,238 --> 03:37:00,559
+from miss
+
+6016
+03:36:58,959 --> 03:37:02,799
+so this is a more common way where a
+
+6017
+03:37:00,559 --> 03:37:05,119
+tool would use rest search api that we
+
+6018
+03:37:02,799 --> 03:37:07,278
+mentioned before where you define yours
+
+6019
+03:37:05,120 --> 03:37:09,40
+your search patterns for example give me
+
+6020
+03:37:07,279 --> 03:37:12,159
+everything that is newer than
+
+6021
+03:37:09,40 --> 03:37:12,880
+30 days everything that uh that contains
+
+6022
+03:37:12,159 --> 03:37:15,760
+at least
+
+6023
+03:37:12,879 --> 03:37:16,398
+that is not coming from say oh since the
+
+6024
+03:37:15,760 --> 03:37:18,719
+sources
+
+6025
+03:37:16,398 --> 03:37:19,599
+or perhaps not something nothing that
+
+6026
+03:37:18,719 --> 03:37:21,760
+comes
+
+6027
+03:37:19,600 --> 03:37:23,520
+uh related to a certain topic for
+
+6028
+03:37:21,760 --> 03:37:25,600
+example i'm not interested in ransomware
+
+6029
+03:37:23,520 --> 03:37:26,399
+when feeding my tools just a stupid
+
+6030
+03:37:25,600 --> 03:37:28,640
+example
+
+6031
+03:37:26,398 --> 03:37:30,159
+so you set up your filter options and
+
+6032
+03:37:28,639 --> 03:37:32,318
+then your tool would fetch
+
+6033
+03:37:30,159 --> 03:37:33,680
+data from misp every 60 minutes for
+
+6034
+03:37:32,318 --> 03:37:36,159
+example
+
+6035
+03:37:33,680 --> 03:37:37,359
+and then replace the data set there you
+
+6036
+03:37:36,159 --> 03:37:40,318
+can also do
+
+6037
+03:37:37,359 --> 03:37:42,79
+sliding time window searches where you
+
+6038
+03:37:40,318 --> 03:37:43,760
+say give me everything from the past 60
+
+6039
+03:37:42,79 --> 03:37:45,359
+minutes that is new
+
+6040
+03:37:43,760 --> 03:37:48,0
+13063.76 --> 13068
+and then you keep concatenating your
+
+6041
+03:37:45,359 --> 03:37:49,40
+data set on the seam side ids side
+
+6042
+03:37:48,0 --> 03:37:51,200
+13068 --> 13071.2
+whatever tool you're
+
+6043
+03:37:49,40 --> 03:37:52,880
+feeding the alternative if you want to
+
+6044
+03:37:51,200 --> 03:37:53,680
+have the data push automatically as it
+
+6045
+03:37:52,879 --> 03:37:55,199
+comes in
+
+6046
+03:37:53,680 --> 03:37:57,40
+you have different channels and mist
+
+6047
+03:37:55,200 --> 03:37:58,560
+that your tools can latch on to
+
+6048
+03:37:57,40 --> 03:38:00,720
+the downside being that you still need
+
+6049
+03:37:58,559 --> 03:38:03,199
+to do the conversion
+
+6050
+03:38:00,719 --> 03:38:04,959
+in those cases so if you were not using
+
+6051
+03:38:03,200 --> 03:38:08,159
+the
+
+6052
+03:38:04,959 --> 03:38:11,199
+the apis to fetch the data from bisp
+
+6053
+03:38:08,159 --> 03:38:11,680
+then mis can push using the miss json
+
+6054
+03:38:11,200 --> 03:38:13,680
+format
+
+6055
+03:38:11,680 --> 03:38:16,0
+13091.68 --> 13096
+data down via different channels serum
+
+6056
+03:38:13,680 --> 03:38:16,0
+13093.68 --> 13096
+queue
+
+6057
+03:38:16,79 --> 03:38:19,760
+or the kafka channel or this blog and so
+
+6058
+03:38:19,279 --> 03:38:21,279
+on
+
+6059
+03:38:19,760 --> 03:38:23,40
+and then your tools automatically feed
+
+6060
+03:38:21,279 --> 03:38:24,0
+13101.279 --> 13104
+on that data so you have these two
+
+6061
+03:38:23,40 --> 03:38:26,399
+different
+
+6062
+03:38:24,0 --> 03:38:27,520
+13104 --> 13107.52
+ways of interacting with it there's also
+
+6063
+03:38:26,398 --> 03:38:28,959
+a third way
+
+6064
+03:38:27,520 --> 03:38:31,760
+where you can basically either build an
+
+6065
+03:38:28,959 --> 03:38:34,0
+13108.96 --> 13114
+export module or an enrichment module
+
+6066
+03:38:31,760 --> 03:38:35,760
+where an analyst can trigger a direct
+
+6067
+03:38:34,0 --> 03:38:38,559
+13114 --> 13118.56
+push of a certain data point
+
+6068
+03:38:35,760 --> 03:38:39,920
+to another tool so that's another option
+
+6069
+03:38:38,559 --> 03:38:41,840
+we'll talk about these different
+
+6070
+03:38:39,920 --> 03:38:45,199
+strategies when to use which
+
+6071
+03:38:41,840 --> 03:38:49,199
+which and how to mix those tomorrow more
+
+6072
+03:38:45,199 --> 03:38:52,399
+so i hope that answers it in a
+
+6073
+03:38:49,199 --> 03:38:54,159
+brief fashion yeah what i'm showing here
+
+6074
+03:38:52,398 --> 03:38:57,840
+is it's just like
+
+6075
+03:38:54,159 --> 03:38:59,359
+on the on the rest uh search client
+
+6076
+03:38:57,840 --> 03:39:01,760
+for example you want to feed your your
+
+6077
+03:38:59,359 --> 03:39:04,800
+storikata and so on uh just
+
+6078
+03:39:01,760 --> 03:39:09,840
+take page um
+
+6079
+03:39:04,799 --> 03:39:09,840
+on a specific limit
+
+6080
+03:39:13,359 --> 03:39:17,199
+so what you can do is if you have a
+
+6081
+03:39:15,600 --> 03:39:19,120
+python script and so on you can pull
+
+6082
+03:39:17,199 --> 03:39:22,159
+directly the data so
+
+6083
+03:39:19,120 --> 03:39:23,199
+the rest client so you see in this case
+
+6084
+03:39:22,159 --> 03:39:26,159
+i have the
+
+6085
+03:39:23,199 --> 03:39:26,880
+shurikata rule set but if you want to
+
+6086
+03:39:26,159 --> 03:39:29,359
+feed your
+
+6087
+03:39:26,879 --> 03:39:31,358
+specific tools and and so on uh
+
+6088
+03:39:29,359 --> 03:39:34,960
+automatically we are generating
+
+6089
+03:39:31,359 --> 03:39:36,399
+uh curl and python card so it could be a
+
+6090
+03:39:34,959 --> 03:39:38,639
+bootstrap to see okay
+
+6091
+03:39:36,398 --> 03:39:41,119
+how should i create my own tool for
+
+6092
+03:39:38,639 --> 03:39:42,639
+feeding my ideas and so on uh for for
+
+6093
+03:39:41,120 --> 03:39:44,399
+study cata for example
+
+6094
+03:39:42,639 --> 03:39:45,840
+a lot of management interface have
+
+6095
+03:39:44,398 --> 03:39:47,760
+already missed connector
+
+6096
+03:39:45,840 --> 03:39:49,120
+so you can even like feed the data
+
+6097
+03:39:47,760 --> 03:39:51,600
+directly from
+
+6098
+03:39:49,120 --> 03:39:52,319
+the from the interface if they have the
+
+6099
+03:39:51,600 --> 03:39:54,720
+ability
+
+6100
+03:39:52,318 --> 03:39:56,639
+splunk for example there's a specific
+
+6101
+03:39:54,719 --> 03:40:00,79
+application
+
+6102
+03:39:56,639 --> 03:40:02,799
+which is an external tools part of the
+
+6103
+03:40:00,79 --> 03:40:04,79
+app store of splunk that you can install
+
+6104
+03:40:02,799 --> 03:40:05,759
+for doing the connection
+
+6105
+03:40:04,79 --> 03:40:08,639
+and some other people are using their
+
+6106
+03:40:05,760 --> 03:40:12,159
+own python script to feed other cm
+
+6107
+03:40:08,639 --> 03:40:14,238
+so again it's a matter of taste
+
+6108
+03:40:12,159 --> 03:40:16,0
+13212.16 --> 13216
+if you are curious about the different
+
+6109
+03:40:14,238 --> 03:40:18,79
+kind of integrations
+
+6110
+03:40:16,0 --> 03:40:20,79
+13216 --> 13220.08
+or you can do it in python for example
+
+6111
+03:40:18,79 --> 03:40:24,79
+in on payments
+
+6112
+03:40:20,79 --> 03:40:26,478
+itself there are plenty of examples
+
+6113
+03:40:24,79 --> 03:40:28,959
+so if you go in the example directory of
+
+6114
+03:40:26,478 --> 03:40:28,959
+palmist
+
+6115
+03:40:30,799 --> 03:40:38,0
+13230.8 --> 13238
+you have a quite significant
+
+6116
+03:40:34,799 --> 03:40:41,438
+set of default scripts
+
+6117
+03:40:38,0 --> 03:40:43,40
+13238 --> 13243.04
+that you can use uh and that's uh
+
+6118
+03:40:41,439 --> 03:40:46,159
+i think usually a good basis if you want
+
+6119
+03:40:43,40 --> 03:40:48,720
+to start to to write your own custom
+
+6120
+03:40:46,159 --> 03:40:49,520
+custom tool set for for feeding your
+
+6121
+03:40:48,719 --> 03:40:51,278
+feeding
+
+6122
+03:40:49,520 --> 03:40:53,920
+systems or existing software in your
+
+6123
+03:40:51,279 --> 03:40:53,920
+infrastructure
+
+6124
+03:40:57,199 --> 03:41:03,760
+yep um
+
+6125
+03:41:01,680 --> 03:41:05,359
+i don't know if it's if we should jump
+
+6126
+03:41:03,760 --> 03:41:07,600
+on a new topic or we just push the
+
+6127
+03:41:05,359 --> 03:41:10,479
+copalos example for tomorrow
+
+6128
+03:41:07,600 --> 03:41:12,79
+yeah i think i think uh we can we can do
+
+6129
+03:41:10,478 --> 03:41:14,398
+it maybe tomorrow i think
+
+6130
+03:41:12,79 --> 03:41:15,920
+if we can i think that would be
+
+6131
+03:41:14,398 --> 03:41:17,519
+stretching it a little bit if we were to
+
+6132
+03:41:15,920 --> 03:41:21,40
+start with that yeah
+
+6133
+03:41:17,520 --> 03:41:22,0
+13277.52 --> 13282
+so um quick quick summary of today so
+
+6134
+03:41:21,40 --> 03:41:25,40
+today we we
+
+6135
+03:41:22,0 --> 03:41:26,79
+13282 --> 13286.08
+show uh how to create an event the basis
+
+6136
+03:41:25,40 --> 03:41:28,319
+of misplay
+
+6137
+03:41:26,79 --> 03:41:29,840
+what is an attribute an object and so on
+
+6138
+03:41:28,318 --> 03:41:32,959
+how to create it so to
+
+6139
+03:41:29,840 --> 03:41:34,79
+make proposal delete uh and and and
+
+6140
+03:41:32,959 --> 03:41:36,238
+stuff like that
+
+6141
+03:41:34,79 --> 03:41:37,840
+so it's really a simple example tomorrow
+
+6142
+03:41:36,238 --> 03:41:40,639
+we want to show you
+
+6143
+03:41:37,840 --> 03:41:42,639
+more the uh even report aspect and the
+
+6144
+03:41:40,639 --> 03:41:45,439
+automatic imports into
+
+6145
+03:41:42,639 --> 03:41:46,879
+into mist with a practical example of an
+
+6146
+03:41:45,439 --> 03:41:49,920
+ocean report
+
+6147
+03:41:46,879 --> 03:41:51,438
+and we will discuss tomorrow about
+
+6148
+03:41:49,920 --> 03:41:53,40
+how to build sharing communities and
+
+6149
+03:41:51,439 --> 03:41:55,840
+especially we will share
+
+6150
+03:41:53,40 --> 03:41:57,279
+our experience of things that worked and
+
+6151
+03:41:55,840 --> 03:41:59,520
+things that didn't work
+
+6152
+03:41:57,279 --> 03:42:01,359
+uh in the past years when creating
+
+6153
+03:41:59,520 --> 03:42:03,40
+sharing communities so if you are
+
+6154
+03:42:01,359 --> 03:42:04,479
+isaac members or creating your own
+
+6155
+03:42:03,40 --> 03:42:05,600
+sharing community even within your
+
+6156
+03:42:04,478 --> 03:42:07,39
+organization
+
+6157
+03:42:05,600 --> 03:42:09,40
+uh it's it's something good to
+
+6158
+03:42:07,40 --> 03:42:10,560
+participate because you we will share
+
+6159
+03:42:09,40 --> 03:42:12,479
+with you some some of the things that
+
+6160
+03:42:10,559 --> 03:42:14,238
+are interesting of building a
+
+6161
+03:42:12,478 --> 03:42:17,519
+bootstrapping such kind of
+
+6162
+03:42:14,238 --> 03:42:19,279
+of community um
+
+6163
+03:42:17,520 --> 03:42:20,800
+i don't know honestly you want to add
+
+6164
+03:42:19,279 --> 03:42:24,319
+something no
+
+6165
+03:42:20,799 --> 03:42:25,920
+and that's basically it thanks for
+
+6166
+03:42:24,318 --> 03:42:27,278
+everyone for sticking through
+
+6167
+03:42:25,920 --> 03:42:29,120
+through this it's a very condensed
+
+6168
+03:42:27,279 --> 03:42:30,880
+session so
+
+6169
+03:42:29,120 --> 03:42:32,560
+we said we didn't make as much progress
+
+6170
+03:42:30,879 --> 03:42:33,920
+as we hoped so we have quite a bit left
+
+6171
+03:42:32,559 --> 03:42:37,198
+for tomorrow
+
+6172
+03:42:33,920 --> 03:42:39,120
+and hope to see you all here tomorrow
+
+6173
+03:42:37,199 --> 03:42:40,800
+thank you very much uh take care and
+
+6174
+03:42:39,120 --> 03:42:43,279
+don't hesitate to ask questions
+
+6175
+03:42:40,799 --> 03:42:44,318
+uh either later on directly contact us
+
+6176
+03:42:43,279 --> 03:42:48,79
+thank you very much
+
+6177
+03:42:44,318 --> 03:42:48,79
+see you tomorrow thank you all see you
+
+6178
+03:42:49,318 --> 03:42:52,318
+tomorrow
\ No newline at end of file