Use Case: Triage Incidents Based-on Enrichment from Threat Intelligence

 

Scenario

A Security Operations Center (SOC) analyst should examine the assigned alerts and incidents to determine if an actual action is required. Use the information in the incident-related alerts to direct the procedure. In order to better understand what to do next, contextual information should be gathered frequently. Now, one can decide whether to escalate or resolve the issue after fully comprehending the underlying alerts and gaining insight from the involved entities. 

Steps

• Start with Security Copilot. Retrieve the latest assigned Microsoft Defender XDR incident and summarize the alerts associated with it.

Prompt used:

What is the latest active Defender incident assigned to me ? Summarize it, including the alerts associated with it. 

• Focus in on specific entities to get more information about them. 

Prompt used:

Elaborate on the details of this alert including the entities involved. 

• Get more information to guide next steps. What type of actions might be next for someone with her credentials ? 

Prompt used:

Tell me more about the user entity. 

• Use a saved hunting query to correlate entities with Sentinel incidents.

Manually activate the suggested prompt for the Natural language to Sentinel KQL plugin to run the query. 

• Pivot the investigation to the SAP incident associated with the user from the original alert. 

Prompt used:

Elaborate on Sentinel incident and give details about the entities. 

• Find out more about the IP address entity and examine how it was determined to be malicious. (if any).

Prompt used:

Give me more details about the IP address and why is it malicious ?

• Create a summary report. 

Saved time in the escalation process with a summary for leadership and incident response teams.

Prompt used:

Write a report based on this investigation. Lead with your assessment of the original Defender incident and whether the threat of credential theft is real. Conclude your assessment on how that threat relates to the Sentinel incident regarding the file downloaded to a malicious IP. 

• Pin the most useful prompts responses and edit the session name.

You have reached your goal and determined the assigned Microsoft Defender XDR incident is a real threat. By linking it to a Microsoft Sentinel incident involving an exfiltrated SAP file, you can prepare to collaborate with your escalation team. 

Conclusion

In this use case, Security Copilot aided in the prompt triage of an assigned incident. By looking into related incidents we verified that the alert called for actual action. An incident involving an IP entity connected to completed intelligence regarding the threat actor and C2 tool utilized was discovered as a result of hunt. We provided the escalation team with the information they needed to respond efficiently by sharing the session and a summary report on a concise pin board.