SIEM/SOC Assessment

Your challenges

• Making sure your security monitoring and detection system detects actual threats
• How to reduce the number of false positives that lead to genuine threats being overlooked
• Striking the right balance between sensitivity (catching every possible threat) and specificity (avoiding false alarms)

How we support you

Detection relies on use cases to find relevant anomalies. A use case could be: ‘alert us when a large amount of data is transferred outside of office hours.’ These rules are meant to detect typical adversarial behavior.

Secura’s Red Team members and pentesters know exactly how to mimic adversarial behavior. To test your capabilities, our experts execute use cases one-by-one. Together with your team or your provider’s team, our experts verify that the alerts are correctly triggered. Any missing alert is analyzed in detail and a root cause is determined if possible.

To trigger use cases, Secura simulates a security event happening inside your network, often without actually performing the activity that would have normally raised that event. This could be for instance by sending attack signatures over the network, or by performing suspicious actions on servers.

Case Study: 70% of TTPs missed

Secura executed a SIEM/SOC test at a client in the public sector. They use a third party detection provider and contacted us because they had a feeling they were missing events and alerts.

Our experts executed approximately 10 high-level use cases in an interactive session, by simulating the corresponding security events and dozens of tactics, techniques, and procedures (TTPs).

In this case, our experts found that only 30% of TTPs covered by the client's use cases were actually detected, even though the related security events were registered correctly. Many critical TTPs were not detected, such as lateral movement, AD hash dumping, privilege escalation and EDR/MDR deactivation.

During analysis sessions, we were able to pinpoint and fix (many of) the issues together with the SOC team. A retest confirmed that the issues had indeed been fixed correctly. The client's detection capabilities were dramatically improved.