As recent attacks targeting sensitive, personal information at a number of high-profile institutions have demonstrated, it is not a matter of if, but when you will have to investigate a security breach. The law enforcement and intelligence communities are increasingly called upon to investigate and mitigate cyberthreats, often applying the same tools and meticulous techniques they have developed over decades.

By moving beyond the reactive, day-to-day operations of the security operations center (SOC) and the hundreds of offenses that are generated daily by various security information and event management (SIEM) tools, more skilled analysts can dive deeper to investigate specific offenses, hunt for threats based on current threat intelligence and known threat actors, test out hypotheses, and proactively look for vulnerabilities and indicators of compromise (IoCs). This type of investigation requires analysts to bring together disparate data sources to gain a better understanding of what is happening, what has happened and the overall sequence of events.

The Tedious Task of Threat Analysis

The task of data collection, curation and loading can be time-consuming and laborious. An analyst may need to write scripts in a variety of tools and languages to gather data from systems or read a number of threat intelligence reports to gain insights about campaigns occurring that day. They might then need to load this data into manual analysis tools to look for patterns, trends and outliers. It can take as much time to collect, normalize and correlate the data as it does to analyze it.

Quickly, the task becomes more about data curation, which is too large a task to carry out for all but the biggest incidents in the largest institutions. But this needn’t be the case. By utilizing investigative analysis software, organizations can come to grips with their investigations, conduct more thorough analyses and proactively hunt for threats.

A Proactive Strategy to Mitigate Cyberthreats

An organization might initially start this journey by looking for threats not typically picked up in the day-to-day operations of the SOC, such as latent threat discovery, campaign analysis or even pattern recognition. By bringing together a few data sets, such as SIEM data, threat intelligence from both open source and commercial vendors, internal investigation data and potentially some basic open source intelligence (OSINT), an organization can identify and mitigate cyberthreats lurking on their networks.

By applying enterprise intelligence tools to techniques already used by many fraud and criminal investigation units around the globe, security professionals can move from data collection and curation to threat analysis and investigation in a collaborative, organizationwide manner. This can ultimately feed back into your security policies, rules and automation to further protect your organization and allow your teams to focus their efforts on proactive protection and threat hunting.