InsightCloudSec Threat Findings is a multi-cloud capability that curates runtime threat detections from customer resources. Threat Findings provides a single view that collects all runtime threat detection findings from various sources. The unified view provides various filtering options, while offering security context by associating the findings with the relevant cloud resource(s) and resource properties. This uniform solution allows users to explore findings using filters and Bot automation.
|Threat Finding||A data item refers to the detection of a possible malicious behavior. The finding may refer to a specific event occurring at a specific point in time or a behavior that spans a period of time.|
Note: Data for reporting in Threat Findings is retained for 90 days.
|Affected Resource||The cloud resource that is affected by the malicious behavior. The resource may be the one that presents the malicious behavior or the one that is the target of the behavior.|
|Finding Source||The tool or mechanism generating the findings|
Threat Findings is available to all InsightCloudSec users from the main navigation under “Security → Threat Findings”.
For its initial release Threat Findings will display information from the following third party sources:
- AWS Guard Duty
- Azure Defender for Cloud
- GCP Security Command Center
Future iterations will expand the data we support and display.
Threat Findings relies on the data that is harvested for InsightCloudSec from each Cloud Service Provider you have configured. Before getting started with Threat Findings you will need to ensure you have the following:
- An existing InsightCloudSec installation (version 22.4.8 or later)
- Appropriate permissions for your desired Cloud Service Providers. In order to harvest the resource information specific to Threat Findings you will need the specified permissions for the Resource Type(s) (e.g. Threat Finding) identified below. *Note: These may already be enabled/configured within your environment as part of your existing platform installation. For general information on policies/roles/permissions for each CSP refer to:
Refer to the details below to validate the individual permissions for each Cloud Service Provider (CSP)
ResourceType.THREAT_FINDING: "guardduty:GetFindings", "guardduty:ListDetectors", "guardduty:ListFindings",
ResourceType.THREAT_FINDING: "securitycenter.sources.list", "securitycenter.findings.list"
The main Thread Findings page displays a list of Threat Findings (with a total and percentage displayed at the top), and the top bar of navigation tools include search, and filtering.
The page displays a list of Threat Findings (with a total and percentage displayed at the top), and the top bar of navigation tools include search, and filtering.
Allows you to search the Threat Findings data for the following fields: Finding Source, Finding Type, Severity, Affected Resource Type, Affected Resource ID. Additional fields will be included in search in future versions.
The filtering capability included with Threat Findings allows you to select additive filters for various finding attributes (Finding Type, Finding Name, Finding Badge, Cloud Type, etc.) and will dynamically assign properties applicable to the attribute selected.
Users can apply additional conditions for specified filters and add additional filters to further refine the data that is displayed.
“Apply” will activate when the selected filters are populated. To exit the Filters window without applying any filters click “Esc” on your keyboard.
Located at the bottom of the main Threat Findings display you can adjust the total number of items displayed on a single page and page through the full list of Threat Finding results.
The main Threat Findings view includes the columns Event Source, Finding Type, Count, Severity, Cloud Account, Resource Name & ID, Resource Type, and Last Seen. The view can be sorted ascending/descending on any of these columns.
Identifies the source of the Threat Finding. For this current release only third-party CSP sources are supported.
Identifies the Finding Type and links to expanded data.
Clicking on the link for an individual Finding Type opens a detail pane that contains additional detail for that finding, as well as a JSON display/download option.
Provides a count of the findings for the event source.
Identifies the severity of the Threat Finding (e.g. High, Medium, Low). Severities are determined by data reported through the individual 3rd-party severity information.
Displays the Resource Name and ID. Clicking on the individual Resource ID opens the detailed resource view. This view contains the option to download the source data as well as a tabbed view (Properties, Public Access, Insight Findings, Thread Findings, etc.) Note: tabs for each resource vary based on type.
Displays the Resource Type, for example Instance or Serviceaccesskey.
Provides the time the Threat Finding was last seen. This will vary based on when the data was last harvested.
InsightCloudSec supports the ability to build automation around notifications through our Bot capability out-of-the-box with Threat Findings. Users can export findings to SIEM (e.g. Splunk) or generate notifications for a specific scope of findings to an specific email or Slack channel.
Your Bot can be scoped with two resource types associated with Threat Findings.
- The Threat Findings resource and the Resource(s) (e.g., EC2 instances) on which a Threat Finding as been identified.
For more details about Bot configuration refer to our documentation on BotFactory & Automation. In general Bots can be created in one of three ways:
- From the BotFactory landing page via the “Create Bot” button
- From an Insight
- Through a template as outlined below (InsightCloudSec does not have out-of-the-box Bot templates but this section includes two examples below.)
1. To use the templates below from your InsightCloudSec platform installation navigate to "Automation --> BotFactory".
2. To import one of the templates on the BotFactory landing page, navigate to "Templates".
3. From the "Templates" tab under BotFactory select the "Import Template" option and paste one of the two examples featured above into the JSON window.
- Click "Submit" to complete the creation of your new Bot.
Updated 7 days ago