Feature Summary

InsightCloudSec Threat Findings is a multi-cloud capability that curates runtime threat detections from customer resources. Threat Findings provides a single view that collects all runtime threat detection findings from various sources. The unified view provides various filtering options, while offering security context by associating the findings with the relevant cloud resource(s) and resource properties. This uniform solution allows users to explore findings using filters and Bot automation.

Feature Terminology

Term	Description
Threat Finding	A data item refers to the detection of a possible malicious behavior. The finding may refer to a specific event occurring at a specific point in time or a behavior that spans a period of time.
Affected Resource	The cloud resource that is affected by the malicious behavior. The resource may be the one that presents the malicious behavior or the one that is the target of the behavior.
Finding Source	The tool or mechanism generating the findings

Feature Support

Beginning with InsightCloudSec 22.4.8, Threat Findings will be available to all InsightCloudSec users under “Security → Threat Findings”.

For our initial release Threat Findings will display information from the following third party sources:

AWS Guard Duty
Azure Defender for Cloud
GCP Security Command Center

Future iterations will continue to expand the data we support and display.

Prerequisites & Deployment

Threat Findings relies on the data that is harvested for InsightCloudSec for each Cloud Service Provider you have configured. Before getting started with Threat Findings you will need to ensure you have the following:

An existing InsightCloudSec installation (version 22.4.8 or later)
Appropriate permissions for your desired Cloud Service Providers. In order to harvest the resource information specific to Threat Findings you will need the specified permissions for the Resource Type(s) (e.g. Threat Finding) identified below. *Note: These may already be enabled/configured within your environment as part of your existing platform installation. For general information on policies/roles/permissions for each CSP refer to:

Refer to the details below to validate the individual permissions for each Cloud Service Provider (CSP)

AWS Resource Type & Required Permissions

ResourceType.THREAT_FINDING: 
 "guardduty:GetFindings",
 "guardduty:ListDetectors",
 "guardduty:ListFindings",

Azure Resource Type & Required Permissions

ResourceType.THREAT_FINDING: 
  "Microsoft.Security/alerts/read"

GCP Resource Type & Required Permissions

ResourceType.THREAT_FINDING: 
 "securitycenter.sources.list",
 "securitycenter.findings.list"

Using Threat Findings

Thread Findings is located under the Security section of InsightCloudSec’s global navigation.

The page displays a list of Threat Findings (with a total displayed at the top), and the top bar of navigation tools include search, and filtering.

General Navigation

The page displays a list of Threat Findings (with a total displayed at the top), and the top bar of navigation tools include search, and filtering.

Search

Allows you to search the Threat Findings data for the following fields: Finding Source, Finding Type, Severity, Affected Resource Type, Affected Resource ID. Additional fields will be included in search in future versions.

Filtering

The filtering capability included with Threat Findings allows you to select additive filters for various finding attributes (Finding Type, Finding Name, Finding Badge, Cloud Type, etc.) and will dynamically assign properties applicable to the attribute selected.

Users can apply additional conditions for specified filters and add additional filters to further refine the data that is displayed.

“Apply” will activate when the selected filters are populated. To exit the Filters window without applying any filters click “Esc” on your keyboard.

Pagination/Items per Page

Located at the bottom of the main Threat Findings display you can adjust the total number of items displayed on a single page and page through the full list of Threat Finding results.

Main Data Display

Viewing Threat Findings Data

The main Threat Findings view includes the columns Event Source, Finding Type, Resource ID & Type, Time, and Severity. The view can be sorted ascending/descending on any of these columns.

Event Source

Identifies the source of the Threat Finding. For this current release only third-party CSP sources are supported.

Finding Type

Identifies the Finding Type and links to expanded data.

Clicking on the link for an individual Finding Type opens a detail pane that contains additional detail for that finding, as well as a JSON display/download option.

1998 — Threat Findings - JSON Detail Example

Resource ID & Type

Displays the Resource ID and type. Clicking on the individual Resource ID opens the detailed resource view. This view contains the option to download the source data as well as a tabbed view (Properties, Public Access, Insight Findings, Thread Findings, etc.) Note: tabs for each resource vary based on type.

1990 — Threat Finding - Resource Detail Example

Time

Provides the time the Threat Finding was discovered. This will vary based on when the data was last harvested.

Severity

Identifies the severity of the Threat Finding (e.g. High, Medium, Low). Severities are determined by data reported through the individual 3rd-party severity information.

Threat Findings and Automation (Bots)

InsightCloudSec supports the ability to build automation around notifications through our Bot capability out-of-the-box with Threat Findings. Users can exporting findings to SIEM (e.g. Splunk) or generate notifications for a specific scope of findings to an specific email or Slack channel.

Your Bot can be scoped with two resource types associated with Threat Findings.

The Threat Findings resource and the Resource(s) (e.g., EC2 instances) on which a Threat Finding as been identified.

For more details about Bot configuration refer to our documentation on BotFactory & Automation. In general Bots can be created in one of three ways:

From the BotFactory landing page via the “Create Bot” button
From an Insight
Through a template as outlined below (InsightCloudSec does not have out-of-the-box Bot templates but this section includes two examples below.)

1. To use the templates below from your InsightCloudSec platform installation navigate to "Automation --> BotFactory".

2. To import one of the templates on the BotFactory landing page, navigate to "Templates".

3. From the "Templates" tab under BotFactory select the "Import Template" option and paste one of the two examples featured above into the JSON window.

Click "Submit" to complete the creation of your new Bot.