Threat Findings

Feature Summary

InsightCloudSec Threat Findings is a multi-cloud capability that curates runtime threat detections from customer resources. Threat Findings provides a single view that collects all runtime threat detection findings from various sources. The unified view provides various filtering options, while offering security context by associating the findings with the relevant cloud resource(s) and resource properties. This uniform solution allows users to explore findings using filters and Bot automation.

Feature Terminology

Feature Support

Threat Findings is available to all InsightCloudSec users from the main navigation under “Security → Threat Findings”.

For its initial release Threat Findings will display information from the following third party sources:

• AWS Guard Duty
• Azure Defender for Cloud
• GCP Security Command Center

Future iterations will expand the data we support and display.

Prerequisites & Deployment

Threat Findings relies on the data that is harvested for InsightCloudSec from each Cloud Service Provider you have configured. Before getting started with Threat Findings you will need to ensure you have the following:

• An existing InsightCloudSec installation (version 22.4.8 or later)
• Appropriate permissions for your desired Cloud Service Providers. In order to harvest the resource information specific to Threat Findings you will need the specified permissions for the Resource Type(s) (e.g. Threat Finding) identified below. *Note: These may already be enabled/configured within your environment as part of your existing platform installation. For general information on policies/roles/permissions for each CSP refer to:
  • Details on AWS
  • Details on Azure
  • Details on GCP

Refer to the details below to validate the individual permissions for each Cloud Service Provider (CSP)

AWS Resource Type & Required Permissions

ResourceType.THREAT_FINDING: 
 "guardduty:GetFindings",
 "guardduty:ListDetectors",
 "guardduty:ListFindings",

Azure Resource Type & Required Permissions

ResourceType.THREAT_FINDING: 
  "Microsoft.Security/alerts/read"

GCP Resource Type & Required Permissions

ResourceType.THREAT_FINDING: 
 "securitycenter.sources.list",
 "securitycenter.findings.list"

Using Threat Findings

The main Thread Findings page displays a list of Threat Findings (with a total and percentage displayed at the top), and the top bar of navigation tools include search, and filtering.

General Navigation

The page displays a list of Threat Findings (with a total and percentage displayed at the top), and the top bar of navigation tools include search, and filtering.

Search

Allows you to search the Threat Findings data for the following fields: Finding Source, Finding Type, Severity, Affected Resource Type, Affected Resource ID. Additional fields will be included in search in future versions.

Filtering

The filtering capability included with Threat Findings allows you to select additive filters for various finding attributes (Finding Type, Finding Name, Finding Badge, Cloud Type, etc.) and will dynamically assign properties applicable to the attribute selected.

Users can apply additional conditions for specified filters and add additional filters to further refine the data that is displayed.

“Apply” will activate when the selected filters are populated. To exit the Filters window without applying any filters click “Esc” on your keyboard.

Pagination/Items per Page

Located at the bottom of the main Threat Findings display you can adjust the total number of items displayed on a single page and page through the full list of Threat Finding results.

Main Data Display

Viewing Threat Findings Data

The main Threat Findings view includes the columns Event Source, Finding Type, Count, Severity, Cloud Account, Resource Name & ID, Resource Type, and Last Seen. The view can be sorted ascending/descending on any of these columns.

Event Source

Identifies the source of the Threat Finding. For this current release only third-party CSP sources are supported.

Finding Type

Identifies the Finding Type and links to expanded data.

Clicking on the link for an individual Finding Type opens a detail pane that contains additional detail for that finding, as well as a JSON display/download option.

Count

Provides a count of the findings for the event source.

Severity

Identifies the severity of the Threat Finding (e.g. High, Medium, Low). Severities are determined by data reported through the individual 3rd-party severity information.

Resource Name & ID

Displays the Resource Name and ID. Clicking on the individual Resource ID opens the detailed resource view. This view contains the option to download the source data as well as a tabbed view (Properties, Public Access, Insight Findings, Thread Findings, etc.) Note: tabs for each resource vary based on type.

Resource Type

Displays the Resource Type, for example Instance or Serviceaccesskey.

Last Seen

Provides the time the Threat Finding was last seen. This will vary based on when the data was last harvested.

Threat Findings and Automation (Bots)

InsightCloudSec supports the ability to build automation around notifications through our Bot capability out-of-the-box with Threat Findings. Users can export findings to SIEM (e.g. Splunk) or generate notifications for a specific scope of findings to an specific email or Slack channel.

Your Bot can be scoped with two resource types associated with Threat Findings.

• The Threat Findings resource and the Resource(s) (e.g., EC2 instances) on which a Threat Finding as been identified.

For more details about Bot configuration refer to our documentation on BotFactory & Automation. In general Bots can be created in one of three ways:

• From the BotFactory landing page via the “Create Bot” button
• From an Insight
• Through a template as outlined below (InsightCloudSec does not have out-of-the-box Bot templates but this section includes two examples below.)

1. To use the templates below from your InsightCloudSec platform installation navigate to "Automation --> BotFactory".

2. To import one of the templates on the BotFactory landing page, navigate to "Templates".

3. From the "Templates" tab under BotFactory select the "Import Template" option and paste one of the two examples featured above into the JSON window.

4. Click "Submit" to complete the creation of your new Bot.