Attack Sequences - Skyhawk Security

Understand the slow, “under the radar” activities that attackers are using over days, weeks, or months,
to compromise your organization’s cloud

Sequenced Chain of Events

Correlated activities that showcase how an organization’s cloud is being compromised

Malicious Behavior Indicators

Key activities that deviate from normal activities and behaviors within your cloud environment

Real Threats Yield Realerts

Activities that are actually compromising your business

Realert Attack Sequence Process:

Step 1: Logs are analyzed to create a baseline of normal behavior for your cloud including how the infrastructure is used, how the applications behave, and how users behave in the environment.
Step 2: Logs are analyzed against the baseline to detect anomalies and threats.
Step 3: Interesting behaviors are flagged and an MBI is raised as an anomaly or one-off.
Step 4: The MBIs are correlated into an attack sequence and the sequence overall score is constantly monitored. Once the score reaches a threshold it is flagged as a realert.
Step 5: Known risky behaviors are identified and corrected, when possible, based on response designed by the Security Operations Team.

Respond to the highest priority alerts and understand where in the attack sequence the
threat actors are, in order to remediate the solution completely and comprehensively.

How Can Sequences Help You?

Avoid alert fatigue and respond to realerts: The attack sequence links together individual activities and scores the risk to clearly demonstrate that a threat in the environment needs to be addressed.
Complete overview of attack progression: Sequences show each step and the time between steps, so the SOC can better understand how attackers are behaving in their environment.
Get control back: Remove the teams’ frustration with chasing every little issue (that turns out to be a non-issue 99% of the time).

BACK TO PLATFORM

The Attack Sequence

Eliminate alert fatigue with “Realerts” and respond only to sequential activities
that represent actual threats to your business