Back
Cyber Threat 22 May 2024

National Security Cyber threat

Author: Gerry Baron
Author Gerry Baron
National Security Cyber threat

The Problem

Newly established national cyber threat monitoring services with lots of data and little insight

A major western country was establishing a national cyber monitoring service to help protect critical national infrastructure. This was a major challenge in establishing a service quickly as foreign cyber attacks had become more and more of an issue. There was lots of data available, lots of technology in existing areas of government but it was incredibly hard for them to generate insights that were useful and actionable in organizations that they supported.

The Solution

Siren with big data correlations across all these cyber threat feeds

The client was already an Elasticsearch user and had maintained a large cluster for storing feeds for search purposes. The Siren system was easily implemented by installing the Siren Federate plugin into the existing cluster. This allowed the client to configure a simple data model in Siren to enable cross index joins in their Elasticsearch cluster. This allowed the client to implement the Mitre Att&ck ontology and alerting feed, among others. The client is able to use Siren dataspaces to run multiple parallel, securely partitioned investigations on the same dataset at the same time.

The Outcome

A coherent investigative tool for cyber analysts

The cyber analysts in the agency now have a single desktop in Siren to search, investigate and run graph analytics to identify key threats to critical infrastructure. Multiple data feeds are now fused together with the Siren data model. There is now a consistent investigative process in dealing with threats, how they are detected, alerted on and creation of intelligence reports.

OTHER AREAS

Explore our topics

Close