Log Analysis and SIEM Queries

The Triage Process

Tier 1 analysts review every alert using a structured process: (1) Read the alert — what rule fired? (2) Pull context — what is the source IP, user, hostname? (3) Search for related events — what else was this host doing? (4) Classify — true positive, false positive, or inconclusive? (5) Escalate to Tier 2 if suspicious. The goal is making this decision in 5-10 minutes per alert. Playbooks standardize the process.

Threat Intelligence Enrichment

Raw alerts gain meaning from threat intelligence. Enrich IP addresses with VirusTotal, AbuseIPDB, Shodan, and MISP. Enrich file hashes with VirusTotal and MalwareBazaar. Enrich domains with passive DNS (Farsight DNSDB, VirusTotal). MISP (Malware Information Sharing Platform) and OpenCTI are open-source TI platforms for managing and correlating IOCs across your organization.

MITRE ATT&CK Framework

MITRE ATT&CK is a knowledge base of adversary tactics, techniques, and sub-techniques observed in real attacks. It is organized by tactics (the 'why': Initial Access, Execution, Persistence, Privilege Escalation...) and techniques (the 'how': Spearphishing Link, PowerShell, Scheduled Task...). Mapping your detections to ATT&CK identifies coverage gaps and helps communicate threat context to management.

import requests

VT_API_KEY = 'your_virustotal_api_key'
ABUSE_API_KEY = 'your_abuseipdb_api_key'

def enrich_ip(ip: str) -> dict:
    results = {}
    
    # VirusTotal
    vt_url = f'https://www.virustotal.com/api/v3/ip_addresses/{ip}'
    r = requests.get(vt_url, headers={'x-apikey': VT_API_KEY})
    if r.status_code == 200:
        data = r.json()['data']['attributes']
        results['vt_malicious'] = data['last_analysis_stats']['malicious']
        results['vt_country'] = data.get('country', 'unknown')
    
    # AbuseIPDB
    abuse_url = 'https://api.abuseipdb.com/api/v2/check'
    r = requests.get(abuse_url,
        headers={'Key': ABUSE_API_KEY, 'Accept': 'application/json'},
        params={'ipAddress': ip, 'maxAgeInDays': 90})
    if r.status_code == 200:
        data = r.json()['data']
        results['abuse_score'] = data['abuseConfidenceScore']
        results['abuse_reports'] = data['totalReports']
    
    return results

# Example enrichment
result = enrich_ip('8.8.8.8')
print(result)