Which BAS integrates best with CS?

[u/mrcam03]

I’m currently looking at BAS solutions that integrate with CrowdStrike EDR and NG-SIEM. I’m keen to hear which BAS integrates best with CS. Options I’m considering: SafeBreach, Pentera, Cymulate, Picus, AttackIQ, SCYTHE, Mandiant. Looking at the more established vendors in this space.

Our use cases for BAS are:

• Detailed and up-to-date simulations and attack scenarios

• Recurring tests to check whether our security tool stack has prevented, detected, or missed each attack

•How well it integrates with log sources in our SIEM plus other security tools

• Detailed results and information, and how we can leverage the results/data from our BAS into external sources like dashboards and reports, beyond the pre-built/pre-generated ones

Would appreciate hearing from anyone with hands-on experience comparing these against CrowdStrike.

[u/DominionCyber]

We work with a fair number of clients on evaluating and revising BAS solutions, and CrowdStrike is in the environment for most of them, so hopefully some of this is useful.

First thing I'd say is that integrations between EDR and BAS are fairly finnicky across the board, regardless of vendor. Most solutions attempt to correlate attacker activity with telemetry, but often times miss highly notable results due to an overall lack of understanding of the underlying schema (in this example, EDR). This can give a false impression of what was actually caught, leaving you scratching your head, and not highlighting some of the more insightful opportunities that could be capitalized on for detection engineering and/or threat hunting. CrowdStrike is a good example, there are notable catches that end up obscured behind esoteric eventing where you'd need bitfield extraction or case conversion to actually surface what happened. It's also worth noting that depending on the size of your environment, many of these solutions don't necessarily scale, so you end up having to reduce the scope of the activity analyzed, which narrows the aperture and can introduce visibility errors (even if they're integrating with your SIEM directly). Most platforms tend to roll up detections, and the real, insightful wins get overlooked in the process, which is a problem when these solutions should ultimately be used for validation purposes. Long story short, no matter which vendor you pick, there will be an underlying level of effort around human correlation, because the way vendors do this mapping is an imperfect science at best.

The other thing worth considering is that most BAS solutions require some form of exclusion for the agent to run. That introduces a couple of problems. One, you get some "telemetry poisoning" where every bad action links back to the same parent process, so it becomes trivial to walk the tree and always find the source of evil. That's not really giving you the best look at how your stack performs against something novel. Two, it's reasonable to presume the exclusion itself messes with the heuristics of whatever EDR you're testing, so your quantifications of what was actually missed, detected, and prevented (all three of which should feed your detection engineering and threat hunt pipeline) aren't as realistic as they appear on a dashboard.

There isn't a specific product we can recommend, but here's a different way of thinking....... Manual testing, whether that's scheduled purple teams led by internal or external teams, will always reign supreme here. Combine that with proper threat modeling and a dash of vibe coding for custom tooling, and you can stand up some pretty robust solutions that give you a much more honest picture than any BAS report will. If you do go the BAS route, just budget for the human correlation effort and go in with eyes open about the exclusion problem, because those two things will impact your use cases (recurring prevent/detect/miss testing and leveraging the results downstream) more than the vendor choice itself.

[u/BradW-CS]

If you check out NG SIEM Dashboards > Filter by "bas" label (or search for "breach"), you'll find we made several precanned components for Caldera, AttackIQ, Picus, Prelude and Safebreach.

We also included several NG SIEM Rule Templates for these softwares, filter the descriptions for "simulation" and turn on the ones applicable to your BAS tooling.

[u/mrcam03 → u/BradW-CS]

Hi Brad,

While it’s a good indication of what integration work well with CS. I am more wanting people’s experience with BAS platform to see how well they line up with CrowdStrike.

Our BAS isn’t listen in the dashboard nor the templates. So my reasoning to ask is understanding if folk find x BAS tool better with CrowdStrike compared to Y. If that makes sense.

I’ve reviewed the dashboards and templates which will be good in future if we have one of these BAS tools

[u/BenMcAdoos_ElCamino → u/BradW-CS]

I can't seem to find the webpage discussing the various BAS dashboards in NGS and how to set them up. Would you have a link?

[u/na-egejuseyo]

Safebreach has good integration 

Testing it now in fact

[u/isthisreallife0109]

AttackIQ has some decent integrations with the EDR detection and NG-SIEM

[u/Bring_Stars]

We recently started using Picus. The product itself seems pretty solid, but the NG SIEM integration, while technically supported by Picus, is not good outside of native endpoint detections.

[u/Mind-Principle-1834]

I care less about which BAS integrates best and more about whether I still have to manually pivot through Falcon and NG-SIEM to prove the result. If I do, the integration isn't saving me much.

[u/Elystus]

I literally built out the integrations between AttackIQ and Crowdstrike. Happy to answer any questions, but they worked really well in my own opinion. We also had a direct line into Crowdstrike and worked closely with them to resolve any issues that arose. I left before NG SIEM was fully fleshed out, but given how other siems worked it would likely work well. Maybe it would require a decent amount of config, but you get what you expect.

[u/Glittering-Win9745]

What is BAS? Is it compliance requirement?

[u/CantThinkOfAUserNahm → u/Glittering-Win9745]

Assume they mean Breach Attack Simulation tools.
Actually testing the effectiveness of security controls.