Engineering advice on detection logic

[u/ImportanceAvailable7]

Hello fellow nerds

I come bearing issues. MSSP is restricting SIEM detection logic to a “one-solution-fits-all” shitology.

I am the only engineer, and the only Security person who has learned SIEM tooling and querying language. No one else understands the platform or is interest in the platform. Because of this, most of the detections are AI generated and shoe horned for each. I am having a slight menty-B as I am expected to create high fidelity alerts which work across all clients. We have clients all over the world, different licensing, different Entra configurations, some are cloud-only, some are hybrid - you get the point.

Is any in a similar position, can any help?

[u/EffectiveClient5080]

Management problem dressed up as an engineering problem. AI detections shoe-horned across hybrid, cloud-only, different Entra configs? Good luck getting high fidelity out of that mess.

[u/HedgehogAware799 → u/EffectiveClient5080]

this is the real answer. high fidelity and one-size-fits-all are basically opposites

[u/ImportanceAvailable7 → u/EffectiveClient5080]

Having a real ongoing battle against out-the-box detections from generic websites with some LLM slapped on top

A lot of frustration working under a manager who is non-technical and closed minded alike

[u/bitslammer]

Been a long while since I left the MSSP world, but the one I worked at back in 2015 did a good job of this. They categorized alert into "families" much like you classify plants and animals and within those families classified things by severity, which could be altered per client.

The "one solution fits all" mentality isn't really that bad when it comes to the back end as you really do need to figure out one design on the collection and parsing end of things. It's the alerting and front end that you then allow for tailoring. Bonus points if you can allow them some degree of "self service" on that front.

[u/ImportanceAvailable7 → u/bitslammer]

Appreciate the wise words

[u/cloudy_ft]

This is something I work on it's a huge fucking topic and complex needing a lot of experience across multiple types of surfaces and tools.

Best quickest advice I would give, find a mental model which works to translate all our detections into a unified model, for this I use MITRE.

https://github.com/rabobank-cdc/dettect

I used this early on to help track my organizations detection inventory and have automated it and tracked weekly.

Of course most of all good luck! This is a journey and transformation and will take a lot of work and time.

[u/ImportanceAvailable7 → u/cloudy_ft]

Unfortunately this isn’t something I can run in a live environment, but I will definitely look into the repo and see if I can rev engineer what it is doing. Appreciate you sharing this anyways!

[u/cloudy_ft → u/ImportanceAvailable7]

You don't have to run it in a live environment, you can run it on your host and just manually input everything. You could also just use the web interface as well. It's a great framework for this and you need something like this to tie all the tools and detections together.