Spectra Assure Free Trial
Get your 14-day free trial of Spectra Assure for Software Supply Chain Security
Get Free TrialMore about Spectra Assure Free Trial
Enrichment example in Splunk.
Enrichment example in Palo Alto XSOAR
Rich context refers to the additional information and insights that help security analysts better understand and respond to threats. Here are some key aspects:
Attribution: Information about who is behind the threat, such as specific threat actors or groups and their known tactics, techniques, and procedures (TTPs).
Geolocation: Data about the threat's geographic origin can help understand regional threat landscapes and targeting patterns.
Historical Data: Past occurrences of similar threats, including timelines and activity patterns, can indicate whether a threat is part of a more extensive campaign.
Associated Indicators: Related threat indicators, such as IP addresses, domains, file hashes, and URLs, can help identify the scope and scale of the threat.
Behavioral Analysis: provides insights into how the threat behaves, including its propagation methods, payloads, and potential impact on systems and networks.
Reputation Scores: Ratings or scores that indicate the trustworthiness or maliciousness of an entity based on aggregated data from various sources.
Consistent formatting is a crucial feature of file enrichment. For example, malware is highlighted in red, good files are in green, and suspicious files are in yellow. While color marketing may seem obvious if your operators must go through several decision processes to make formatting consistent, human error and stress will cause them to make mistakes.
Automating most incident reporting in a consistent format will significantly reduce human error, speed up mitigation, and reduce operator fatigue.
Hash (SHA256) | 2ac4f0f16f41a4e9cf031d8186534e8a668ecfff484d85c171ac4b7d9c89e6 |
|---|---|
Status | MALICIOUS |
Status Description | The sample was classified as malicious by ReversingLabs proprietary algorithms. This classification is reserved for high-accuracy heuristics and named threats, such as Emotet, Dridex and WannaCry. Threat severity is expressed through the threat level value on a scale of 1-5. The higher the value, the more severe the threat. |
Threat Name | ByteCode-MSIL.Trojan.RedLine |
Threat Level | 5 |
Reason | antivirus - the sample was classified by the ReversingLabs multi-scan algorithm based on aggregated antivirus scan results |
File Details | This file (SHA1: dc278e5f402923b7305f361df7a7ed427daf75a) is a 32-bit portable executable |
Scanner Detection | 23 of 25 scanners detected this file |
Example of a well-formatted incident in Microsoft Sentinel
ReversingLabs' pre-built integrations and flexible REST API allow customers to seamlessly integrate with existing security tools and workflows.
For further information, technical details, and documentation on the ReversingLabs integrations, see https://www.reversinglabs.com/integrations.
Get even more insights in this ON DEMAND WEBINAR: Do More With Your SOAR | Enhance Your SOC With RL Threat Intelligence Enrichment
With this integration, Rubrik users can now tap ReversingLabs' ransomware feed to decide whether each file in their backup is safe.
This guide compares leading file security tools across connector coverage, throughput, file-size range, and file-type breadth.
Package managers auto-pull the latest OSS version — malware included. Protect your pipelines with this free plugin.