ReversingLabs File Enrichment API for Microsoft Sentinel

The modern security operations center (SOC) team requires high levels of agility and accuracy to detect and respond to the latest threats. To further empower the SOC in this objective, ReversingLabs has introduced the File Enrichment API for Microsoft Sentinel offer in the Azure Marketplace.

This solution, powered by ReversingLabs TitaniumCloud, allows Microsoft Sentinel users to automatically obtain threat classification and rich context on file hash entities from a repository of tens of billions of files. This will provide users a high level of confidence in classifying a program, file, or object as goodware, malware, or unknown status. Integrating with Microsoft Sentinel's deep visibility and automation features enhances the efficiency of SOC teams.

Why Automate Enrichment?

Speed is everything when it comes to reducing the impact of an attacker in your environment. For reference, it takes an average of four hours for the QuantumLocker group to go from initial access to data encryption and eight days if they decide to exfiltrate your data. Meanwhile, IBM’s Cost of a Data Breach report (2022) found that it takes an average of 207 days for an organization to identify a data breach.

How can a SOC keep up with attackers that move this quickly? The best answer is to reduce the amount of analyst toil via automation. The use of “toil” in this post was initially defined in Google’s SRE handbook as any type of work that is: manual, repetitive, automatable, tactical, has no enduring value, and scales linearly as a service grows. Iman Ghanizada and Anton Chuvakin, both of Google, adapt this concept for the SOC in their paper “Autonomic Security Operations — 10X Transformation of the Security Operations Center”. Among other great recommendations for applying Google’s SRE lessons, they make a point to have an “automate-first” mindset. This generally means using SOAR to automate away analyst toil.

Your average SOC deals with dozens, even hundreds of alerts per day. Many of those alerts are probably missing context for the associated indicators that could help an analyst quickly decide whether or not there’s an actual threat, such as whether or not an IP address is known to be used by threat actors or if a file is goodware or malware. The analyst has to jump between tools to perform lookups and conduct additional analysis on those indicators. This is a massive waste of time, and any analyst will tell you it is one of the most tedious parts of the job.

Using automation via a SOAR platform slashes the time spent dealing with this “toil.” Rather than spending several minutes of legwork trying to see if an alert indicator is malicious, implementing a SOAR playbook that automatically enriches the alert with this additional context means the analyst only needs to spend a few seconds checking the resulting output. This empowers your analysts by allowing them to spend more time on real threats instead of wasting time closing out yet another false positive.