With that, there’s no better date than Guy Fawkes Day to focus on the state of cybersecurity in the United Kingdom.

A Comprehensive Approach to British Cybersecurity

The UK’s National Cyber Security Centre (NCSC) was established in 2016 as the cyber arm of GCHQ with the intention of “making the UK the safest place to live and work online.” The organisation’s mission is to also “reduce the harm from cybersecurity incidents in the UK” via incident management and response.

According to the NCSC’s third annual review, the United Kingdom is taking an increasingly active and comprehensive approach to protecting organisations and users. The report describes the British cybersecurity strategy as revolving around the government’s ability to constantly share threat indicators with organizations as “active defense”.

Automating British Cyber Threat Intelligence

The UK is also looking to expand its cyber defense strategy using automation to improve its cyber threat intelligence and information sharing capabilities. For example, Operation Haulster automates the flagging of credit card fraud in the UK. The operation automatically flagged fraud on over one million stolen credit cards last year alone.

As a result, the NCSC’s Incident Management Team can now detect and stop threats in their tracks in a matter of seconds while threat intel is timely, as opposed to a matter of hours.

This new level of automation also gives the team greater visibility into where threats are coming from and who they may be targeting. For the first time ever this year, the NCSC was able to report on which sectors needed the most support. Government, higher education, IT, managed service providers and healthcare topped the list.

Conclusion

As cybercriminals continue to develop more sophisticated ways to steal data and dupe unsuspecting victims, remember, remember to stay safe online.

Learn more about how you can proactively detect malware and protect your users and data via DNS. Visit the Infoblox website or start your free trial of Infoblox’s subscription-based cybersecurity solution today.

Here’s an overview of this type of malware, how it works, and how organizations can stay protected online.

What is a RAT (remote access Trojan)?

A remote access Trojan (RAT) is a dangerous malware program that enables covert surveillance or unauthorized access to any victim’s computer or network anywhere in the world. Unlike legal remote administration tools, RATs are typically installed onto a computer or network without the victim’s knowledge. They are primarily distributed through email attachments or user-requested program downloads, such as games. This backdoor gives an attacker complete control over that computer or network, making it possible for an intruder to monitor user behavior, access and exfiltrate sensitive information, establish a botnet, take screenshots and more.

Common RATs to Hunt

Many RATs have been dominating cybersecurity headlines recently. These are just some of the well-known RATs observed by Infoblox’s Cyber Intelligence Unit.

Remcos RAT

Remcos (remote control and surveillance) RAT emerged in 2016 and is still widely used by cybercriminals today. The Infoblox Cyber Intelligence Unit recently observed Remcos being distributed via phishing email using a simplified delivery tactic. Remcos has advanced surveillance and capabilities, including ScreenLogger, audio capture, and webcam capture. It’s a popular choice for targeting Windows operating systems because it is easy for threat actors to use and control.

FlawedAmmyy RAT

Infoblox Cyber Intelligence Unit recently observed a malicious email campaign that distributed the new AndroMut malware downloader, which then dropped the FlawedAmmyy RAT to targeted victims in South Korea. Spam emails, mostly written in Korean, were sent out referencing financial quotes or invoices and carrying an attached .doc or .xls file. Once the file opened and macros were enabled, the file downloaded AndroMut, which then downloaded FlawedAmmyy. The FlawedAmmyy RAT has also been used since at least 2016, allowing threat actors to gain access to infected computers and steal credentials, files, and other data.

Adwind RAT

Infoblox also observed a malicious email campaign distributing the Adwind RAT. These emails spoofed a notification about a commercial invoice and referenced “images of shipping documents,” while containing a malicious JAR file attachment. Adwind is a Malware-as-a-Service (MaaS) platform that first appeared in 2012. It can log keystrokes, access webcams and record video, steal cryptocurrency wallet keys and VPN certificates, download and execute files, and more. Because it is a Java-based malware, Adwind can run on any operating system that supports Java Runtime Environment.

Detecting and Exterminating RATS

RATs are typically downloaded invisibly through malicious email campaigns, web links, download packages, games or .torrent files. They are covert by nature and may prevent identification of the software using a randomized filename/path structure.

Infoblox protects organizations wherever they’re deployed using a unique hybrid approach. Hybrid security gives enterprises the power to leverage the cloud to detect more of today’s most dangerous threats while integrating with the on-prem system. Organizations benefit from streamlining and automating their security operations and scale for future growth using the security tools they already have.

Learn more about Infoblox's Cyber Intelligence Unit and stay up to date on the latest threat intelligence news here.

For those that are affected by the NIST 800-171, the NIST gives them the ability to review the modifications and changes that are being made to the standard and for organizations and contractors to suggest changes to the security requirements at https://csrc.nist.gov/publications. This gives organizations the ability to keep ahead of the game and to make sure they are always staying compliant. If organizations find security requirements that matches the following criteria inside the NIST 800-171:

•       Uniquely federal (i.e., primarily the responsibility of the federal government);
•       Not directly related to protecting the confidentiality of CUI;
•       Expected to be routinely satisfied by nonfederal organizations without specification.

Then this may be a chance for organizations or contractors to let the NIST know it so they can fix it in further publications as these shouldn’t be inside the NIST 800-171 and will help organization compliance to be simpler and smoother.

The NIST 800-171 strongly affect any businesses or contractors that process, store, or transmit CUI. The full list of potential CUI can be found on the National Archives page here: https://www.archives.gov/cui/registry/category-list. If an organization touches any of the CUI listed here and are not compliant with the NIST 800-171, they are at risk for losing any contracts organizations have with the US government. The NIST 800-171 is not being enforced everywhere, however, over the course of the next few years, NIST 800-171 will have more authority and be enforced more strictly.

Infoblox, which is the leader in the DDI market with a secured DNS resolver, helps organization stay within compliance with the NIST 800-171 but here are just some of the security requirements that Infoblox helps organizations stay compliant in from the NIST 800-171 security requirements list:

3.1.3. Control the flow of CUI in accordance with approved authorizations:

Infoblox keeps users from accessing certain resources by blocking the IPs and URLs. Infoblox also helps prevent data exfiltration and infiltration through the DNS which helps control the flow of CUI going to malicious entities.

3.1.11. Terminate (automatically) a user session after a defined condition:

Through the use of our ecosystem Infoblox can inform appliances such as NAC’s and they visit Firewalls.

3.1.12. Monitor and control remote access sessions:

Infoblox allows organizations to monitor all the networks with IPAM and allows organizations to remove someone’s lease if needed.

3.1.18. Control connection of mobile devices:

With Infoblox organizations can see all the device on the network and remove a device if needed. Infoblox helps to efficiently manage which networks need to be looked at and to have additional help for managing mobile devices.

3.1.20. Verify and control/limit connections to and use of external systems:

Infoblox allows organizations to set up all remote and internal users to a single DNS point of reference so users don’t access external DNS servers that could be poisoned or malicious. Infoblox also allows organizations to block users from accessing sites remotely that could allow for the use of external systems.

3.1.22. Control CUI posted or processed on publicly accessible systems:

Infoblox allows organizations to block access to all media sites and control which sites a user can’t gain access to.

3.3.1. Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity:

Infoblox provides an extensive list of all sites a user has visited, including, a complete lease history for a device that was on the network which is needed to enable the monitoring, analysis, investigation and reporting of unlawful or unauthorized system activity

3.3.2. Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions:

Infoblox allows organizations to keep track of all devices on the network and what IP’s they have connected with a comprehensive lease history including the sites visited.

3.4.1. Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles:

Infoblox provides network discovery of all components on networks and allows organizations to quickly evaluate what devices are on the network and what type of firmware and hardware is on it. NetMRI users can also automate many of the updates for software.

3.4.2. Establish and enforce security configuration settings for information technology products employed in organizational systems:

With NetMRI Organizations can automate much of this process.

3.4.7 Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services:

With Infoblox’s Secure DNS server Organizations can limit the access to all nonessential sites and helping protect DNS traffic from nonessential sites.

3.5.1. Identify system users, processes acting on behalf of users, and devices:

Infoblox provides organizations with the ability to know all the IP and MAC addresses on the network, including several other device-unique token identifiers.

3.6.1. Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities:

Infoblox provides organizations with the contextual data needed to expedite the full incident-handling operation.

3.6.2. Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization:

Here, Infoblox provides organizations with easy ways visualize the incidents that are occurring on the DDI network.

3.7.1. Perform maintenance on organizational systems:

Infoblox provides organizations with the ability to confirm the maintenance of organization systems with the devices information. Infoblox also provides a quick and easy way to organize all the assets with the ability to map devices with Extensible attributes.

3.11.2. Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified:

Infoblox provides organizations with the ability to scan devices as they come on the network with third-party vendors such as Tenable, Rapid7 and Qualys. Infoblox has the vision of the whole network and knows when devices come on the network which allows for scanning software to quickly scan a system.

3.13.1. Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems:

Infoblox Provides Organizations with the ability to Monitor, control and protect communications through the DNS with data exfiltration and infiltration protection and the ability to prevent access to different malicious sites.

3.13.5. Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks:

Infoblox helps organizations to more quickly and efficiently set up and manage demilitarized zones within an organization by managing the IP’s of the routers, gateways and firewalls.

3.13.6. Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception):

Infoblox helps organizations with this by preventing Botnet communications through the DNS and prevent unpermitted communications.

3.13.7. Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling):

Infoblox helps organizations to prevent unsecured DNS resolvers when outside the organization.

3.14.2. Provide protection from malicious code at designated locations within organizational systems:

Infoblox Provides Organizations from data Infiltration through the DNS and helps prevent the injection of code executions on their environment.

3.14.3. Monitor system security alerts and advisories and take action in response:

Infoblox Provides Organizations with large quantities of continuous alerts for IoC information from itself and from many third parties such as SURBL, DHS, NCCIC and more. Infoblox also provides users with custom list of IoC’s from the custom data that is flowing through an organization's network.

3.14.6. Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks:

Infoblox provides organizations the ability to monitor all DNS traffic and detect when an attack through the DNS is occurring.

3.14.7. Identify unauthorized use of organizational systems:

Infoblox provides organizations the ability to monitor all DNS traffic and will help organizations know when unauthorized use of organizational systems has occurred with alerts on when a user access malicious or unauthorized resources through the DNS.

DNS sinkholing is a very effective strategy to control access to network resources.   Infoblox builds DNS sinkholes, with Infoblox DNS Firewall or Response Poicy Zones (RPZ).  According to Infoblox documentation,  a DNS RPZ enables you to “ define RPZ rules to block DNS resolution for malicious or unauthorized hostnames, or redirect clients to a walled garden by substituting responses.”   In ordinary terms, with DNS Sinkholing (aka DNS Firewall and RPZ), a name query to a known malware site, administratively banned site or a prohibited web category will be blocked before a web connection is established.  Here's an excellent paper from SANS for anyone interested in a deeper dive into the use case for DNS Sinkholes.

DNS is well suited to controlling network access.  Since DNS operates in real-time and spans every type of operational environment, it’s an ideal tool to implement real-time network access policy. There are many applications for DNS sinkholes such as malware detection and mitigation, web content control, connections to countries that are sanctioned or unnecessary to your business, DDoS mitigation and more.  However, the most common DNS sinkholing application Infoblox sees in the market is malware detection and mitigation. Especially in the healthcare and health insurance markets.

DNS is the first line of defense for cyber threat intel since it can block IP addresses, domain names and host names so it’s important to take advantage of DNS capabilities for actioning threat intelligence.  Infoblox DNS supports over 40 million Indicators of Compromise (IOC) in real time with no service degradation.   Considering that most firewalls can’t handle more than 100,000 IOCs in real time, it makes a lot more sense to use Infoblox DNS for DNS sinkholing than a firewall.  Furthermore, firewalls at operate at the network perimeter whereas Infoblox DNS sinkholing applies to intra east-west traffic as well as north (outbound) and south (inbound) traffic.  What’s more Infoblox DNS sinkholing can be applied to mobile users and remote branches with limited technology footprints.

DNS sinkholing can be dangerous since a single bad IOC can have a big service impact across the enterprise.  That’s why Infoblox creates purpose-built intelligence for DNS that will not block known GOOD sites.  Infoblox threat intelligence focuses on garbage domains malware uses for command and control with Domain Generation Algorithms (DGA), known botnets, ransomware, command and control, malware infrastructure and other intel that can be summarized with IP address, host name or domain name.  All Infoblox intel is run through correlation and scoring engines to insure against false positives.  You can read more about DGA and other threats in this excellent white paper on DNS security threats.  Infoblox can work with your private intel or threat intelligence from your favorite intelligence provider or threat intel platform.

DNS sinkholing is included in Bloxone Threat Defense and is often called DNS Firewall in Infoblox documentation.   Infoblox is seeing an increased interest in DNS Sinkholing in the healthcare, finance, industrial and utility markets due to recent regulations and security guidelines.   So, with all the focus in DNS sinkholing lately, why not do DNS sinkholing with Infoblox DNS, the most scalable and intelligent DNS platform available?   Answer in the comments, would love to hear your thoughts.

Special thanks to Infoblox SE Ross Gibson for technical advisory and edits!

The Cybersecurity Excellence Awards recognize companies, products, and individuals that demonstrate excellence, innovation, and leadership in information security. The industry’s best professionals and organizations were chosen based on the impact their products and services have on the industry as well as open voting by members of the cybersecurity community.

The cyber threat landscape is rapidly changing with the introduction of SD-WAN and IoT. Traditional security approaches don’t work well in a loud first world. To effectively defend against threats, organizations need a solution that provides: 

• Visibility into transformative network architectures like SD-WAN, cloud, and IoT.
• Scalability to protect against breaches and malware in a cost-effective way.
• Automation to help respond faster to threats that enter the network by evading perimeter defenses.
• A hybrid approach to network security that protects assets and infrastructure anywhere—on- and off-premises—and that integrates tightly with existing on-premises ecosystems.

Though some of the other solutions in the market provide cloud only solution, cloud-only security architecture solutions face the following challenges:

• Cloud-only solutions make it difficult to implement threat responses in a way that completely close security gaps. For example, they can’t easily share security events with on-premises cybersecurity solutions. The lack of integration results in siloed tools and increasingly costly delays at a time when network attacks are unfolding at ever-higher speeds.
• Cloud-only solutions do not provide timely access to the troves of network data residing in on-premises assets that can help security teams better detect and remediate some of today’s most urgent network threats.
• Cloud-only solutions are unable to ensure the protection of remote offices when Internet connections go down.

With BloxOne Threat Defense, organizations get an integrated solution suite that provides hybrid security for all network environments. Pervasive, scalable, and cloud-managed, the solution suite protects users and devices anywhere, on any network—across physical, virtual or cloud infrastructure. These solutions block DNS-based data exfiltration, stop malware communications with command-and-control (C&C) servers and prevent access to

content not in compliance with security policy. They also automatically distribute threat intelligence and indicators of compromise (IOCs) to existing security infrastructure for faster incident response.

The solution suite’s hybrid security architecture employs the scalability and pervasiveness of DNS to provide comprehensive protection. It enables your organization to boost the performance of your business’s existing infrastructure investments while taking advantage of the simplified service delivery made possible through Infoblox’s next-generation SaaS platform.

Advantages of a hybrid architecture for security:

According to Comport Technology Solutions, the use of hybrid approaches that blend on-premises and cloud infrastructure will become more common because organizations want to take advantage of the cloud without giving up proximity to data residing in on-site infrastructure. For implementing security, the same argument holds true. Cloud architecture supplies several advantages, such as being able to scale threat detection and handling big data analytics, while the on-premises components of a hybrid solution can unlock valuable data and context that can be

leveraged for the response.

Infoblox’s hybrid approach to security offers you the following advantages:

• Analytics in the cloud: Certain threats like DNS data exfiltration, infiltration and tunneling can evade reputation and signature-based detection methods. To effectively detect these threats requires analytics that combine machine learning and user behavior. The cloud has greater processing capabilities to detect a wider range of threats, including data exfiltration, domain generation algorithm (DGA), Dictionary DGA, fast flux, fileless malware and more. Using the hybrid model, this detection can take place in the cloud and enforcement can happen anywhere: on-premises or in the cloud.
• Threat intelligence scaling: Infoblox threat intelligence includes data from Infoblox research and third-party intelligence providers that is aggregated and curated into one platform. Your organization can apply this comprehensive intelligence of indicators to enforce policies on-premises or in the cloud. You can also automatically distribute it to the rest of the security infrastructure. Moreover, with Infoblox, you can access additional threat intelligence from the cloud that is not available to your on-premises tools.
• Full integration with on-premises ecosystem: The hybrid model enables full integration with on-premises Infoblox and third-party security technologies, enabling your teams to unlock valuable network context and deliver faster, more accurately prioritized incident response and network-wide remediation.
• Remote survivability: With the Infoblox hybrid model, if the Internet connection goes down in one of your locations, the on-premises DNS security will continue to secure and service clients in the network, protecting remote and local users.

To learn more: Please go to https://www.infoblox.com/products/bloxone-threat-defense/ .

In our blog, Modern IPAM as a Security Asset Part 1, we proposed the importance of triangulating data for context and quick response, reliable data and 100% visibility of network endpoints.  We’d like to continue the thought by recalling the story of Sam Security and Nancy Network.

Sam Security and Nancy Network Revisited

A SecurityWeek article co-authored with Rod Rasmussen some years ago raises this point: “Why Sam Security needs a seat at Nancy Network’s table.”

The main – and still very relevant – takeaway here is to use “low-friction” assets already available that can benefit (or at least not harm) network performance. The subtext you can read into this clever lexicon is that it is best to use existing budget line items to get done quickly what might otherwise take several months of negotiation for enhanced resources. Selling the benefits to peers as a win/win can be an easier pathway to progress than buying something as a new or add-on solution. If you disagree with that statement, please connect with us and we can chat offline. This principle is still certainly true with modernizing DNS Resolvers and designing security into network administration – your DNS servers are either a security asset or a security liability today – whether it becomes an asset or liability is a choice left up to you depending on how you allocate resources. However, an even simpler manifestation of this principle is to look at your IPAM. In the network operations world, few solutions have been as much of a boon to network administration as moving from shared spreadsheets (and Notepad in some cases) to efficient IP address management. A couple of questions to ask yourself about whether your organization is using resources efficiently are:

1) Can you get the contextual data you need for today’s event easily?

2) Can you automatically get the data you need for yesterday’s event easily?

From our perspective, the answer to these questions both start with IPAM. Why? Let’s look at what organizations nowadays are up against. Many employees have capability to stand up 500 connected virtual machines instantly. Containerization using IPv6 will only amplify that volatility. Do you know how many user-device combinations have privileges to administer, edit and configure your cloud data? AWS offers per-user administrative configuration for who can do what, but are they are configured with the principle of least privilege? How would you verify this? And let’s look at “old” Internet of Things (IOT): multifunction printers have hard drives, are connected and store sensitive data by default. Your answer? Our internal DNS is fine. Who attacks a printer? Why do I need to inventory MF printers on our network? Or unpatched windows machines or Point-of-Sale systems? The list goes on. Why are we not using these innovations in network management to move toward individual risk scoring of assets? That is to say, link user and computer situations and then overlay a richer set of DHCP meta data like lease history? From there, assign DNS RPZ risk rule sets to those unique situations? A point to ponder.

So many threat intelligence whitepapers, articles and conference panels include variations on this theme: “We gotta do basic hygiene. We gotta do the basics well.”It turns out that boring hygiene can actually be a great source of data through modern IPAM. As we approach another RSA extravaganza, keep in mind the basics. Boring as it may be, it just so happens that modern IP Address Management can be a rich and reliable source of applicable wisdom that enhances everything else you’re doing – or trying to do – in security. Great data leads to great creativity – more use cases can be addressed and more solutions can be devised by the talented people you work with every day. What is the point here? When you do IPAM for free, you “buy cheap, but pay twice.”

Authoritative IPAM: Where does it fit in the Plan?

Enter authoritative IPAM. Authoritative IPAM accurately reflects the state of your network, provides contextual visibility (i.e., the who, what, why, when, how, where and which) of your network assets (e.g., IP addresses, subnets or VLANs) and enables you to replace manual, error-prone tools and processes with efficient, automated workflows. The following graphic provides a step-model for understanding where this fits in your plan.

If we were to devise a “punch list” for how to integrate authoritative IPAM data as a security asset, we’d suggest 4 key components:

1. Single Source of Truth (Authoritative IPAM):Accuracy, visibility, reliability and IPAM automation is where to start. Management through distributed, high availability, security-hardened, easy-to-manage core network services with central platform visibility delivers your advantage. Providing an agentless DDI overlay that retains Microsoft DNS and DHCP protocols, enables visibility to AD Sites and Services, user/IP mapping and IPAM sync makes your life better by eliminating IP conflicts, lease and network outages.
2. Continuous Asset Discovery (On-Premises and in the Hybrid Cloud):Automated on-premises and multi-cloud asset discovery, visibility, IPAM sync, switch port management, rogue and compromised asset detection, open RESTful and leading cloud interfaces (e.g., AWS, Azure, Google Cloud Platform, OpenStack), DNS/IP provisioning, DDI policy-based automation, auditing and workflow automation deliver the efficiency and control you need.
3. Cross-System Interoperability (Security Ecosystem):Automated quarantine and scans of newly discovered assets, near-real-time remediation and TrustSec policy updates via security vendor integrations (e.g., McAfee, Cisco, Carbon Black, FireEye, etc.) and threat data sharing with NACs, SIEMs, TIP, ITSM and other security tools is also an essential component for modern threat defense.
4. Network Visibility and Intelligence (Integrated Reporting and Analytics):Best practices call for fast plug-and-play deployment and full visibility through pre-built, customizable dashboards and reports, search, predictive analytics and Splunk-powered visualizations to give you actionable control of endpoint, performance, security forensics, access logging, audit and network management.

100% visibility should be the strategic imperative in everything you do at all times. If that sounds daunting, expensive and never-ending-“pie-in-the-sky-ish,” it just may be a lot more achievable than it seems.

There are superior and affordable alternatives to IPAM-only solutions that lack full network discovery, extensive ecosystem integrations and basic reporting. We invite you look at our IPAM QuickStart and speak with one of our Network Architecture professionals. QuickStart enables you to affordably achieve authoritative IPAM control and automation based on your time, priorities and resources. QuickStart provides a “light-lift, solid bang for your buck.” Don’t merely assume the Network Operations Department is moving in this direction. Sam, get a seat at Nancy’s table and advocate for 100% visibility, always. That begins with how you manage your internal IP addresses. After all, you need full and reliable network data from all sources. Otherwise, you cannot secure what you cannot see.

Infoblox is a provider of a technical threat intelligence which includes domains, FQDNs, ip-addresses and URLs. These threat intelligence indicators may be used on different platforms like NGFW, Secure Proxy, SIEM etc.

Infoblox gives you not only threat intelligence indicators to detect threats but also information on why an indicator is malicious. Using threat class and property (name) it is possible to successfully identify the type of threat as well as a mitigation procedure.  

As mentioned earlier, a SIEM platform contains all kind of events from various software and network equipment, so the indicators can be used to enrich any log messages which contain relevant fields.

For example, web-server access logs contain a source (or requestor) IP address and a URL. Both properties can be used in conjunction to detect and mitigate malicious traffic and hunt new threats. The idea is simple - that known HTTP scanners scan for specific software and vulnerabilities. Based on requested URLs we can find out what kind of tools are used and which vulnerabilities malicious actors are trying to exploit. Analyzing similar requests, we can find other hosts that scan our network. Blocking access to such scanners can significantly reduce attack surface.

An another example, on the screenshot below you can see a Splunk dashboard which displays bruteforce attempts on my SSH server (BTW it is not recommended to have SSH exposed to the Internet). The dashboard is powered by Infoblox's threat intelligence. It is worth mentioning that based on my observations, 5%-20% (depending on a day) of known scanners generate 60%-95% attacks.

To generate the report, I'm using a lookup tool I wrote, also available on GitHub (https://github.com/Homas/Splunk_AT_Lookup). The tool allows you to enrich log messages with threat intelligence (Infoblox, SURBL, Farsight, CrowdStrike etc) available via Infoblox TIDE.

The tool consists of 2 scripts:

• a script which downloads indicators and stores them in a local SQLite database. It should be executed on a schedule to periodically update DB
• a lookup tool which searchs domains/FQDNs, IPs and URLs in a local database and returns threat properties. A single indicator may be associated with one or more threat properties.

The list of indicators of compromise are continuously updated so:

• It is important to store already enriched logs to easily access this information and not lose it, in case your threat intel vendor cannot provide you access to historical data or a subscription expires. Infoblox TIDE does provide access to historical data.
• It's also worth to validate logs (e.g. DNS response logs) from the last few days on the indicators which were recently added.

To further investigate incidents Splunk offers an easy way to drilldown to Infoblox Dossier. To access Dossier from a Splunk dashboard you will need to use the following URL in the drilldown configuration:

"$row.field$" contains an indicator in a row which was clicked (there are some other options available to configure drilldown). The column may contain any supported indicator type: domain/fqdn, ip-address, url, check sum, email. Because there is no single sign-on you may be asked to authenticate.

I hope this short article was useful and showed you how to empower your SIEM with accurate and contextual threat intelligence for faster correlation of events.

Vadim