- Posted: Tuesday, July 26, 2022 9:56 AM
Many companies struggle to understand malicious activity and its impact when a security incident is in progress. This consumes valuable time and resources defenders need to contain the attack and minimize damage. However, a new open-source tool designed to increase visibility into suspicious activity detected by organizations aims to ease that pain.
Detectree, developed by WithSecure (formerly known as F-Secure Company), is a detection visualization tool for defense/defense cybersecurity teams (also known as blue teams).
According to Tom Barrow, senior threat hunter for WithSecure’s managed detection and response service, WithSecure Countercept, finding the links between suspicious events on an endpoint is critical for responders:
“Visibility is always a priority, but absolutely vital when responding to an incident,” Barrow explained. “Time is always against incident responders. And looking through rows of textual data and making connections between them and the suspicious activity under investigation is time spent not solving the problem, which is a real waste when you’re under pressure. to stop an attack.
Detectree was designed to help blue teams simplify investigative work by structuring log data into a visualization that shows relationships between detected suspicious activity and any processes, network destinations, files, or registry keys connected to it. this detection. Rather than manually sorting the data represented as text to reconstruct a chain of events, stakeholders can consult the visualization to see not only the connections, but also the nature of the connections, including interactions, parent-child relationships and process injections. Relying on visualization allows responders to quickly see the context surrounding a detection and share that data with relevant stakeholders in a simple and intuitive way to ensure the information is accessible to everyone who needs it. .
“Even the most experienced and skilled blue teams need tools to help them do their job well. Detectree is a simple tool, but it tackles real issues that make work unnecessarily difficult and time-consuming for security teams,” he said.
Detectree is now available for download on the WithSecure Countercept Github page.