SOAR-EDR Lab

Project Overview

The purpose of this project is to automate security operations by integrating Tines (SOAR) and LimaCharlie (EDR). The goal is to enhance threat detection and response by reducing manual intervention and streamlining security workflows.

Objective

The project involves simulating an infected machine executing a malicious file designed to extract system passwords. By leveraging LimaCharlie as the EDR, we will monitor and analyze system events in real-time. Once the EDR detects the malicious process, an alert will be generated.

Following this, Tines (SOAR) will automate the incident response by executing predefined actions based on the detected threat.

Skills Learned

Creating automated incident response playbooks.
Monitoring and analyzing endpoint security events in real-time.
Detecting malicious activity and responding to security threats.
Understanding how security tools detect and log security incidents.
Learning how to reduce manual intervention by automating repetitive SOC tasks.
Evaluating risk levels and deciding on the appropriate security response.

Tools Used

Security Orchestration, Automation and Response (SOAR) software to build workflows.
Endpoint Detection and Response (EDR) that collects and analyzes data from endpoints.

Process Workflow

Pre-Conditions:

Disable real-time protection from Windows Security to download and run the Lazagne application from its official github repository.

Threat Simulation & Detection

Deploy an infected machine with a malicious executable designed to steal system passwords.
Monitor system events using LimaCharlie to detect suspicious activity.
Generate an alert when the malicious process is identified.

Automated Response via Tines

Notification Phase: Send an alert notification via Slack and Email containing details of the detected event.
User Decision Point: Prompt the user with event details, including the affected endpoint. Ask if the infected machine should be isolated.
Isolation or Warning Response: If the user selects "Yes", LimaCharlie isolates the machine from the network, and a confirmation message is sent via Slack. If the user selects "No", a Slack message is sent, warning that the machine was not isolated and requires further investigation.

Img 1: Network Diagram