Match a feed against your logs and count what it was worth

short · 45 min · Objective 1.4

Task

Take an indicator list, match it against your lab's traffic, and measure the result honestly: how many matched, how many were useful, and how many would have been false alarms. Intelligence is bought by the feed and paid for in analyst hours, and this is how you find out which.

Steps

  1. Build an indicator file with thirty lines mixing four kinds: the beacon destination from your own earlier lab, five addresses in your lab subnet that you never contacted, ten addresses in documentation ranges, and a handful of very common values -- your own gateway, the collector, a DNS server your VMs actually use.
  2. Match the list against your collected connection logs, producing a hit count per indicator.
  3. Classify every hit: true positive (the thing you planted), benign true positive (real infrastructure that happens to be listed), or noise.
  4. Compute two numbers: the fraction of the list that ever matched anything, and the fraction of matches that were worth an analyst's attention.
  5. Now age the list: remove the beacon from your lab and re-run. Note that the indicator is still in the file, still matching nothing, and indistinguishable from the twenty-nine that never mattered.

Verify

wc -l < /tmp/indicators.txt
grep -F -f /tmp/indicators.txt /var/log/collected/conn.log | wc -l
grep -F -f /tmp/indicators.txt /var/log/collected/conn.log | awk '{print $5}' | sort | uniq -c | sort -rn

The first is the list size. The second is total hits. The third is the distribution, and it is the one that matters: if one or two indicators produce almost all the hits and they are your own infrastructure, the feed's real contribution is much smaller than the hit count suggests.

Notes

The ratio you just computed is the one nobody publishes. A feed that matches a great deal is usually matching common infrastructure, and a feed that matches nothing may still be correct -- you simply were not attacked by those actors. Neither number alone tells you the feed is good.

Rank your thirty indicators on the pyramid of pain. The ones at the bottom are the ones that expire silently, and you have just watched one do it.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.