You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/getting_started/best_practices.md
+25-25
Original file line number
Diff line number
Diff line change
@@ -4,15 +4,15 @@ In the current cybersecurity landscape, organizations face significant challenge
4
4
5
5
### Rules Configuration
6
6
7
-
Our extensive catalog of over 900 rules, each [associated with a TTP from the MITRE ATT&CK framework](https://docs.sekoia.io/xdr/features/detect/built_in_detection_rules/), is categorized by four levels of effort. This enables targeted and effective defense against threats. The normalization of events via [intake formats](https://github.com/SEKOIA-IO/intake-formats/blob/main/doc/structured_event.md) and the use of [ECS taxonomy](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html) allows for technology-agnostic integration, facilitating the production of detection rules based on the [SIGMA models](https://docs.sekoia.io/xdr/features/detect/sigma/), our specific [anomaly detection engine](https://docs.sekoia.io/xdr/features/detect/anomaly/) and even the [IOC Detection](https://docs.sekoia.io/xdr/features/detect/iocdetection/) & [Collections](https://docs.sekoia.io/xdr/features/detect/ioccollections/).
7
+
Our extensive catalog of over 900 rules, each [associated with a TTP from the MITRE ATT&CK framework](../xdr/features/detect/built_in_detection_rules.md), is categorized by four levels of effort. This enables targeted and effective defense against threats. The normalization of events via [intake formats](https://github.com/SEKOIA-IO/intake-formats/blob/main/doc/structured_event.md) and the use of [ECS taxonomy](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html) allows for technology-agnostic integration, facilitating the production of detection rules based on the [SIGMA models](../xdr/features/detect/sigma.md), our specific [anomaly detection engine](../xdr/features/detect/anomaly.md) and even the [IOC Detection](../xdr/features/detect/iocdetection.md) & [Collections](../xdr/features/detect/ioccollections.md).
8
8
9
9
**Recommendations:**
10
10
11
-
-**Activate all [effort level](https://docs.sekoia.io/xdr/features/detect/rules_catalog/#effort-level) 1 and 2 rules** during the initial setup of your community.
11
+
-**Activate all [effort level](../xdr/features/detect/rules_catalog.md#effort-level) 1 and 2 rules** during the initial setup of your community.
12
12
13
-
-**Configure the Rules Settings** to [enable new rules](https://docs.sekoia.io/xdr/features/detect/rules_catalog/#automatically) up to the Intermediate level.
13
+
-**Configure the Rules Settings** to [enable new rules](../xdr/features/detect/rules_catalog.md#automatically) up to the Intermediate level.
14
14
15
-
-**Fine-tune detection rules** after each false positive alert through the [available options](https://docs.sekoia.io/xdr/features/detect/rules_catalog/#limiting-the-scope-of-a-rule), primarily using alert filters.
15
+
-**Fine-tune detection rules** after each false positive alert through the [available options](../xdr/features/detect/rules_catalog.md#limiting-the-scope-of-a-rule), primarily using alert filters.
16
16
17
17
-**Activate a new wave of higher effort level rules** after the initial RUN period, representing:
18
18
@@ -33,10 +33,10 @@ To ensure comprehensive and effective coverage, it is crucial to configure your
33
33
-**2 company wide Network Based Intake** (e.g., Loadbalancer/Reverse-Proxy, Proxy, DNS). They help monitor internal network traffic and detect anomalies such as lateral movements by attackers and suspicious communications.
34
34
-**1 company wide Email Security Based Intake** (e.g., Office, ProofPoint, Vade) **with security options enabled**. This helps identify phishing attacks, malware transmitted via email, and other email-related threats.
35
35
-**1 Identity and Access Management Based Intake** for **on-premise** environments (e.g., Active Directory, Okta, Wallix) **and 1 for cloud** environments if applicable (e.g., Azure Entra ID, Cloudflare Access Requests, Google Workspace). This helps detect suspicious activities related to user access, such as unauthorized login attempts and privilege changes, and ensures security oversight across both on-premise and cloud environments.
36
-
-**Activity Logs**: Ensure that [Sekoia.io activity logs](https://docs.sekoia.io/integration/integrations/application/sekoiaio_activity_logs/) are activated. This allows monitoring actions and changes within the Sekoia.io platform itself, ensuring complete transparency and traceability.
37
-
-**No intake should have zero events received** in the past 7 days. An intake without events can indicate a configuration or data collection issue, compromising threat detection capability. Ensure that notifications are configured to alert in the case of [an event drop for an intake](https://docs.sekoia.io/getting_started/notifications-Examples/#intakes).
36
+
-**Activity Logs**: Ensure that [Sekoia.io activity logs](../integration/categories/applicative/sekoiaio_activity_logs.md) are activated. This allows monitoring actions and changes within the Sekoia.io platform itself, ensuring complete transparency and traceability.
37
+
-**No intake should have zero events received** in the past 7 days. An intake without events can indicate a configuration or data collection issue, compromising threat detection capability. Ensure that notifications are configured to alert in the case of [an event drop for an intake](./notifications-Examples.md#intakes).
38
38
39
-
-**Use the [Sekoia.io Forwarder](https://docs.sekoia.io/integration/ingestion_methods/syslog/sekoiaio_forwarder/)** each time you need to forward On Premise events via syslog protocol to Sekoia.io SOC Platform to ease discriminate logs before adding them the relevant Intake Key. It also is the only log forwarder that our Support team will be able to provide you with assistance.
39
+
-**Use the [Sekoia.io Forwarder](../integration/ingestion_methods/syslog/sekoiaio_forwarder.md)** each time you need to forward On Premise events via syslog protocol to Sekoia.io SOC Platform to ease discriminate logs before adding them the relevant Intake Key. It also is the only log forwarder that our Support team will be able to provide you with assistance.
40
40
41
41
42
42
### Events Quality
@@ -51,7 +51,7 @@ The quality of events is crucial for accurate and effective detection. Here are
51
51
Our product is designed to focus on high-priority threats, enabling expert resources to conduct a manageable number of quality investigations each day. By creating alert filters, you can ensure that alerts are raised for the right reasons, enhancing the efficiency and effectiveness of your security operations.
52
52
53
53
-**Monitor the average number of Alerts per Intake** to identify intakes generating too many or too few alerts.
54
-
-**Limit the number of Daily New Alerts** at a manageable level for your team (by experience, around 6 to 8 per day per analyst, or 60 per day) and prioritise the [tuning of a rule](https://docs.sekoia.io/xdr/features/investigate/alerts/#create-an-alert-filter) over automating its status change if no defensive action is to be taken.
54
+
-**Limit the number of Daily New Alerts** at a manageable level for your team (by experience, around 6 to 8 per day per analyst, or 60 per day) and prioritise the [tuning of a rule](../xdr/features/investigate/alerts.md#create-an-alert-filter) over automating its status change if no defensive action is to be taken.
55
55
-**Track the Weekly and Monthly volume of New Alerts** to evaluate the evolution of threats and the performance of detection rules.
56
56
-**Assess the number of Daily New Cases** to understand workload and the effectiveness of response processes. In general, the number of case(s) per day does not exceed 1, as it is cconsidered as a very important incident.
57
57
-**Ensure no sleeping alert is older than 1 week** without status "Closed" or "Rejected".
@@ -66,27 +66,27 @@ Playbooks complement operational optimization by automating various types of man
66
66
67
67
-**Keep the number of playbook executions per day low**: Aim for less than 60 executions per playbook per day, aligning with the number of raised alerts. Each playbook should have a specific objective to meet a particular need.
68
68
-**Design playbooks with simplicity in mind**: On average, each playbook should be composed of less than 15 modules, including:
69
-
-**1 [Trigger](https://docs.sekoia.io/xdr/features/automate/triggers/)** such as the “Manual trigger” or “Alert created” trigger **with a filter condition** to start the playbook only for relevant cases.
70
-
-**Some [Operator](https://docs.sekoia.io/xdr/features/automate/operators/) modules** like "[Condition](https://docs.sekoia.io/xdr/features/automate/operators/#condition)" and "[Foreach](https://docs.sekoia.io/xdr/features/automate/operators/#foreach)" to halt the playbook execution if new information gathered during the process indicates that the playbook is unnecessary in the current context.
71
-
-**A majority of [Action](https://docs.sekoia.io/xdr/features/automate/actions/) modules** making it easily understandable for new team members and maintainable over time. To give you more details on the top 10 most used playbook Actions, here is a list:
For instance, the following [playbook template](https://docs.sekoia.io/xdr/features/automate/build-playbooks/#templates) composed of 9 modules (1 Trigger, 1 Operator, 7 Actions) answers the need of adding a domain in a blocklist (IOC Collection).
69
+
-**1 [Trigger](../xdr/features/automate/triggers.md)** such as the “Manual trigger” or “Alert created” trigger **with a filter condition** to start the playbook only for relevant cases.
70
+
-**Some [Operator](../xdr/features/automate/operators.md) modules** like "[Condition](../xdr/features/automate/operators.md#condition)" and "[Foreach](../xdr/features/automate/operators.md#foreach)" to halt the playbook execution if new information gathered during the process indicates that the playbook is unnecessary in the current context.
71
+
-**A majority of [Action](../xdr/features/automate/actions.md) modules** making it easily understandable for new team members and maintainable over time. To give you more details on the top 10 most used playbook Actions, here is a list:
For instance, the following [playbook template](../xdr/features/automate/build-playbooks.md#templates) composed of 9 modules (1 Trigger, 1 Operator, 7 Actions) answers the need of adding a domain in a blocklist (IOC Collection).
-**Ensure the duration of each Action** within playbooks is less than 10 seconds to reduce the chance of a timeout with most third-party tools you interact with.
89
-
-**Track the overall [duration of playbook executions](https://docs.sekoia.io/xdr/features/automate/navigate-playbooks/#playbook-runs)** for each playbook to complete its execution in less than 1 minute.
89
+
-**Track the overall [duration of playbook executions](../xdr/features/automate/navigate-playbooks.md#playbook-runs)** for each playbook to complete its execution in less than 1 minute.
90
90
-**Ensure no playbook is having an issue** that is visible with the status "Trigger crashed" and "Configuration issues".
91
91
-**Keep a low number of "Ready to start" playbooks**, for instance less than 2, to avoid activation issue after a long period of configuration due to confict with recent evolutions of your community.
0 commit comments