Access Investigation - Generic - NIST

This playbook investigates an access incident by gathering user and IP information, and handling the incident based on the stages in "Handling an incident - Computer Security Incident Handling Guide" by NIST. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf Used Sub-playbooks: - IP Enrichment - Generic v2 - Account Enrichment - Generic v2.1 - Block IP - Generic v3 - NIST - Lessons Learned

NIST · 46 tasks · 6 inputs · 17 outputs

Inputs

  • SrcIP — The source IP address from which the incident originated.
  • DstIP — The target IP address that was accessed.
  • Username — The email address of the account that was used to access the DstIP.
  • NotifyEmail — Email addresses to notify about the incident.
  • RemediationSLA — The Remediation SLA for the 'Containment, Eradication, and Recovery' stage (in minutes).
  • InternalRange — A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).

Outputs

  • IP — The IP objects
  • Endpoint — The Endpoint's object
  • Endpoint.Hostname — The hostname to enrich
  • Endpoint.OS — Endpoint OS
  • Endpoint.IP — List of endpoint IP addresses
  • Endpoint.MAC — List of endpoint MAC addresses
  • Endpoint.Domain — Endpoint domain name
  • Account — The account object.
  • Account.DisplayName — The user display name.
  • Account.Groups — Groups for which the user is a member.
  • Account.Manager — The user manager.
  • Account.ID — The user distinguished name.
  • Account.Username — The user sAMAccountName.
  • Account.Email — The user email address.
  • ActiveDirectory.Users.userAccountControl — The user account control flag.
  • ActiveDirectory.Users.sAMAccountName — The user sAMAccountName.
  • ActiveDirectory.Users.name — The user common name.

Commands used

ad-disable-account ad-expire-password ad-get-user closeInvestigation send-mail setIncident

Flowchart

yes No yes No Yes yes yes yes yes Start Start Incident Documentation Incident Documentation Enrich indicators Enrich indicators Enrich source IP Enrich source IP Enrich destination IP Enrich destination IP Enrich source user Enrich source user Done Done Was the manager's ID returned? Was the manager's ID retu... Get manager's info - ad-get-user Get manager's info ad-get-user User confirmed account activity User confirmed account ac... User denied account activity User denied account activity Set severity to low - setIncident Set severity to low setIncident Close Investigation - closeInvestigation Close Investigation closeInvestigation Set severity to high and set the Remediation SLA - setIncident Set severity to high and ... setIncident Incident Analysis Incident Analysis Interact with the user Interact with the user Incident Prioritization Incident Prioritization Incident Prioritization Incident Prioritization Active Directory - Expire password - ad-expire-password Active Directory - Expire... ad-expire-password Would you like to perform auto-remediation? Would you like to perform... Active Directory - Disable account - ad-disable-account Active Directory - Disabl... ad-disable-account Perform manual remediation Perform manual remediation Identifying the Attacking Hosts Identifying the Attacking... Choosing a Containment Strategy Choosing a Containment St... Send mail - Notify about the incident - send-mail Send mail - Notify about ... send-mail Evidence Gathering and Handling Evidence Gathering and Ha... Generate Investigation Summary Report - GenerateInvestigationSummaryReport Generate Investigation Su... GenerateInvestigationSummaryR... Containment, Eradication, and Recovery Containment, Eradication,... Request user to confirm account activity Request user to confirm a... Incident Notification Incident Notification Post-Incident Activity Post-Incident Activity Generate Investigation Summary Report - GenerateInvestigationSummaryReport Generate Investigation Su... GenerateInvestigationSummaryR... Account Enrichment - Generic v2.1 - Account Enrichment - Generic v2.1 Account Enrichment - Gene... Account Enrichment - Generic ... Set NIST stage to "Incident Analysis" - setIncident Set NIST stage to "Incide... setIncident Set NIST stage to "Containment, Eradication, and Recovery" - setIncident Set NIST stage to "Contai... setIncident NIST - Lessons Learned - NIST - Lessons Learned NIST - Lessons Learned NIST - Lessons Learned Manual - Update TI Platform with indicators found in the investigation Manual - Update TI Platfo... Using Collected Incident Data Using Collected Incident ... Set NIST stage to "Post-Incident Activity" - setIncident Set NIST stage to "Post-I... setIncident IP Enrichment - Generic v2 - IP Enrichment - Generic v2 IP Enrichment - Generic v2 IP Enrichment - Generic v2 IP Enrichment - Generic v2 - IP Enrichment - Generic v2 IP Enrichment - Generic v2 IP Enrichment - Generic v2 Notify by Email? Notify by Email? Manual Notification Manual Notification Is Active Directory enabled? Is Active Directory enabled? Is Active Directory enabled? Is Active Directory enabled? Block IP - Generic v3 - Block IP - Generic v3 Block IP - Generic v3 Block IP - Generic v3