Is there any way we can integrate Emerging Threats with SOAR so that if an IOC match is found it creates a SOAR case?
Solved
Emerging Threats - Integrate with SOAR?
+9- Bronze 1
Best answer by gkush
What I would do is set all of the Curated Detections to only detections, no alerting. Next, I’d create a composite detection that aggregates the rule findings. You can create hourly buckets, and you can match on user or machine, or choose some other match condition (production vs dev, AD group) that makes sense for what you want to track. There’s a fair bit of flexibility and creativity you can use here to suppress or aggregate “noise”, but it also means some work and planning.
There is current ET to SOAR cases directly, albeit if you do have Applied Threat Intel rules (which use these IOCs) enabled these will surface the same matches as shown in ET in a SOAR Case.
+16How do I configure the creation of ET matches to SOAR cases directly?
The Applied Threat Intel (ATI) Curated Detections cover these IOCs. If these Curated Detections are enabled and set to alerting, you should receive alerts in the SOAR for them
+9- Bronze 1
I can see 7 ATI Curated Prioritisation and 3 ATI non-prioritised IOC matching curated detections available to us. Which ones would need to be enabled? Does alerting need to be enabled to the P or B level?
+6If a rule detects and IOC, it has to be enabled to see it, and set to alerting to generate a case.
+9- Bronze 1
+6
What I would do is set all of the Curated Detections to only detections, no alerting. Next, I’d create a composite detection that aggregates the rule findings. You can create hourly buckets, and you can match on user or machine, or choose some other match condition (production vs dev, AD group) that makes sense for what you want to track. There’s a fair bit of flexibility and creativity you can use here to suppress or aggregate “noise”, but it also means some work and planning.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.