Indicators in Splunk SOAR (formerly Phantom) are crucial elements used to detect and respond to security incidents. Let’s break down what indicators are and their significance:
Definition of Indicators:
Indicators are data points or patterns that suggest the presence of malicious activity or potential security threats.
They can be anything from IP addresses, domain names, file hashes, URLs, email addresses, or other observable artifacts.
Indicators help security teams identify and correlate events across different sources to understand the scope and impact of an incident.
Types of Indicators:
Observable Indicators: These are directly observable artifacts, such as IP addresses, domain names, or file hashes.
Behavioral Indicators: These describe patterns of behavior, such as failed login attempts, lateral movement, or suspicious network traffic.
Contextual Indicators: These provide additional context around an event, such as the user account associated with an action or the time of occurrence.
Use Cases for Indicators:
Threat Detection: Security analysts create rules or playbooks that trigger based on specific indicators. For example, an indicator like a known malicious IP address can trigger an alert.
Incident Response: During an incident, indicators help identify affected systems, track lateral movement, and prioritize response efforts.
Threat Intelligence Sharing: Organizations share indicators with each other to improve collective security posture.
Multiple Containers:
Indicators can appear in multiple containers (playbooks, actions, etc.) within Splunk SOAR.
For example, an IP address associated with a suspicious domain might appear in both a threat intelligence playbook and an incident response playbook.
Artifact Values vs. Indicators:
While artifact values are related, they are not the same as indicators.
Artifact values represent specific data extracted from an artifact (e.g., extracting an IP address from an email header).
Indicators encompass a broader range of data points and are used for detection and correlation.
References:
Splunk SOAR Documentation: Indicators
Splunk SOAR Community: Understanding Indicators
