How does a Reveelium UEBA / Threat Hunting SIEM work?
The principles governing the operation of SIEM (Security Information and Event Management) monitoring tools have been well-established for years. The arrival of artificial intelligence in cybersecurity tools is less so. We aim to explain it simply here, despite the significant technical complexity required to understand the inherent functioning of highly innovative AI technologies.
Logical building blocks:
– A SIM (Security Information Management): centralizes and aggregates logs from applications, equipment, and security tools (FW, antivirus, proxies, etc.). An advanced SIM can generate certain alerts based on (simple) database search criteria. Within Reveelium, we use an Elastic/Graylog database to centralize incoming data.
Example: a dangerous Windows event, an antivirus detection event.
– A Reveelium SIEM (which also includes the SIM): correlates incoming events to detect attack tactics and/or techniques (cf. MITRE) or malicious activity based on scenarios, threshold criteria, or counts.
Example: A sequence of alerts matching a MITRE malicious activity.
Reveelium's correlation engine (3) can ingest events, logs, alerts, threats generated by the AI engine, probabilistic threat outputs, or threat intelligence data. Standard SIEMs on the market only perform simple correlation.
Reveelium SIEM is paired with the AI / UEBA engine, enabling it to:
– detect weak signals that cannot be identified by scenarios or patterns (such as ransomware, APTs, etc.)
– reduce the number of false positives to increase monitoring team productivity and eliminate noise caused by false alerts
The challenge lies in processing massive volumes of data and delivering the highest-quality, best-scored, prioritized detections with minimal false positives. Below.
The Reveelium UEBA / Threat Hunting Engine provides extensive machine learning processing capabilities. It is capable of:
– (1) detecting abnormal behavior based on events and logs collected by the SIM/SIEM.
Example: Abnormal user behavior on proxies, anomalous communications on firewalls or DNS indicative of a potential compromise.
In this manner, it characterizes attack techniques that are impossible to detect using conventional pattern- or scenario-based methods.
Most UEBA SIEMs on the market are ill-equipped with these techniques. Reveelium is one of only five technologies worldwide to embed these detection capabilities.
Example: detection of a DGA during the 2016 Petya outbreak, preventing the detonation of the ransomware attack that impacted Saint-Gobain (€60M in losses).
– (2) probabilistically correlating (late 2020 release) all alerts, detected techniques, and threats within a behavioral engine that is “one-of-a-kind in the world”.
Example: Enabling the detection of dangerous behavior among a vast volume of events or alerts without relying on scenarios or patterns.
– Scoring and prioritizing Threats (the set of identified malicious techniques and tactics) to decrease analyst handling time, accelerate response time, and enhance Blue Team detection capabilities.
Example: Petya resulted in 3 threats scored at 80/100 instead of 300 unmanageable alerts.
Correlation engines 2 and 3 address the challenge identified below by Gartner and our clients:
The AI-based behavioral and probabilistic detection engine has been developed by ITrust since 2010. It is recognized as a disruptive technology across the market (cf. awards received).
Reveelium SIEM and Reveelium UEBA/TH operate in coordination, sharing the same SIEM correlation engine and probabilistic AI correlation engine to deliver a high-performing SOC (Security Operations Center):
superior, prioritized detection
fewer false positives
threat scoring mapped to the MITRE framework, saving time and augmenting detection capabilities, referred to as SOAR (with the addition of the Acsia EDR module)
an alerting system (TheHive)
a workflow and case management system for enhanced detection
seamless interfacing capabilities with a vulnerability scanner (Ikare) and an EDR (Acsia)
reporting capabilities providing dashboards tailored to specific verticals: Healthcare, PCI-DSS, regulatory compliance, etc.
KPIs (indicators) tailored to user profiles (managers, executives, or technical experts)
