How does Reveelium UEBA / TreatHunting SIEM work?

The principles governing the operation of SIEM (Security Information and Event Management) tools have been well known for years. The emergence of artificial intelligence in cybersecurity tools is less well known. We will try to explain it simply here, despite the significant technical knowledge usually required to fully understand how highly innovative AI technologies work.

 

The logical building blocks:

  • A SIM: Security Information Management (SIM): It centralizes and aggregates logs from applications, devices, and security tools (firewalls, antivirus software, proxies, etc.). An advanced SIM can generate alerts based on (simple) search criteria in the databases. At Reveelium, we use an Elastic/Graylog database to centralize the data we receive.
    • Example: a dangerous Windows event, an antivirus detection event
  • Reveelium SIEM (it also contains the SIM): This tool correlates the events it receives in order to detect attack tactics and/or techniques (see MITRE) or malicious activity, based on scenarios, threshold criteria, or numbers.
    • Example: A chain of alerts related to a Mitre threat.

Reveelium's correlation engine (3) can process various types of input: events, logs, alerts, threats from the AI engine, probabilistic threat results, or threat intelligence data. In contrast, basic SIEMs available on the market perform only simple correlation.

The Reveelium SIEM is integrated with our AI/UEBA engine, which enables it to:
– detect weak signals that cannot be detected by scenarios or patterns (such as ransomware, APT, etc.).
– reduce the number of false positives, thereby increasing the productivity of monitoring teams and reducing the noise generated by these false alerts.

The challenge is to process a very large amount of data and return the best detection—the one with the highest score—prioritized with the fewest false positives.

 

 

 

 

 

 

 

 

 

 

 

The Reveelium UEBA/Threat Hunting Engine: provides significant machine learning processing capabilities. It is capable of:

  • Detect abnormal behavior (1) based on events and logs from the SIM/SIEM.
    For example: unusual user behavior on proxies, unusual traffic on firewalls or DNS, or signs of a possible security breach.
    In this way, it identifies attack techniques that cannot be detected by conventional pattern- or scenario-based methods. Most UEBA SIEMs on the market are ill-equipped to handle these techniques. Reveelium is one of only five technologies in the world that incorporates these detection capabilities.

    • Example: Detection of a DGA during the spread of Petya in 2016, which prevented the ransomware attack that affected our client Saint-Gobain (60 million euros in potential losses)
  • Correlate (2) in a probabilistic manner (released in late 2020) all alerts, detected techniques, and threats, thanks to a "one-of-a-kind" behavioral engine
    • Example: Enable the detection of dangerous behavior among a very large number of events or alerts without relying on scenarios or patterns.
  • Score and Prioritize Threats (all identified malicious techniques and tactics) in order to reduce the time required for an operator to process them, shorten the response time, and enhance the detection capabilities of the blue team.
    • Example: Petya resulted in 3 threats scored at 80/100 instead of 300 alerts that were impossible to process.

Correlation engines (2) and (3) enable us to address the following problem identified by Gartner and our customers:

ITrust has been developing the AI-based behavioral and probabilistic detection engine since 2010. It is recognized by the market as a disruptive technology (see the awards it has received).

Reveelium SIEM and Reveelium UEBA/Threat Hunting work in coordination and share the same SIEM correlation engine and the probabilistic correlation engine (IA) to provide a powerful SOC (Security Operations Center):

  • better prioritization of detection
  • fewer false positives
  • a threat scoring system in the Mitre repository, which saves time and enhances detection capabilities, known as SOAR (with the addition of the Acsia EDR module)
  • an alerting system (The Hive)
  • A workflow and case management system for improved detection
  • The ability to integrate with a vulnerability scanner (IKare) and an EDR (ACSIA)
  • A reporting system that provides dashboards related to a specific activity: Health, PCI/DSS, regulatory compliance, etc.
  • KPIs (indicators) tailored to the profile of the individuals (managers, executives, or experts)