Partner Spotlight: Get a Complete Threat View With Cisco Umbrella Investigate

Editor’s Note

This is part of a series of blog posts on useful “all-source analysis” research and collaborative approaches using Recorded Future and our OMNI Intelligence Partners.

Summary

Cisco Umbrella Investigate’s threat intelligence on domains, IPs, ASNs, and file hashes can be accessed via an extension built into Recorded Future Intel Cards. Starting with a single piece of data, incident responders can query and find associated domains, IPs, ASNs, and file hashes, drill down on specific behavior indicators, and pivot directly into the Investigate console for additional research. In a single correlated source, Investigate’s threat intelligence enables security teams to uncover threats and tighten the gap between threat detection and remediation.

Challenge

Many security products provide visibility into what’s happening on your own network. But what about the rest of the internet? What about everything going on beyond your perimeter?

News flash — that’s where attackers are staging infrastructure in preparation for launching attacks.

Many organizations have little or no visibility into global internet and attacker trends, including what infrastructure attackers are staging or leveraging on the internet to launch attacks. Additionally, they find it difficult to prioritize incident investigations because they’re overloaded with alerts and lack the context to determine which security incidents would have the most impact on the business.

Solution

Prior to launching a campaign, attackers need to pay for, build, or borrow the infrastructure needed. For example, they set up servers, obtain or reuse IP addresses, and register domains to use. This often happens before they even perform reconnaissance on their targets or create the malicious payload. In most cases, attackers are pretty sloppy criminals, leaving behind fingerprints and breadcrumbs.

That’s where Cisco Umbrella Investigate can help — it tracks down attackers and provides the most complete view of an attacker’s internet infrastructure, enabling security teams to discover malicious domains, IPs, and file hashes, and even predict emergent threats.

As analysts use Recorded Future’s Intel Cards to research emerging threats or review new alerts, they can quickly tap into Investigate’s wealth of infrastructure information with a single click.

Intel Card	Extension
IP Address	Available
Domain	Available
Hash	Available

Example

An analyst receives a SIEM alert for suspicious activity linked with the IP address 58.158.177.102. Before deciding on a course of action, the analyst has to research this indicator, and with a quick click, is able to pull up the following Recorded Future Intel Card:

Recorded Future Intel Card for IP address 58.158.177.102.

According to Recorded Future, this is a “malicious” IP, with plenty of evidence across a variety of sources to support this assessment. One easy route to gain further insight is to use the Cisco Umbrella Investigate extension. For this particular IP address, the following is what Cisco Umbrella Investigate has:

A partial response returned by the Cisco Umbrella Investigate extension in Recorded Future’s IP Intel Card.

In addition to the various malicious domains linked to this IP address, there are several malware samples that Investigate associates with it; as shown above, these samples are all from the “Ramnit” malware family. A quick look at the Ramnit Malware Intel Card gives the analyst a better idea of what this malware is about, as well as a sense of recent chatter volume related to it: Read More https://www.recordedfuture.com/partner-spotlight-cisco-umbrella/