Name: Closing the Detection Gap: Smarter SOCs for the Asia Pacific Threat Landscape
Uploaded: 2025-12-05T07:30:05.118Z
Duration: 23 min 4 s
Description: Closing the Detection Gap: Smarter SOCs for the Asia Pacific Threat Landscape

Transcript for "Closing the Detection Gap: Smarter SOCs for the Asia Pacific Threat Landscape": Good day, everyone. Thank you for taking your time to participate in this webinar. My name is Eric, and I'm the sales engineer from Cymulate. So the topic for today's webinar will be on detection engineering and how Cymulate is able to empower the SOC team to act with confidence while addressing the challenge in closing the detection gap between what can be detected versus those that are not covered by your SOC currently. Let's take a look at today's agenda. There are a few areas that I would like to cover for this session, and we will start off by looking at the critical detection gaps that security professionals are facing on the ground. Next, we will dive in at the various phases or stages towards detection engineering. What are the exact score of works that our world detection engineers are performing, and why the challenges are essentially slowing down or hindering the overall process. And for the last two parts, I'll be showing you how our platform can help in addressing those key challenges and how you can incorporate our solution into your current detection engineering workflow. But before we begin with the session today, let's do a poll. And the question is, how confident are you in your organization ability to detect and response to emerging threats? So let's take a minute and let the answers comes in. Okay. So you can actually participate in the poll by going to the poll tab. Okay. I can see that there is a mixture of answers very well. For those that regularly test and validate your detection controls, we will explore how you can actually incorporate family into your testing and validation routine. And for those that have no current processes or doing it infrequently, you may also explore features within our platforms that may suit your needs in increasing your team's efficiency to mitigate against emerging threats through detection engineering. Okay. What we see here are several metrics taken from research studies conducted by security vendors that review some of the pinpoints that the detection engineering team faces. First off, 49% of the challenges actually comes from validating the effectiveness of the custom detection rules that were created, whether or not these custom detection rules are working as intended, of which 18% of the SIEM rules are broken in a way that could be due to a broken logic or issues with the data sources itself. And, usually, this kind of issue will only be surfaced when the team goes in and scrutinize the individual rule. Finally, it was also gathered that the average enterprise team only have detections for around 21% covering the MITRE ATT and CK framework. But, of course, we are not seeking to cover the entire framework. However, research found that there are actually potentials to increase the coverage based on the data sources that are already available in the environment. It is undeniable that detection rules are the main driver behind a sync platform. It is what that forms the correlation and triggers an alert. The process behind often requires, numerous efforts like manpower resources and time. For those that are not familiar with detection engineering, on screen here, you can see it's a typical work process. We showcase the various phases while developing a new detection rule with some elements of maintenance. Starting with data ingestion and telemetry collection, this phase mainly focuses on identification of all the relevant data sources within the environment, which can be, for example, an endpoint, servers, cloud workloads, or even network devices. The goal here is to build a rich and trustworthy data foundation that give us the visibility across our environment. Once we have these foundation set, we move into threat modeling and use case development. At this phase, we ask ourselves these questions like, what are the most important threats to my organization today? And how would these threats actually present themselves through the data they have collected? This is the part where most team will rely on a particular framework with the popular ones that might attack to map real attackers' behavior to the environment and design concrete use cases such as natural movement by RDP or suspicious privilege escalation. And from there, we derive the detection logic, which is the actual set of rules, queries, and conditions that will spot those behaviors in our logs. This might involve correlation across different factors like multiple data sources, threshold, or time based. With the detection logic defined, we'll then move into deploying the rule. From this phase onwards, from the moment the rule is being deployed, there will be a continuous effort to ensure that the rules are working as intended. Revisiting the challenge that we have discussed earlier on on validating custom detection rules, without the use of any tool to aid in testing, the detection engineers have to rely on observing and checking the performance of the deployed rules, fine tune the parameters, refine the logic while ensuring that it maintains a good detection coverage. Detection engineering demands continuous vigilance to adapt to incoming new threats. And without a solution that enables the team to continuously and effectively strengthen the detection engineering process, This will result in a dangerous mismatch between threat evolution and your detection capability. The struggle to maintain the efficacy of all the detection rules can be represented here on the weighing scale. The constant tension that the detection engineering or the SOC team is experiencing. First, do we write broad rules that catches everything but in return generate tons of false positive? Or we write something that is narrow and precise, but potentially miss critical threats. To be honest, neither of the extreme is actually safe, and bouncing between alert fatigue and blind spot is not sustainable for the team considering the effort that is required. And we are just taking away the precious time that the team needs to focus on the real threats. So now we have identified all the various challenges and pinpoints, I would like to share with you how Cymulate can help to accelerate detection engineering in a continuous and efficient way by allowing your team to enhance your current detection rules, scrutinize the alert logic, and expand your threat detection coverage with the help of automation and inbuilt AI to test and optimize detection at scale. First off, we can help you to address the challenge in rule validation with actionable insights that you can leverage on to optimize or create custom rules. You'll also be able to validate against the MITRE ATT and CK framework, which is also the foundational framework behind our platform. And also a visualization on your track coverage to pinpoint weak or missing detection rules that need to be fine tuned or create. So as mentioned previously, there is a constant need as part of the continuous improvement process in house to optimize and fine tune existing detection rules. Through our platform, you will be able to measure current rules that are pulled from your integrated SIEM platform to relevant attack scenarios that are within our library. Now let's take a look on how you can achieve this on our platform. When you log on to our platform and navigate to validate, you will come over to our simulated exposure validation page. So this is the area where you can find more than 96,000 unique attack scenarios within our library, and these scenarios are updated and curated almost on a daily basis by our internal research team. From here, apart from validating your existing SIEM rules, you will also find an extensive filtering option to sieve out the relevant scenario against your selection. Probably a particular APT group of interest to you maybe based on your geographical location of your businesses, or even diving straight into a specific MITRE attack techniques that you wish to validate against the various security controls that you have in your environment. But, of course, back to SIEM rules, you can simply simply just select your current rule from the drop down box here on the right to find the relevant scenarios for validation. The Simulate SIM rule validation feature helps you to ensure that your current SIM detection rules are effective and in line with real world threats. By importing rules from compatible SIM platforms, Cymulate leverages our inbuilt AI to automatically correlate each rule with relevant attack scenarios, removing the need for your team to actually manually map them. Once connected, you may conduct focus assessment to ensure that the alerts are generated as planned. And in the event if no alerts or events are identified, Cymulate generates a detection result that highlights the gap, allowing you to analyze and refine the rule. Mappings are updated automatically as new rules or scenarios are introduced or amended. So this is to ensure that your detection logic remains accurate and actionable, which help you in your continuous detection engineering efforts. To incorporate this feature into your existing workflow, you can start by importing your sim rules. Start by selecting those that doesn't fire or those that produce too much noises. Once selected, the summary AI will map the relevant scenarios for you to validate against, and from there, you can gather recommendations to optimize those validated rules. And to close-up the loop, simply just conduct continuous assessment against the rules for your new detections and update your rule base to counter the new emerging threats. So what comes after the validation? Of course, we touch on briefly on our platform capability to provide actionable insights. In any cases where the validation assessment returns a result where areas of improvement can be achieved. This is what you will see here on the screen. We provide a vendor neutral Sigma rules that you can use, for example, to check on the data sources required for this particular scenario that has been executed as part of the assessment. From here, we will recommend the exact rule that you need to address for the gap. And for further convenience, we do have an inbuilt sigma converter for you to convert the sigma rules into the syntax based on the SIM platform that you are currently using. And as part of the actionable insights, you will also see recommendations like this. Correlation based rules derived from the sigma rules used for different steps in the scenarios. These recommended rules are designed to trigger when multiple related events occur within a defined time frame. This is to ensure that your rules are optimized and we only alert when specific conditions are met according to the sequential action that will take place. From a single assessment standpoint, you will gain insights on these various information, such as your prevention and detection ratio, how well your prevention or detection controls are holding up against the scenarios that are executed. You will also be able to drill down and locate the findings that are broken down to the particular security controls that the scenario has validated against to get a more info and details that you can act upon to perform your remediation. As a result, these are the metrics and data that you can gather from the platform. By performing the same assessment after remediation, you can check your detection trend over time, How you currently fare against three or six months ago? How your SIEM or EDR is faring in terms of detection capability? What are the types of APT groups that may slip past your defense? By utilizing our platform to achieve continuous validation and assurance makes detection engineering become measurable, repeatable, and reliable. So before we go on to the last slide, I just want to do a poll again. This time around, the question will be, does your organization currently map detection to the MITRE ATT and CK framework? Okay. So I see there is still a mixture of answer of yes and occasionally. So MITRE ATTACK is definitely the framework of choice when it comes to threat detection and security program development. Not only does it give you a standardized and widely accepted language to describe attacker behaviors across the entire keychain, through mapping, you also see the gaps within your current detection capabilities. So as mentioned earlier in our previous slide, our platform is able to provide a visualization of your threat coverage against the MITRE ATT and CK framework within the dashboard that you see now. Our MITRE ATT and CK key map provides you a bird's eye view on your current threat detection coverage based on color coding, and this is not a static heatmap. However, you will be able to select a specific MITRE ATTINIC or subtechnic to find the associated scenarios that you can actually use to validate against. And you can even emulate specific real world threat actors' behavior and understand what your SOC can catch. Through this, Cymulate aims to help organization to shift from reactive to proactive detection by making threat modeling actionable. With this, you can see exactly which techniques you can detect, what are the blind spots, and which are other reviews, so you can prioritize the next detection to build. So I just went through the values that Cymulate wants to brings over to you and your team to enhance the detection engineering process and improve threat detection capabilities. To summarize, our objective is to enable your team to cut down the time that is required to build new detection rules, be it creating a new one or improve the existing rules with targeted guidance and recommendations. We also want to help in visualizing the threat detection gaps that you have in your environment and create the required detection logic to increase your MITRE attack coverage. And with the help of the platform capability to conduct automated and continuous validation, you will be able to appreciate the true state of your threat resilience on your environment. So for the next segment, let me just do a quick demo on our platform to show you the areas that we have covered earlier on and how you can actually validate your SIEM rules in just a few steps. K. Let me just pull out the screen. K. So after logging on to the platform and come over to the exposure validation page, you'll find our attack scenario workbench. This is also the area that was highlighted previously where you can find our library of more than 96,000 unique attack scenarios to date. And these scenarios here are single atomic scenarios that you can use to validate against your controls. And on the left panel here, you can find the comprehensive filtering options that you can use to slice and dice the 96,000 plus scenarios to find the ones that are relevant against your selection. And once you have integrated your SIEM platform, your current SIEM rules will be put and shown here. Simply just select the rules that you want to validate, and our inbuilt AI will map and show you the relevant scenarios that you can use to validate against the selected rules. To create an assessment, select the scenarios that you wish to execute. Yes. K. Select the scenarios that you want to execute. Click the create assessment button. And because I'm on the MSSP platform right now, I will have an additional page to select the account before I move on to the next one. And if you have multiple environment, simply just select the environment that you wish to conduct the assessment on and also the associated test agent. So for the agent test point, this is actually a single machine in your network that's installed with our simulate agent. So once you have finished up, you'll come to the last page. So at this page, you can either launch the assessment now or you can actually schedule to run it on a particular date and time or even set it on the repeated recurrent schedule. So once you have completed the assessment, you can come over to the assessment tab itself. So this is the place where you can file all the assessment report on all the completed assessment that you have done today. So let me just show you a report. K. Let me select this. So from the report, you'll get an overview information like which environment was it on and what are the various security controls that has been validated as part of this assessment, and also insights that provide a summary of the findings, detection, and prevention ratio, how well each pillar is actually doing against the executed assessment. So moving on, now this is the area where you can find actionable insights. Here, you can find all the related findings pertaining to this assessment itself. You can find a particular finding, click on more info, and you will come over to this page. From here, you can see that no event was found forwarded to the SIEM platform, meaning to say that the SIEM has failed to pick up the detection for this scenario itself. When you scroll down, this is where you can find the recommended mitigation. And when you click view, you'll be shown with the Cymulate context rule that you or your team members can use to create new detection rule or identify the data sources that are recommended. Simply just use our inbuilt signal converter or here on the right to convert the syntax based on the SIM platform that you are using. And once you have implemented all the necessary remediation action, you can run the same assessment again. So let me show you another set of report that is based on the same assessment. K. So what you see here right now is the new report that is based on the same assessment that was shown previously, and you may also find additional information such as the previous status of the same finding and whether or not your configured rules are working as intended. K. So with this, I've come to the end of today's webinar. I hope you have gained some insights on our platform capabilities, and, hopefully, there are areas that you may find useful for your current work process. And feel free to reach out to us if you have any more in-depth session or want to explore other use cases for our platform. Thank you, and have a nice day. K. So I have a last reminder. We have some documents and materials for you to learn more. Let me just show the screen again. So you can scan the QR code on screen to gather some of the gathered articles or the blog process that we have, or hop over to the document tab on the right. There you can see some of the data sheets that we have already prepared for you to download. K. So at the top, you can see that there is a get a demo button. You can also click that to actually get in touch with our team members to arrange for a session on the platform demo itself. Thank you.