Automating Security Workflows with Rich Device Context

Automating Security Workflows with Rich Device Context

ORDR Systems Control Engine (SCE)

Digital transformation has brought many benefits to organizations, but also increased complexity and risk. Maintaining operations requires the collection, monitoring, and understanding of the status and behavior of thousands – if not hundreds of thousands – of managed and unmanaged devices. Security Information Event Management (SIEM) solutions correlate, normalize, and analyze device logs and other inputs to create a centralized repository of security events to give organizations a clear picture of their environment. SIEM solutions often serve as an organization’s security "nerve center," prioritizing and alerting on incidents that warrant further investigation or an immediate response.

Unfortunately, SIEM deployments often have two blind spots:

• Lack of visibility into connected devices that don’t produce logs, such as IoT, smart office, physical security, and medical equipment.
• Frequently do not provide detailed context about alerts, often reporting on IP or MAC addresses rather than human-friendly information like device names and classifications.

These gaps can increase the time to identify a threat, overlook critical information, and raise the workload of busy security analysts. That’s where ORDR Systems Control Engine (SCE) comes in.

ORDR Data Model: Inputs and Outputs

ORDR SCE sits at the center of an organization’s security and IT data, correlating a broad set of inputs with advanced machine learning for classification, behavior analytics, risk scoring, and policy modeling, then feeding enriched results out to the SIEM via API and Syslog.

Inputs ORDR Correlates

• Threat Feeds and OSINT, consumed via a Threat Intelligence Platform (STIX/TAXII)
• Network telemetry: Packets, Netflow/IPFIX, and Topology
• Security logs: Anti-Virus Logs, IDS/IPS Logs, and Firewall/VPN Logs
• Endpoint and data sources: Host, File, and DLP logs
• Infrastructure context: IPAM, Location, External API Data, and Microsoft Active Directory / WinRM / Kerberos

Output to the SIEM

ORDR consumes, compresses, and reduces the amount of high-availability data needed, then delivers enriched, correlated results to the SIEM via API and Syslog.

ORDR Systems Control Engine (SCE)

ORDR SCE is an IoT and unmanaged device security platform that discovers every connected device, profiles device behavior and risks, and automates security responses. ORDR not only identifies devices with vulnerabilities, weak passwords, expiring certificates, and active threats, but also those that exhibit malicious or suspicious behaviors. Finally, ORDR automates response for security and networking teams, such as dynamically generating policies and enforcing them on existing infrastructure, or alerting and triggering a specific security or operational workflow.

Through an agentless deployment, within just a few hours of installation – via a network tap or SPAN – ORDR passively discovers every network-connected device with detailed context: manufacturer, model, device type, network connectivity information, and more. ORDR then enriches this device context with threat intelligence, vulnerability data, and FDA/device manufacturer alerts, and incorporates it into the ORDR Data Lake for analytics, reporting, and granular classifications for every device.

Organizations can use ORDR’s rich device context and associated alarms to initiate specific workflow actions based on device type, group, manufacturer, model name and number, and more.

SIEM Integration with ORDR SCE

ORDR SCE integrates with SIEM solutions by transmitting security alerts, device information, and other critical information via the Syslog output format. The SIEM ingests the feed, parses the data into the proper fields, and allows SIEM users to leverage ORDR’s rich device data to create alerts, reports, and custom analyses.

ORDR SCE Provides Four Separate Syslog Feeds:

Device Information: Notifications of new devices on the network, updates to network information (e.g., IP addresses or VLAN assignments), and risk states. Including information such as manufacturer, model, serial number, and device type.

Security Incidents: Alerts spanning a wide array of issues, such as malicious behavior, software vulnerabilities, accesses to known bad URLs, and more. Alerts include severity ratings, device identifiers, and alarm IDs to query ORDR for additional information.

Audit Trail: Notifications of privileged user access to ORDR, password changes, user account creation, and similar events to ensure the ORDR system itself remains secure.

System Events: Reports of ORDR system health, sensor connections and disconnections, and configuration data.

Additionally, ORDR offers a robust REST API that provides even deeper access into device information, security alerts, network flows, and medical device utilization. These APIs allow enterprise developers or services personnel to further augment SIEM solutions that support API programmability. Such extensions could allow:

• Rapid lookup of IP and MAC addresses, so SOC analysts or SIEM users can quickly map threats and risks to specific device, manufacturer, and product names.
• Evaluation of network neighbors and related traffic to identify potential malware spread.
• Detailed security alert information to augment the Syslog reports.
• Understanding of medical device utilization to identify time windows for patching and security upgrades.

Benefits to a SIEM / ORDR Integration

• Integrate ORDR’s insights into connected device security risks into your organization’s "single pane of glass" security dashboard
• Increase efficiency for incident response (IR) workflows
• Identify security risks against device names, like "Axis P5532 Network Camera" instead of "AC:CC:8E:65:A6:B2"
• Complete visibility into every network-connected device, simplifying security, regulatory, and business reporting processes
• Integrates with SIEM solutions capable of parsing ingested syslog, including leading vendors such as Exabeam, Splunk, IBM QRadar, LogRhythm, Chronicle, and Micro Focus ArcSight

Case Study

An automotive parts manufacturer with more than 28 manufacturing plants, three technical centers, one software center and 13 customer service centers, serving more than 60 customers in every major region of the world including BMW, Ford, GM, Toyota, VW, and more, recently needed to address their managed and unmanaged device security risks.

Their environment included complex devices from infotainment (e.g., media players, in-car navigation, telematics, etc.) to fleet management and machine sensors. The team faced the daunting challenge of discovering and inventorying these managed and unmanaged devices, understanding the device behaviors and risks, then integrating this context into their IR workflow. ORDR mapped well to their key security requirements and the NIST Cyber Security Framework principles of Identify, Detect & Protect. Integrating ORDR with their existing SIEM solution allowed them to transform their IR workflow to incorporate rich device context to quickly and effectively triage incidents.