Detectree: Open Source Tool Simplifies Data Analysis for Blue Teams and Reduces Alert Fatigue
Many organizations struggle to understand malicious activity and its effects when a security incident is in progress. This consumes time and resources defenders need to contain the attack and minimize damage. However, a new open-source tool designed to increase visibility into suspicious activity detected by organizations aims to ease that pain.
Detectree, developed by WithSecure, is a detection visualization tool for cybersecurity defense teams (also known as blue teams).
“Visibility is always a priority, but it’s absolutely vital when responding to an incident,” explained Tom Barrow, a senior threat hunter at WithSecure. “Time is always working against incident responders. And looking through rows of textual data and making connections between it and the suspicious activity under investigation is time spent not resolving the problem, which is a real waste when you’re under pressure to stop an attack.
For example, if an analyst tries to find the cause of a suspicious process, they usually have to go through the log data and manually reconstruct the chain of events. The longer the chain, the more difficult and time-consuming it becomes to manage. And given the number of security alerts blue teams in large enterprises can face, it’s a process that can overwhelm security teams and exacerbate issues like alert fatigue and burnout. professional.
Detectree was designed to help blue teams simplify investigative work by structuring log data into a visualization that shows relationships between detected suspicious activity and any processes, network destinations, files, or registry keys connected to it. this detection.
Rather than manually sorting the data represented as text to reconstruct a chain of events, stakeholders can consult the visualization to see not only the connections, but also the nature of the connections, including interactions, parent-child relationships and process injections.
Relying on visualization allows responders to quickly see the context surrounding a detection and share that data with relevant stakeholders in a simple and intuitive way to ensure the information is accessible to everyone who needs it. .
“Even the most experienced and skilled blue teams need tools to help them do their job well. Detectree is a simple tool, but it tackles real issues that make work unnecessarily difficult and time-consuming for security teams,” he said.