The Situation Room

We adopted the term ‘Situation Room’, often used by military and political establishments as an intelligence management center to monitor and deal with crisis situations.

The Samurai MDR Situation Room is where you will find detailed information for any given Security Incident reported to you and allows you to communicate with our SOC Analysts.

Enter The Situation Room

To enter the Situation Room, click a Security Incident reported to you from the Security Incident List.

See the Security Incidents article for additional information.

Figure 1: Example Situation Room

The Situation Room is structured as follows, click on the links to learn more:

Security Incident Information
Communication Channel
Details
Evidence

Security Incident Information

Figure 2 - Example incident information

To the left of the window, high level information about the Security Incident will be displayed, some of which is also summarized under the all Security Incidents menu. For clarity we have also included the field information below:

1. Incident Reference # / Title

Reference number of the Security Incident
A “one-liner” that describes the content of the reported Security Incident.

2. Severity

All Security Incidents are categorized with a severity that describes the reported threat.

Severity	Description
Critical	Security Incidents with severe impact that threatens to have a significant adverse impact on the affected systems. These issues have a high probability of spreading or propagating, pose a threat to confidential or otherwise sensitive data or system. Critical security incidents require immediate attention for remediation or mitigation.
High	Security incidents where if exploited, these threats could lead to compromise of the system and/or loss of information. Should be investigated in a timely fashion.
Medium	Minor security incidents with low risk of spreading or propagation. Should be tracked and followed-up but generally medium threat severity incidents require no immediate action.
Low	Observed security related event that could be an indicator of threat or interesting from other perspectives but no direct security incident or threat.

3. MITRE Categories

To make it easier to understand the threat and perform additional mitigation actions, we categorize a threat according to tactics in the MITRE ATT&CK IT and OT framework.

A threat can be categorized under multiple MITRE tactics.

For more details about MITRE ATT&CK tactics:
- IT: Enterprise Matrix
- OT: ICS Matrix
Reflecting the MITRE tactics, provides the possibility to use MITRE techniques to conduct additional threat hunting, respond and mitigate threats.

4. Status

Each Security Incident has an assigned status which quickly allows you to determine who is responsible for follow up.

State	Icon	Description
Awaiting Feedback		Security Incident has been created or updated and is awaiting your feedback / response
Awaiting SOC		Security Incident is currently awaiting feedback / input from the SOC.
Closed		The Security Incident is Closed.

7. Created

Date and time of creation of the Security Incident in the format [yyyy:mm:dd], [hh:mm:ss] with time represented in Universal Time Coordinated (UTC).

8. Summary

A short summary of the Security Incident.

Towards the top of the window additional information is displayed:

Figure 3 - Additional information

9. Revision

If a threat changes, emerges or new relevant information is available, a new revision of the Security Incident will be created and the revision number displayed. e.g Revision 2,3,4.
You are notified of any new revisions (which is also displayed within the Communication Channel) with the latest revision being displayed as default.
Selecting the drop down allows you to select the revision number which will update details and evidence appropriately.

10. PDF

Allows you to download the Security Incident and all details in PDF format.

11. Close Incident

Allows you to Close the Security Incident.

12. Status

Icon depiction of the current Security Incident Status. See item (4).

Communication Channel

The Communications Channel provides messaging functionality allowing you to communicate with SOC Analysts in real-time. The editor allows you to construct and format text as desired, your messages are displayed to the left of the Communications Channel whilst all SOC messages are displayed to the right.

Figure 4 - Communications channel

After typing your message ensure to click on

Send Message

Details

Security Incident details are included within this section as:

Recommendations

A set of actionable mitigation step(s) that can be performed by you to mitigate the threat and bring it to closure.

The Recommendations might not be the only way to mitigate the threat. Rather, they provide a suggested approach from the SOC. Ultimately, the choice of the most appropriate mitigation approach rests with the client. When performing mitigation, it is also necessary to understand risks associated with mitigation actions, as there could be impacts on availability and in some cases even data loss could occur. These kinds of impacts may either be known side-effects of mitigation or there may be potential risks associated with errors which could occur during mitigation.

Description

In this section, the SOC clearly describes the relevant threat and outlines why this poses a risk. The description includes steps and findings through the analysis process where the SOC has used enrichment data and performed Threat Hunting and correlation. The SOC will add Evidence data to support the findings.

The Incident Description can be short or extensive depending on the what is needed to accurately describe the reported threat and associated risk.

Evidence

Evidence is provided with any given Security Incident to corroborate a SOC analyst investigation and ultimately the Security Incident.

Evidence may be included by the SOC analysts or by a user and will display a timestamp of when it was added building a timeline. Evidence may include:

Alert data - vendor/product alerts and/or Samurai platform alerts
Log data- log data
Files - e.g PCAP files if available

You can also upload supporting evidence for the security incident, click on Upload File and provide a description (optional) and select the file to upload. The maximum size limit for the file is 50MB.

Selecting the drop down allows you to view or download the Evidence. For Log data you can pivot to Advanced Query by clicking the link to view the log data and complete further investigation as required.

What Now?

Please refer to our Incident Management process as it is important you understand what is expected of you in the result of a Security Incident as well as our responsibilities.