One of the most time-consuming steps while implementing a SIEM solution is writing and tuning "Playbook" document – a set of reaction procedures SOC Team has to follow in case of alert triggering.

During one of our implementation projects I stoped for a moment and thought: how can I optimize (ideally automate) the Playbook execution – in a playful way?

<cut/>

First of all – how does Playbook looks like? Here is a basic snippet of this document:

One of the ideas I could come up with was – hey, why don't we add some AI on top of it? Everyone is doing AI nowadays, isn't it? Can we automate SOC activities with some extra help of a Chatbot?

TensorFlow is one of the well known free and open-source libraries available for machine learning and deep neural networks and it was the first thing to investigate.

OK, now I forgot to mention one substantial fact – our SIEM solution (Enterprise Threat Detection, or SAP ETD) comes from SAP SE, which means this SIEM solution runs on SAP HANA as a platform. How can I integrate Tensorflow into HANA platform?

Quick research confirmed that it was possible:

Tensorflow Machine Learning Model Integration with SAP HANA

Nowadays we can integrate TensorFlow even with ABAP environment:

How To Use TensorFlow Seamlessly Inside ABAP

OK, Google, that goes far beyond my humble research..

So I decided to focus on end-to-end solutions. Let's try to make use of SAP Conversational AI (CAI). Luckily, there is a trial service available, hopefully no programming skills is necessary.

Now that I am logged onto a trial version CAI, let's create a "performing actions" Chatbot named "SEC", which would be (at least) able to participate in some basic discussions, such as greetings, small talks and weather:

This newly born bot is already able to do some basic activities, but let's add some extra security-relevant capabilities (intents) to it:

Initiator – collect information about attacker's terminal id
Username – collect information about attacker's username
System – collect information about attacker's system
Inform – inform SAP Basis Team about possible attacker in their system
Alert – collect information about triggered alert

Now we group these new "intents" into new "skills" so that our bot would be able to "register alerts" and "talk to basis":

The last thing I want to do is of course bot training:

When training is finished I can test the bot:

When the bot says "We have blocked this terminal..." that's no joke because one of the "talk to basis" skills was calling external APIs:

What do you think of Chatbot helping SOC Team registering alerts and reacting to threats? Tell in comments

Chatbox on Top of SIEM Solution