Retour 
We have built a Security Operations Center at Netskope in short order. Facing the vast expanse of the Security Operations ocean, I grabbed my board with my team and focused on doing a few things really well. We documented workflows, expanded our visibility, and tuned monitoring systems. We paddled out from shore, braving the shark-infested waters of the threat landscape. Of course, with many tools comes many threat data sources, and as expected, the threat data ingestion tidal wave quickly manifested itself.
Testing the waters
Our SOC, like most, operates in an extremely fast-moving environment with shiny objects everywhere. We are constantly asked to look at the latest technology, most of which are just little swells that won’t become waves and aren’t worth the energy to surf. I am always interested in checking out new technology to understand the potential fit. But if you can’t explain the use case to me in 30 minutes, I move on. I surf big waves. This is a story of a swell that quickly turned into a big wave for my team.
A big wave
When approaching the topic of orchestrating static indicators of compromise such as hashes, IP addresses, and domains, I was introduced to an in-house solution: Cloud Threat Exchange (CTE). CTE is a module that runs in a lightweight collection of Docker applications, named Cloud Exchange, that ingests, manages, and shares IP addresses, domains, and file hashes. It’s free, too.
My team and I pushed up from our boards. After careful research of our own environment and prioritizing the many threat data routing options available to us, we deployed our own instance in the SOC and started connecting key data points.
Hanging ten
We are now routing high-fidelity threat data multi-directionally and in near-real-time between our Netskope instance and other monitoring points, such as EDR and our email gateway. Furthermore, we are channeling certain output for incorporation into the Netskope threat detection engine. We are up on our boards and carving a ride on the wave.
We are not drowning. We are routing threat data faster than ever and you can too. We are up on our boards and can see the threats below the surface sooner. This protects Netskope AND drives improvements in our own threat detection engine to protect our customers.
How it works
Sharing threat intelligence is configurable between any two connected systems. For instance, we can facilitate sharing between different endpoint providers or even multiple Netskope cloud tenants. As threat intelligence and IOCs are received via CTE, we can enforce real-time security enforcement, blocking user access to malicious sites or files that can endanger our security posture. The possibilities are truly mind-boggling.
Consider this diagram an example of how we think about using CTE for automated indicator routing in the SOC: