Many organizations struggle to understand malicious activity and its effects when a security incident is in progress. This consumes time and resources defenders need to contain the attack and minimize damage. However, a new open source tool built to increase visibility into suspicious activity detected by organizations aims to alleviate that pain.

Detectree, developed by WithSecure, is a detection visualization tool for cybersecurity defense teams (also known as blue teams). According Tom Barrowa senior threat hunter at WithSecure.

“Visibility is always a priority, but absolutely vital when responding to an incident,” Barrow explained. “Time is always against incident responders. And looking through rows of textual data and making connections between them and the suspicious activity under investigation is time spent not solving the problem, which is a real waste when you’re under pressure. to stop an attack.

For example, if an analyst tries to find the cause of a suspicious process, they usually have to go through the log data and manually reconstruct the chain of events. The longer the chain, the more difficult and time-consuming it becomes to manage. And given the number of security alerts blue teams in large enterprises can face, it’s a process that can overwhelm security teams and exacerbate issues like alert fatigue and burnout. professional.

Detectree was designed to help blue teams simplify investigative work by structuring log data into a visualization that shows relationships between detected suspicious activity and any processes, network destinations, files, or registry keys connected to it. this detection.

Rather than manually sorting the data represented as text to reconstruct a chain of events, stakeholders can consult the visualization to see not only the connections, but also the nature of the connections, including interactions, parent-child relationships and process injections.

Relying on visualization allows responders to quickly see the context surrounding a detection and share that data with relevant stakeholders in a simple and intuitive way to ensure the information is accessible to everyone who needs it. .

“Even the most experienced and skilled blue teams need tools to help them do their job well. Detectree is a simple tool, but it tackles real issues that make work unnecessarily difficult and time-consuming for security teams,” he said.