Lion Cipher Lab
Deconflict SOC alerts against pentest activity to find the real attacker
- Penetration Testing / Red Team
- Intermediate
- ~35 min
- Free · no account required
Why it matters
When a penetration test is running, the client's security operations centre (SOC) sees a flood of attacks. The dangerous shortcut is to wave them all through: 'the pentest is on this week'. Real attackers do not pause for a test, and a busy test is excellent cover. NIST SP 800-115 says that if the presence of an adversary is found during an assessment, it should immediately be reported, and that the organization's incident response team may detect an incident caused either by the assessors or by a real adversary attacking while the assessment is in progress. The PCI SSC's penetration testing…
What you'll learn
- declaring tester source IPs and windows in the RoE
- matching alerts to logged test activity
- spotting tester activity outside the agreed window
- treating unexplained alerts as possible real attacks
- why 'the pentest is running, ignore it' is dangerous
- sharing the engagement log with the SOC safely
Steps in this lab
- Deconfliction needs two facts: who and when
- The test windows and the SOC's alerts
- Write the deconfliction check
- Run it: five explained, five not
- Make deconfliction routine