March 23, 2022

© 2022 SOC Prime Inc.

All rights reserved. This product and documentation related are protected by copyright and distributed under licenses restricting their use, copying, distribution, and decompilation. No part of this product or documentation related may be reproduced in any form or by any means without the prior written authorization of SOC Prime. While every precaution has been taken in the preparation of this book, SOC Prime assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice.

We are thrilled to announce the release of an onboarding wizard designed to make the experience with the SOC Prime Platform faster and simpler than ever. The newly released onboarding functionality has a modular structure and is aimed to drive more value to all SOC Prime users, more specifically:

The onboarding wizard is intended to deliver an improved user experience based on extensive customer feedback while boosting threat detection capabilities and increasing threat hunting velocity for each cybersecurity professional leveraging the SOC Prime Platform.

With this release, all new users who sign up for the SOC Prime Platform will be prompted to set up all required configurations after creating an account.

Security practitioners who have an existing account will see a notification at the top of each page prompting them to fill in the missing settings starting from the corresponding step. If you have already set up configurations required for proper platform use, they will be automatically populated on the wizard.

Here are the Onboarding Wizard steps depending on the selected security platform:

The onboarding process starts with the welcome screen where security practitioners are prompted to select the platform in use. The default settings display the most widely used security solutions, including Microsoft Sentinel, Chronicle Security, Splunk, Humio, Sumo Logic, Microsoft Defender for Endpoint, Securonix, the Elastic Stack, and legacy SIEM solutions like QRadar and ArcSight.

By clicking Show Other Platforms, you can see the full list of supported platforms:

To choose the platform, click the tile with the solution in use, and you will move to the Search Profile step. You can always change these settings and return to the initial step by clicking Change. The previously selected platform will be highlighted in green.

For a better user experience, the onboarding wizard displays the progress bar on the left on all screens following the platform selection:

Security practitioners can reach out to SOC Prime experts anytime they find challenges with the onboarding process in one of the following ways:

Also, we’ve provided the Tips section for each wizard step guiding SOC Prime users through the onboarding process. The walkthrough video guides and hints are at the customers’ disposal to make onboarding as simple as possible.

At this step, InfoSec practitioners are prompted to configure content search preferences based on the data sources available in their environment. For your convenience, these settings can be configured in two ways:

Here security practitioners should add the specific log source products monitored by the environment. To add certain items, start typing the name of the log source product in use, and the search will automatically return its full name. Once selected, you will see all log source products added to the settings on the fly.

Alternatively, the Search Profile step can be configured by first selecting the log source category from the list of predefined options, like “Access Management”, “Cloud (IaaS)”, “Cloud (SaaS)”, “Endpoint”, etc.

Once the category is selected, you can browse and add log source products that belong to it. Click the Plus icon next to the log source category, set the checkmarks against the items you monitor, and select Apply. You can select multiple log source categories with a number of log source products matching them.

All selected log source products will be automatically displayed next to the corresponding log source category.

After finishing the setup with the onboarding wizard, you can find the resulting Onboarding Search Profile in the Search Profiles section of the SOC Prime Platform. You can enhance it with additional details to make your search even more relevant.

This simple step is required for setting up a hunting environment to enable the SOC Prime users to drill down to search for threats in their environment using the Quick Hunt and Uncoder CTI modules.

By entering the required web address in the corresponding field, you are all set to take advantage of on-the-fly hunting capabilities available with SOC Prime’s Hunt modules.

Newcomers to the SOC Prime Platform who might need help with properly configuring the Platform URL settings are welcome to watch a short video in the Tips section on the right. We’ve added a brief video tutorial for each platform making it easier for SOC Prime users to complete this step.

At this step, security practitioners should indicate the indexes or tables where the log source data of the products provided in the Search Profile step is stored. This information ensures that detection content available in the Threat Detection Marketplace will work correctly even if the target environment uses non-default log source data locations.

Depending on the selected security platform, we offer up to three ways to identify the log sources:

After the onboarding setup is complete, you can find the mapping for each log source product as a separate profile in the Custom Field Mapping section of the SOC Prime Platform. In this profile, you can also add mappings for specific fields or even values.

Apply profiles manually on the Code tab of the content item page or set the Make Default checkmark in their settings to use them automatically.

This step is needed to personalize the user experience of the SOC Prime Platform. Security practitioners are prompted to select one or two of their main roles in their organizations.

The step is skippable, but if the professional roles are not set up, some features of the SOC Prime Platform might not work properly.

This step is about setting up a full-fledged API integration with the target environment. The link to the environment (if any) is pre-filled using the URL provided at the Platform URL step. Security practitioners need to fill in the rest of their credentials.

This integration is used to deploy detection content directly to the target environment from the Threat Detection Marketplace or automate content deployment with Continuous Content Management.

Once the onboarding process is complete, teams will be notified with the corresponding success notification.

We've significantly enhanced and redesigned the Custom Field Mapping module. Now, in addition to field names, it offers customization of table/index names and even field values.

Security practitioners can create mapping profiles that cover all possible customization needs related to non-default log source, field, and value names in the target environment. Such profiles ensure the proper work of the detection content from the SOC Prime Platform which is originally created for the default data schema settings.

In this section, you can name the profile and select the security platform for which it will be applied.

Select the log source product for which the profile will be applied.

Provide custom names used in the target environment for log source location (indices, tables, etc.), fields, or values. Select the corresponding tab and indicate the default and custom names.

You can also import field mappings using a CSV.

Custom data locations for each log source product provided during Onboarding are saved as a separate mapping profile.

The name of such a profile has the following pattern: security platform + log source product + (Onboarding)

To edit a profile, click the three-dot icon on the right and select Edit.

The information provided during Onboarding is pre-filled in the corresponding fields.

If, in addition to custom log source locations, you have non-default field names or need to customize field values, you can do it on the Fields or Values tabs.

In accordance with the updates in the Custom Field Mapping profile, Job settings in Continuous Content Management now show a checkbox Use Default Custom Field Mapping based on Log Source which is set by default.

To apply a different Custom Field Mapping, clear the checkbox and choose a profile in the dropdown that appears below.

Leveraging the SOC Prime Continuous Content Management (CCM) API, security engineers can stream detection logic directly into their LimaCharlie EDR/XDR environment. Using particular API queries and endpoints, teams can create Content Lists tailored to their security needs and automatically pull the most up-to-date detections from these lists. Detection algorithms can also be automatically optimized for operations by applying non-standard data schemas for scalable deployments and custom environment needs.

To take advantage of the automated content streaming capabilities, make sure the API access is enabled. For more details on how to set up relevant configurations and get started, download the guide for the latest version of the CCM API Integration Tool.

For more streamlined and intuitive content deployment, SOC Prime users can also take advantage of the FREE socprime add-on from LimaCharlie’s marketplace. SOC Prime users can leverage this add-on to choose pre-configured Content Lists to sync and enable them as D&R (detection and response) rules used to automate actions based on the real-time events in LimaCharlie.

First, security practitioners need to configure specific Content Lists via the SOC Prime’s CCM module so they can further pull detections from these lists to their LimaCharlie instance using the socprime add-on.

LimaCharlie users can leverage the following capabilities of Content Lists:

After setting up Content Lists in the SOC Prime’s platform, log into your LimaCharlie account to finish the configuration between two platforms and enable content streaming.

Go to the socprime add-on page to explore brief guidelines on how to enable CCM configuration in LimaCharlie via the Integrations page. For more details on how to set up add-on configurations in the LimaCharlie environment, read our partner blog post.

With this release, we've made the functionality of adding a content item to a Static Content List from the Code tab available for all supported security platforms. This makes using Continuous Content Management equally convenient for security experts relying on different technologies.

With this release, we’ve made the following key bug fixes and improvements to enhance the user experience with the SOC Prime Platform: