Software - Example

 


(Author's Screenshot)

In this post, I will explain how the software works. As it is displayed above, the search firstly identifies two clusters of alerting that contain malware. Then, choosing the lower alert group that shows an outer source (Germany) gives more details to see (bricata,2021).




(Author's Screenshot)


Then it will be shown a Summary Timeline of all alerts in the cluster. We can look at those individual alerts by clicking See Group Alerts (bricata,2021).







(bricata,2021).

As you can see here, these shown alerts tell a pretty clear story of a potentially malicious file being downloaded from an external website. Signatures identifying the suspicious download have alerted 3 times. Subsequently, Bricata has caught the file and specified it as ‘Suspected Malware’ We can see the individual alert by clicking Suspected Malware (bricata,2021).






Reference:

BRICATA (2021) BRICATA PRODUCT . [Online] BRICATA. Available from:Tour the Dashboard - Bricata Network Detection & Response Platform [Accessed 05/06/21].

0 Comments