Riba:
- Fahimtar cewa basirar wucin gadi yana hanzarta amsawa tare da taƙaitaccen shaida, kafa tsarin lokaci, rarrabuwar tushen tushen da rubuta littafin wasan kwaikwayo, amma yanke shawarar ware/kulle/rufe/sanarwa na ƙungiyar da aka ba da izini.
- Ikon kimanta zaɓuɓɓukan ƙulli dangane da tasirin kasuwanci da jujjuyawa kuma ba ware muhimman abubuwan more rayuwa ba tare da auna tasirin sa ba.
- Ikon fahimtar cewa saurin dawowa ba zai iya shawo kan adana shaida ba (hoton forensic, sarkar shaida) kuma ba za a iya canza matakan bincike zuwa hankali na wucin gadi ba.
Lokacin da lamarin tsaro ya tashi, lokaci shine abokan gaba. Yayin da ransomware ya fara yaduwa, yana nufin ƙarin injunan ɓoyayyiyar injuna a kowane minti daya; Da zarar an lalata wani asusu, maharin yana zurfafa zurfafawa kowane minti daya. Amsar abin da ya faru (IR a takaice) shine tsarin gano abin da ya faru na tsaro, iyakance shi, tsaftace shi da mayar da shi zuwa al'ada. IR yana buƙatar yanke shawara a ƙarƙashin matsin lamba, tare da cikakkun bayanai, kuma tare da agogo; Shi ya sa dole ne ya zama mai sauri da kuma horo.
AI yana kawo saurin da ba ta da amfani ga IR: da sauri yana taƙaita bayanan da aka tarwatsa (rubutun bayanai, faɗakarwa, bayanan EDR), ya kafa tsarin lokaci na taron, yana ƙididdige tushen dalilin da zai yiwu, ya samar da daftarin littafin wasa (wanda aka riga aka ayyana mataki-mataki jagorar shiga tsakani) da kuma bayyana rahoton bayan shiga tsakani. Amma mafi mahimmancin yanke shawara a cikin IR - ware tsarin daga hanyar sadarwa, kulle asusu, rufe uwar garken, sharewa ko adana shaida - yanke shawara ne da za a iya juyawa, haifar da katsewar kasuwanci, da tasiri tsarin shari'a. Ba za a iya wakilta waɗannan zuwa AI ba. AI shine injin bincike da tsarawa a cikin IR; Shawarar kan keɓewa, kullewa, rufewa da sanarwa na cikin ƙwararrun ƙungiyar mayar da martani.
Matakan mayar da martani
Tsarin gama gari a masana'antar (dangane da NIST) matakai shida ne. A kowane mataki, taimako da iyaka na AI ya bambanta:
- Shiri: Littattafan wasan kwaikwayo, matsayi, shirin sadarwa suna shirye a gaba. AI yana taimakawa samar da littattafan wasan kwaikwayo da wasan motsa jiki - kafin taron, maimakon a yanzu.
- Ganewa & Bincike: An tabbatar da taron kuma an ƙayyade iyakarsa. AI yana taƙaita shaidar, yana kafa tsarin lokaci, kuma ya lissafa tushen hasashe. Mai sharhi ya yanke shawara.
- Abun ciki: An daina yadawa (keɓewa, kulle asusu). Wannan yanke shawara mai mahimmanci na mutane ne; AI kawai ke lissafin zaɓuɓɓuka da tasirin su.
- Gogewa: An share ɓarna, bayan gida, asusun da aka yi sulhu. AI yana samar da jerin abubuwan dubawa; aiwatarwa da tabbatarwa mutane ne.
- Farfadowa: Ana dawo da tsarin kuma ana kulawa ta hanyar sarrafawa. AI ta ba da shawarar tsarin sa ido.
- Darussan da aka koya: Tushen dalili, tsarin lokaci, ingantawa. AI yana samar da daftarin rahotanni da shawarwarin ingantawa; Yana kan tawagar amincewa.
Sharuɗɗan: EDR (Ganowar Ƙarshen Ƙarshen da Amsa - software da ke aiki a kan wuraren ƙarshe, watau kwamfutoci, kuma za ta iya ganowa da amsa halin da ake tuhuma). Tushen tushen shine ainihin wurin farawa na taron ("Yaya suka shiga da farko?"). Sarkar tsare bayanai ne mara katsewa na wanda, ta yaya da kuma lokacin da aka tattara bayanan bincike; Yana da mahimmanci a tsarin shari'a. MTTR (Ma'anar Lokacin Amsa) shine ma'aunin aikin ƙungiyar IR.
Tebur ikon yanke hukunci
IR aiki
Matsayin AI
Wanene ya yanke shawara
Me yasa
Takaitacciyar shaida, tsarin lokaci
furodusa, hanzari
Manazarci ya tabbatar
Hadarin hallucinations
Tushen yana haifar da hasashe
Tsara, shawara
manazarci
Ana buƙatar magana da shaida
Daftarin littafin Playbook (a da)
sketch janareta
Shugaban IR ya tabbatar
Aiwatar da aiki
Ware tsarin
Zaɓuɓɓukan jeri kawai
manazarci mai izini
Katsewar kasuwanci, dawowa
Kulle asusu
Yana ba da nazarin tasiri
manazarci mai izini
Kulle kuskure yana dakatar da aiki
Share/kiyaye shaida
Gargaɗi, shawarwari
Shugaban IR + doka
An shafi tsarin shari'a
Sanarwa na doka/ka'ida
daftarin marubuci
Dokar + gudanarwa
Alhaki na shari'a
uku mini lokuta
Case 1 - Takaitacciyar taƙaitawa a ƙarƙashin matsin lamba. Faɗakarwar ransomware tana zuwa da ƙarfe 2:40 na safe. Manazarci yana ba EDR da rajistan ayyukan tacewar zaɓi (ta hanyar ɓoye suna) ga AI. AI tana gina tsarin lokaci kowane daƙiƙa 90: "01:55 an buɗe abin da aka makala phishing, 02:10 An saukar da PowerShell, 02:30 an fara motsi na gefe, inji 3 abin ya shafa." Manazarci ya tabbatar da wannan sarkar tare da ingantaccen rikodin EDR, ya keɓance injinan 3 da abin ya shafa bisa ga ra'ayinsa, kuma ya dakatar da yaduwar. AI ya rage minti 20 na shaidar karantawa zuwa 90 seconds; Manazarcin ya yanke shawarar keɓewa.
Harka 2 - Ba daidai ba shawarar keɓewa. A wani yanayi, AI ta ce, "Tsarin zirga-zirga daga IC_HOST_7 yana da shakku, keɓe." Manazarci yana duba mahallin: IC_HOST_7 shine babban sabar tabbatar da kungiyar; Idan keɓe, duk ma'aikata suna daina shiga. Haka kuma, dalilin zirga-zirga shine ingantaccen madadin. Manazarcin ba ya ware, a madadin kawai yana sa ido kan mahaɗin da ake tuhuma. Darasi: Ba za a iya aiwatar da shawarar keɓewar AI ba tare da sanin tasirin kasuwanci ba; Don mahimman abubuwan more rayuwa, yanke shawara a hankali ɗan adam ne.
Case 3 - Hatsari da lalata shaida. Wata ƙungiya, a cikin gaggawa don tsaftacewa, ta tambayi AI "ta yaya zan tsaftace wannan injin da sauri?" yana tambaya; AI yana ba da damar sake shigar da tsarin. Amma na'urar ta ƙunshi shaidun bincike (zubawar ƙwaƙwalwar ajiya, kayan aikin kai hari) waɗanda har yanzu ba a tattara su ba; reinstallation zai lalata sarkar shaida. Babban manazarci da farko ya tabbatar da cewa an ɗauki hoton (kwafin shari'a) sannan a wanke shi. Darasi: Saurin farfadowa ba zai iya haifar da adana shaida ba; ba a wakilta matakan shari'a ga AI.
Rauni mai ƙarfi / Ƙarfi mai ƙarfi
Rawanin faɗakarwa:
Akwai harin fansa, me zan yi? Wadanne inji zan kashe?
Wannan saurin yana neman AI don yanke shawara na aiki kai tsaye (wanda injin zai rufe), ba shi da mahallin, babu tasirin kasuwanci, kuma babu shaida. AI yana ba da umarni na gaba ɗaya ko mai haɗari; Idan aka yi amfani da shi a makance, aikin zai tsaya ko kuma shaida ta bace.
Ƙarfi mai ƙarfi:
Matsayinku: mataimaki wanda ke ba da NAZARI da ZABBU ga ƙungiyar amsawar lamarin. Kada ku yanke shawara; kar a ba da oda "kashe/keɓe waccan na'ura", kawai jera zaɓuɓɓuka da yuwuwar tasirin kowane. Gudanar da waɗannan shaidun da ba a san su ba: [EDR / taƙaitaccen log] Ayyukanku: (1) gina tsarin lokaci mai yiwuwa, nuna shaidar da kuka kafa kowane mataki a kai, yi alama wanda ba shi da tushe a matsayin "[dole ne a tabbatar da shi]", (2) jeri 3 tushen tushen hasashe, rubuta yadda za a gwada kowane, (3) jerin abubuwan da ke tattare da zaɓaɓɓu (keɓewa, saka idanu, rufe tasirin kasuwanci); bar yanke shawara gareni, (4) tunatar da ni matakan da ake buƙata don adana shaida KAFIN keɓewa.
Ƙarfin buƙata yana iyakance AI a matsayin mai ba da zaɓi, yana ɗaure shi da shaida, yana jaddada tasirin kasuwanci da adana shaida, kuma yana barin yanke shawara ga mutane.
Samfuran gaggawar da za a iya kwafi
SAFIYA TIMELINE TEMPLATE Gina jerin lokutan aukuwa na lokaci daga wannan shaidar IR da ba a san sunanta ba. Kowane layi: [lokaci] [wakilin] [tushen shaida]. Ƙara mataki ba tare da tambarin lokaci ko hujja ba; sanya alamar a matsayin "[bace - dole ne a tattara]". Shawara/shawarwari, matsayi bisa shaida kawai. Shaida: [manna]
Tushen HYPOTHESIS TEMPLATE Ƙirƙirar 3-5 mafi kusantar tushen tushen hasashe don wannan taron. Ga kowace hasashe: (1) shaidar da ta ginu a kai, (2) ƙarin shaidar da za a tattara don tabbatar da ita, (3) duk wata alama da ake tsammani idan ta kasance gaskiya. Kada ka bayyana ko ɗaya daga cikinsu tabbatacce; Yi amfani da yaren yuwuwar. Takaitaccen taron: [manna]
ZABI NA KWANAKI TEMPLATELIƙira zaɓukan ƙunshe don yanayi mai zuwa (keɓewa / saka idanu / kulle / sashi). Don KOWANNE zaɓi: tasirin kasuwanci, wahalar dawowa, tasiri akan shaida, haɗarin haɗari. Kada ku ba ni umarni; Zan yanke shawara. Ya dace musamman idan an haɗa mahimman abubuwan more rayuwa (bayani, DNS, madadin). Matsayi: [manna]
TEMPLATE LITTAFI MAI WASA (shiri kafin aukuwa)Don yanayi mai zuwa [misali. aikin daidaitawa ta imel] rubuta littafin shiga mataki-mataki-DRAFT: faɗakarwa, matsayi, tsarewa, lalata, farfadowa, lamba, matakan sanarwa. Sanya alamar "[yardar ɗan adam]" kusa da kowane yanke shawara mai mahimmanci. Wannan daftarin ba zai fara aiki ba tare da amincewar shugaban IR ba.
Kuskuren gama gari
- Bari AI ta yanke shawarar aiki. Tambayar "Wane inji zan kashe" yana cikin ƙungiyar da ta san tasirin kasuwanci, ba ga AI ba; AI kawai yana ba da zaɓi da tasiri.
- Share shaida ba tare da tattara ta ba. Rusa shaidun shari'a don gudun abin da ba zai iya jurewa ba; Juye hoto da ƙwaƙwalwar ajiya kafin warewa/tsaftacewa.
- Shigo da tsarin lokaci cikin rahoton ba tare da tabbatar da shi ba. AI na iya yin jerin abubuwan da suka faru; Tabbatar da kowane mataki tare da tabbataccen shaida.
- Ware muhimman ababen more rayuwa ba tare da tunani ba. Ware ainihi, DNS, uwar garken madadin na iya kawo ƙarshen ƙungiyar gaba ɗaya; auna tasirin farko.
- Rubuta littafin Playbook a karon farko a lokacin da abin ya faru. An yi littafin wasan kwaikwayo a lokacin shiri; Ƙoƙarin rubuta daga karce a lokacin da abin ya faru yana haifar da firgita da kurakurai.
Tukwici: A cikin IR, koyaushe ku gaya wa AI "jerin zaɓuɓɓuka da tasirin su, bari in yanke shawara." Wannan jumla ɗaya tana juya AI daga “autopilot” mai haɗari zuwa “mai ba da shawara.”
Tsanaki: Ware tsari, kulle asusu ko share shaida na iya haifar da sakamako mara jurewa kuma yana shafar tsarin shari'a/na shari'a. Ana yin waɗannan yanke shawara tare da amincewar ƙungiyar amsawa mai izini kuma, idan ya cancanta, doka da gudanarwa; Fitowar AI shawara ce, ba oda ba.
a takaice
Amsar abin da ya faru yana buƙatar yanke shawara cikin sauri da ladabtarwa a ƙarƙashin matsin lamba kuma tare da titin agogo. AI yana haɓaka wannan saurin tare da taƙaitaccen shaida, gina tsarin lokaci, tushen tushen rarrabuwa, da tsara littafin wasan kwaikwayo. Amma mafi mahimmancin ayyuka na IR-keɓancewa, kulle asusu, rufewar tsarin, sharewa / adana shaida, sanarwar doka- yanke shawara ne da ba za a iya jurewa ba waɗanda ke haifar da katsewar kasuwanci da sakamakon shari'a kuma ba za a iya wakilta ga AI ba. A cikin kowane nau'i na shida (shiri, ganowa, tsarewa, lalata, ceto, darasi), AI yana samar da bincike da tsari; Yanke shawarar na ƙungiyar da aka ba da izini. Dokokin zinariya guda biyu: tsaftace shaida ba tare da kiyaye ta ba, ware muhimman abubuwan more rayuwa ba tare da auna tasirinta ba.
Aikin aikace-aikace
Zaɓi yanayin yanayi (misali ɗaukar asusu bayan phishing). Bayyana wani bincike daga AI tare da samfuran "Tsarin Lokaci" da "Tsarin Tushen Hatsari"; Rubuta shaidar da za ku yi amfani da ita don tabbatar da kowane mataki na lokaci. Sa'an nan, tare da samfurin "Ƙarancin Zaɓuɓɓuka", da zarar kuna da zaɓuɓɓuka masu iyakance guda uku, kimanta tasirin kasuwancin kowane kanku kuma ku lura da wanda za ku zaɓa da kuma dalilin da ya sa (kuma abin da za ku fara yi don adana shaida).
jerin abubuwan dubawa
- [ ] Na iyakance AI a matsayin zaɓi / uwar garken bincike; Na yanke shawarar aiki.
- [ ] Na tabbatar da kowane mataki na lokaci tare da kwararan hujjoji, na kawar da ƙirƙira.
- [] Na shirya tarin shaida (hoto, juji na ƙwaƙwalwar ajiya) mataki kafin warewa / tsaftacewa.
- [ ] Na fara auna tasirin kasuwancin keɓe don mahimman abubuwan more rayuwa.
- [ ] Na bi da tushen tushen hasashe a matsayin yiwuwar gwadawa, ba a matsayin tabbatacce ba.
- [ ] Na shirya littafin Playbook kafin taron kuma na mika shi ga shugaban IR don amincewa.
- [ ] Na haɗa da izinin doka/Gudanarwa a cikin lamuran da ake buƙatar sanarwar doka.