Configure the Data Access Abuse Use Case

Configure Exabeam Security Operations Platform to protect your environment against the Data Access Abuse use case. Ensure that you collect the right data, set up investigation tools, enable response mechanisms, and import relevant Data Lake reports.

To protect against a use case, you might follow an end-to-end workflow that looks like:

Collect – Ensure that you bring in the correct logs for the use case and that all fields populate.
Detect – Use out-of-the-box rules and models to identify suspicious activity.
Investigate – Ask important questions about the data from log sources, rules, and models.
Respond – Isolate, neutralize, eliminate, and mitigate any threats you find.
Report – Gather all the evidence in a report so you can share your investigation with others or use for compliance purposes.

Let's configure everything you need to successfully follow each stage of this workflow.

Collect

Collect the data needed to investigate the Data Access Abuse use case and ensure all context tables are populated correctly.

Ensure that you contacted Exabeam Customer Success and they helped you onboard and validate the log sources needed to implement the Data Access Abuse use case.
Ensure that you have specific out-of-the-box context tables:
- sourcecode_file_extensions
- user_is_executive
- user_is_privileged
Create a custom context table for network zones.
Ensure that users and assets have the correct labels based on the context tables. For example, if a user is in the user_is_privileged context table, navigate to the user's profile to verify they have the privileged label.

Detect

Ensure you have all mechanisms in place, like rules, models, watchlists, and Threat Hunter searches, to successfully identify suspicious activity.

Rules and models

Validate out-of-the-box rules and models to ensure you accurately detect anomalous activity.

Import the latest content packages on the Exabeam Community. These content packages contain the latest rules and models, which aren't available to install in Content Updates settings. You must download them from the Exabeam Community, then import them.
Ensure that related rules and models are triggering correctly.

Threat Hunter searches

To quickly search for events that may indicate someone is abusing their data access, create and save the suggested Threat Hunter search queries.

Threat Hunter search	Search criteria
Users who accessed an abnormally high number of files	Reasons: FA-UFCOUNT FA-UR-A FA-URCOUNT-A FA-UWCOUNT-A Dates – Last 7 days
Users who accessed applications or databases for the first time	Reasons: DB-DbU-F DB-UDbH-F DB-UDbI-F DB-UDbO-F APP-UappA-F APP-UOb-F Dates – Last 7 days
Users exhibiting MITRE ATT&CK^® Collection tactics, techniques, and procedures (TTPs)^[a]	Rule Tags: Collection Automated Collection Email Collection Dates – Last 7 days
Users suspected of leaving who accessed new/abnormal files, file shares, databases, or applications	User Labels – Suspected Leavers Reasons: SA-US-AU FA-GD-A FA-GD-F FA-OG-A FA-OG-F FA-OU-A FA-OU-F FA-SFU-A FA-SFU-F FA-UA-A FA-UA-F FA-UD-A FA-UD-F FA-UH-A FA-UH-F FA-UZ-A FA-UZ-F DB-DbG-A DB-DbG-F DB-DbU-A DB-DbU-F DB-UDbH-A DB-UDbH-F DB-UDbI-A DB-UDbI-F DB-UDbZ-A DB-UDbZ-F APP-AA-F APP-AppSz-F APP-GappA-A APP-GappA-F APP-GOb-A APP-GOb-F APP-UApp-A APP-UApp-F APP-UappA-A APP-UappA-F APP-UOb-A Dates – Last 7 days
Users or assets that accessed data from a risky geolocation	Activity Types: File Access Web Activity Application Events Geo Locations – China, Ukraine, Russia, North Korea, or other geolocation your organization deems risky Dates – Last 7 days
Users who issued new database commands	Reasons: DB-UDbO-F DB-UDbQL-A DB-UDbR Dates – Last 7 days
Data abormally moved from specific network subnets	Network Zones – Enter your organization's network subnets. Dates – Last 7 days
^[a]MITRE ATT&CK and ATT&CK are trademarks of The MITRE Corporation ("MITRE"). Exabeam is not affiliated with or sponsored or endorsed by MITRE. Nothing herein is a representation of the views or opinions of MITRE or its personnel.

Configure Settings to Search for Data Lake Logs in Advanced Analytics

If you have an on-premises deployment, ensure that you configure certain Advanced Analytics settings so you can search for Data Lake logs from a Smart Timelines™ event.

If you have a cloud-delivered product offering, ensure that you configure Data Lake as a log source.

Investigate

Ensure you have the tools you need, like tasks and incident types, to investigate the evidence you collect from log sources, rules, and models.

Case Manager Incident Type

In Case Manager, ensure that you have the out-of-the-box Data Access Abuse incident type, or create one if it isn't available out-of-the-box in your Exabeam version. Ensure the incident type has all corresponding incident fields.

Case Manager Tasks and Phases

In Case Manager, define a clear response plan to ensure everyone across your organization responds to a data access abuse incident consistently. Under each phase, prescribe the relevant tasks for investigating, containing, and remediating a data access abuse incident.

The out-of-the-box Data Access Abuse incident type comes with suggested phases and tasks. If you don't have the out-of-the-box Data Access Abuse incident type, create the following suggested phases and tasks for your custom Data Access Abuse incident type.

Phase: Detection & Analysis

Task name – Identify suspicious activity
Task instruction:
- Determine how the data was leaked; for example, through web, email, network, or physical device.
- Identify what the user accessed; for example, application, file, or database.
- Identify the files the user accessed.
Task name – Review user and asset Smart Timelines™ and profiles
Task instruction:
- Review all user Smart Timelines for anomalies.
- Review all user profiles and what's considered normal for the user.
- Review all asset Smart Timelines for anomalies.
- Review all asset profiles and what's considered normal for the asset.
Task name – Identify the accessed data
Task instruction:
- Identify where the data was located.
- Identify what applications were involved.
- Determine if any cloud applications were involved.
Task name – Identify the contents of the accessed data
Task instruction – Determine how many records, type of records, or individual accounts were accessed.
Task name – Identify the data source
Task instruction – Determine whether the data source is a database, email repository, or other location.
Task name – Identify the scope of the data accessed
Task instruction:
- Determine what query ran on the database.
- Determine what records or information was accessed.
- Determine whether the information accessed was controlled, restricted, intellectual property, or personally identifiable information (PII).
Task name – Analyze and scope
Task instruction:
- Determine if the threat is ongoing.
- Determine what data was involved or accessed.
- Identify relevant third-party alerts and link them to this incident.
- Identify and collect relevant artifacts, like IPs and hostnames.
- Identify the credentials used to initially access the data.
- Identify all user accounts associated with the identified credentials.
- Identify the initial attack vector.
- Identify the data classification of the accessed data.
Task name – Retrospectively search for anomalous activity
Task instruction:
- Determine when initial activity likely began and revise this as you investigate and learn new information.
- Determine if logs from potentially impacted systems were sent to your centralized SIEM or log aggregation platform.
- Determine if there was any additional anomalous activity, like if the account accessed new applications, triggered security alerts, or exfiltrated data.
- Determine if any new processes were executed or software was installed. Investigate if the processes or software were used nefariously.
- Determine if the user disabled any security tools on the endpoint, like Endpoint Detection and Response (EDR), Endpoint Protection Platform (EPP), or Data Loss Prevention (DLP) tools.
Task name – Assess impacted systems
Task instruction – Determine if the potentially impacted systems are critical business or infrastructure systems.
Task name – Reassess the severity of the incident
Task instruction – If appropriate, edit the incident priority.

Phase: Containment

Task name – Tell the SOC Manager about the incident
Task instruction:
- If needed, inform your SOC Manager of the incident and include the incident's expected start and end date.
- Determine whether additional team members or teams, like HR, Legal, or Physical Security, must get involved.
Task name – Determine adequate response measures to contain the threat
Task instruction:
- Isolate the system from where the data leaked.
- Disable affected user accounts as appropriate.
- Disable physical badge access.

Phase: Eradication

Task name – Preserve logs for impacted systems and users
Task instruction:
- Retrieve and preserve Data Lake logs associated with the user from the expected start to the present.
- Upload the Data Lake logs to the incident.
- If there's possible nefarious intent, obtain a forensic image of the system or isolate the physical machine from the network.
Task name – Remediate
Task instruction:
- If necessary, reduce the user's network access; for example, block ports or restrict web access.
- Remove all persistence methods.
- Ensure any code pushes or infrastructure as code (IaC) is free of persistence methods.
- As necessary, deploy new patches.

Phase: Recovery

Task name – Proactively check systems
Task instruction:
- Reset all affected credentials
- Restore disabled credentials as necessary,
Task name – Implement relevant global security measures
Task instruction:
- Change permissions and access levels as appropriate.
- Implement new Data Loss Prevention (DLP) security rules as necessary.

Phase: Post-Incident Activity

Task name – Update documentation
Task instruction:
- Ensure the incident contains documentation of all relevant events and actions taken.
- Identify methods to improve the team’s response to future incidents.
Task name – Hold post-mortem meeting
Task instruction:
- Meet with your team. Review the incident and lessons learned.
- Document and track administrative and technical gaps identified during the incident.

Case Manager Incident Email Communication

To collaborate on an incident with people across your organization, ensure that you configure incident email communication.

Respond

Enable response mechanisms you need to isolate, neutralize, eliminate, and mitigate any threats you find.

In Incident Responder, create triggers for all turnkey playbooks.

Report

To share your investigation with others or for compliance purposes, ensure you have the relevant out-of-the-box Data Lake reports:

Exabeam - Failed Database Login Activity
Exabeam - Object Access Summary
Exabeam - Successful Application Logon Activity
Exabeam - Successful Database Logon Activity

Use CasesConfigure Threat Detection, Investigation, and Response (TDIR) Use Case Categories

Table of ContentsTable of Contents