Attack Defense Graph Analysis for Supporting SOC and CSIRT Operations
summary
SOCCRATES builds an automated Infrastructure Modeling Component that ingests scanners, NetFlow, cloud configs and continuously outputs topology with hosts, software CVEs, AD objects and firewall rules; SecureCAD (MetaAttack Language) runs Monte Carlo attack simulations via Cortex/TheHive integration against AWS/GuardDuty examples, computes time to compromise, identifies shortest and most probable attack paths to high‑value assets, and generates prioritized mitigations and playbooks. Pilot with an MSSP and a major energy operator starts H1 2022 and much of the platform is open source.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:50Partners
- 1:42Why
- 4:01Project Objective
- 4:33Use Cases
- 9:30Architecture
- 11:04Data Model
- 19:06Demo
- 20:56SecureCAD
- 27:48Conclusion
related talks
30mThe SOC Counter ATT&CK
40mAdversary Simulation: Close the Gaps in Your Security Posture
45mFrom Attacks to Action: An Open Community Model to Drive Defensive Choices
49mFight Smarter: Accelerate Your SOC with AI Discovered Attacks
33mDecoding Cyber Threats: A Practical Guide to Using Attack Trees
40mCybersecurity Operations Center Technology Taxonomy
28mScaling Your Defenses: Next Level Security Automation for Enterprise
26mImproving Cybersecurity Posture with an AI Security Assistant