Time for Prompt Thinking! Here, Marty The OT Guy asks Vantage IQ to surface alerts with low risk scores that carry high actual threat potential. What Vantage IQ finds doesn't match what the score suggests, and it tells you exactly what to investigate and where to look next.
"Risk score of 2, looks fine, nothing to see here, except it's PSExec and PowerShell downloads and it's happening right now. My name's Marty, I've spent 30 years in OT engineering and OT security and your risk score will tell you what to look at, but it won't tell you what to ignore. So let's check it out. I'm on the alerts page and there's nothing here that's overly concerning but I'm going to ask Vantage IQ what alerts on this site have a low risk but a high actual threat potential. Vantage IQ finds them immediately. We have multiple sigma rule matches, risk score of 2, it's very low but the threat names tell a different story. PowerShell download commands, PSExec service execution, these are MITRE attack techniques, the tools of ransomware operators and lateral movement. Vantage IQ tells me exactly what to do. It tells me to investigate one of our inputs, to review the sigma rule configurations, consider tuning some alert risk scores and check for lateral movement in the network. And then finally, it gives me options of what follow-up steps I could take. Your risk score tells you what to prioritize. It doesn't tell you what attackers are counting on you to ignore. Those aren't the same list. Vantage IQ is already in your Vantage platform. Ask it the question your risk score isn't asking."
💬 Discussion
Time for Prompt Thinking! Here, Marty The OT Guy asks Vantage IQ to surface alerts with low risk scores that carry high actual threat potential. What Vantage IQ finds doesn't match what the score suggests, and it tells you exactly what to investigate and where to look next.