Alright folks, I’ve saved the best for last . If you’ve ever worked with a traditional EDR (Endpoint Detection & Response) tool, you know what it gives you—file analysis, threat hunting, quick search, incident review, all that juicy stuff, right? Now, imagine doing all of that—but for email . Yes, you heard me right. Welcome to the world of Sublime EDR for Email.  📬⚡ This isn’t your boring "filter spam and move on" solution. This is real EDR-level capability  in your email environment. Let's break it down, in the chill, easy way we always do. If this catches on, I might even write another post just about custom detection rules 👀. 🔍 First Stop: Search Let’s start simple. Sublime gives you powerful search capabilities . You want to know: How many people got an email  from a shady sender? Did this subject line go to more than one user? How many people received this one specific message? Just type it in and boom—you’ve got results. Example1: Example2: No complex query language needed. Use sender email, subject line, message ID—whatever you have. It’s straightforward , and honestly kinda fun once you get the hang of it. 🧨 The Coolest Part: Hunting Now THIS is my favorite part. This is where you put on your digital detective hat 🕵️. So, what’s hunting in Sublime? It's where you search across your entire email environment  for stuff like: Suspicious attachments Authentication failures (like DMARC/ SPF/ DKIM mismatches) Weird domains Signs of phishing or malware delivery Anything that looks off! This feature is driven by something called MQL (Message Query Language) —don’t worry, it sounds more complicated than it is. If you’ve ever used something like YARA, Sigma, or even basic Python filters, you’ll feel right at home. And the best part? 💻 Meet the MQL Editor – Built for You The MQL Editor  is like working in VS Code, but specifically for email detection rules. It’s smart, fast, and gives you all the help you need while you write: Autocomplete Live error checking Function & field tips Debugging and test support You can upload a real .eml file and test your rule instantly . If it works, you’ll see a ✅. If not, it’ll give you a ❗ and highlight what didn’t match. 🔍 There’s even a feature that shows the intermediate results of each function —so you’re not just guessing what went wrong. Got logic errors like mixing up AND vs OR, or forgetting a bracket? It’ll warn you gently but won’t block you. Super useful. If you’re ever stuck, just hit Ctrl + Space to see all possible fields and functions. Sublime’s got your back. Example1 : You can make query more intense i am keeping it simple Example2 : Example3: 📁 Email Analyzer – The Cherry on Top And now, the final boss  of this EDR setup: the EML Analyzer . Upload any .eml file (yes, the actual raw email file), and Sublime will: Analyze it using its ML engine 🤖 Break it down line by line Show you headers, links, attachments, logos, domains—you name it It’s like having your own little sandbox to inspect suspicious messages without needing a full SIEM or EDR setup . Perfect for analysts, incident responders, or even curious defenders who want to dig into how phishing emails really work. ------------------------------------------------------------------------------------------------------------- 🏁 Wrapping Up: That’s a (Sublime) Wrap! That’s it! 🎉 This was the final piece of the Sublime EDR series, and honestly—I had a blast sharing this with you all. Sublime isn’t just another “email security tool.” It’s a full-blown email EDR , and it gives you the power to: ✅ Investigate ✅ Hunt ✅ Remediate ✅ Automate ✅ Analyze...and do it faster than ever . 🙌 Final Words If you enjoyed this journey and want to go deeper (like how to write powerful MQL detection rules, or threat hunting workflows), hit me up! 💬 Also, if you're curious about how to get started with Sublime, or even want to join one of the best security companies out there —reach out to me. I’ll point you in the right direction and tell you why they’re truly next-level . Thanks again for sticking with me through this series—I’ll catch you in the next article, where we’ll dive into even more cool cybersecurity tools and concepts! Until then, stay safe, stay curious. 👋

While Detection Rules and Automations are at the heart of Sublime Security's threat detection and response, the platform is packed with additional tools and capabilities  that make it even more powerful, customizable, and community-driven. Here are a few advanced features every security team should explore. 🧠 Git-Backed Rule Feeds Stay Updated, Stay Ahead Sublime supports Git-backed rule feeds that allow you to receive continuous updates from the Sublime team and the broader security community. Sublime Rules Feed  is included by default and maintained by the Sublime team. You can add custom feeds  from GitHub, GitLab, or Bitbucket—perfect for managing and sharing detection rules across teams or community groups. To manage feeds, just head to the Feeds  section in your dashboard and click New Feed . 🔗 Pro Tip:  Community collaboration makes rule evolution much faster. Embrace it. 🗂 Lists Dynamic Sets for Smarter Matching Sublime supports the use of named lists —these are reusable sets of data (like domains, email addresses, or file hashes) you can reference within your detection logic using MQL. All list names start with $ (e.g., $org_vips, $blocked_domains) You can create your own lists or use the built-in ones provided by Sublime. Lists simplify rule maintenance and improve readability. 📖 Learn more about Lists → 🚫 Exclusions Cut Out the Noise Exclusions are used to suppress alerts on known benign messages (like phishing simulations or internal test emails). They're evaluated before  rules or automations trigger. There are three types of exclusions : Global Exclusion  – Message is skipped from all  rules and automations Detection Rule Exclusion  – Message bypasses detection rules, but still hits automations Rule-Specific Exclusion  – Blocks a specific rule from matching a sender, domain, or recipient Sublime ships with built-in global exclusions for vendors like Cofense, KnowBe4, and Hoxhunt —inactive by default, but available if needed. ✅ Use exclusions strategically to reduce alert fatigue and fine-tune precision. ⚙️ Actions: How You Enforce Responses Actions are what you want to do  when something is detected. You can apply actions manually or automatically through Rules and Automations. Here are two key ones: 🛑 Quarantine (Enterprise) Makes the email inaccessible to end users In Microsoft 365 , the message goes to “Recoverable Items Purges” In Google Workspace , it's deleted from the user's inbox but retrievable by Sublime admins 📌 To add quarantine: Open a Rule or Automation Click "Edit" Under Actions, choose Quarantine Save 📬 Move to Spam (Core + Enterprise) Moves suspicious messages to the Spam/Junk folder Good for messages that are unwanted but not outright malicious Often paired with Warning Banners  for extra visibility 📌 To use Move to Spam: Open your Rule or Automation Click "Edit" Select Move to Spam  under Actions Save ✨ Final Thoughts These extra features may seem small, but they can supercharge your email security operations  when used properly: Feed integrations keep your detections fresh Lists and Exclusions fine-tune your logic Actions like Quarantine and Move to Spam help automate response And Git-based feeds make Sublime feel like a true DevSecOps-native platform Let the platform do the heavy lifting— you focus on what matters most. ---------------------------------------------------Dean-------------------------------------------------- Upcoming Article: Meet ASA: Your New AI-Powered Security Teammate from Sublime Security https://www.cyberengage.org/post/meet-asa-your-new-ai-powered-security-teammate-from-sublime-security ----------------------------------------------------------------------------------------------------------

In our previous articles , we talked about how Sublime Security’s Detection Rules  can be configured to automatically perform actions like auto-quarantining or triggering a review . But what if you want more control—or prefer separating detection from remediation workflows? That’s where Automations  come into play. 🚀 What Are Automations? Automations  are logic-based workflows in Sublime Security that focus on triaging  and responding  to email threats, especially those flagged by detection rules or reported by users. Think of Automations as your response engine —while Detection Rules identify the problem, Automations decide what to do with it. You can configure Automations to: 🛡 Auto-quarantine emails with a “Malicious” verdict 📛 Trash phishing messages or apply visual warning banners 📣 Alert when VIPs receive suspicious emails 👥 Take action when a certain number of users report the same message 🧵 Quarantine an entire campaign based on multiple detection triggers 🧠 How Do Automations Work? Automations are built on MQL (Message Query Language) —the same language used by Detection Rules. They trigger based on: A message being reported by a user A Detection Rule flagging a message Or both Once triggered, Automations can take two types of actions : ✅ Active Response : Auto-quarantine, trash, or apply a banner 👀 Passive Mode : Only generate alerts (e.g., webhooks, dashboard signals) without taking action This makes it super flexible—test in passive mode, then flip the switch when you're ready to go live. ⚙️ Active vs Passive Mode Sublime gives you fine-grained control with Active and Passive Modes : Mode Description Active Takes immediate action (e.g., quarantine, trash) Passive Only generates alerts—ideal for testing and tuning You can even toggle between them easily as you fine-tune your playbooks. 📦 Core Feed of Automations Just like Detection Rules, Sublime Security ships with a Core Feed  of recommended Automations: They’re inactive by default You can activate them in Active or Passive Mode They're designed to respond to common threat patterns , saving you time and effort These prebuilt workflows give you a solid foundation to build upon or customize for your unique threat landscape. 🔌 Bonus: API Integrations for Power Users Sublime Security also offers a powerful REST API , which lets you: 🧼 Trash or quarantine messages directly from your SOAR 🔍 Update blocklists with IOCs from your threat intel feeds 📎 Enrich JIRA, ServiceNow, or Slack alerts with email metadata The API uses standard HTTP verbs, JSON payloads, and predictable URLs. You’ll find your exact Base URL  under Automate > API  in the Sublime dashboard. 🎯 Final Thoughts Automations in Sublime Security are powerful , flexible , and designed to reduce analyst fatigue . Whether you want fully hands-off auto-remediation or prefer a passive alerting model, Automations help you tailor the perfect response strategy. Let Sublime handle the triage. You stay in control. -------------------------------------------Dean------------------------------------------------------------- Upcoming article: Beyond Detection: Hidden Power Features of Sublime Security https://www.cyberengage.org/post/beyond-detection-hidden-power-features-of-sublime-security ------------------------------------------------------------------------------------------------------------

Okay, so in this tab, we’re going to explore one of my favorite features of Sublime Security — Detection Rules , also known as your email detection posture . This is where things get really cool, especially if you love having visibility AND control over what happens in your email ecosystem. So, here's the deal — Sublime Security puts everything online on GitHub . https://github.com/sublime-security/sublime-rules Yep, it’s all open-source. You can: Write your own rules, Use existing community rules, Customize anything you like. No walled gardens, no black boxes. Just raw detection power at your fingertips. 🧠 How the Rules Are Organized The Detection Rules tab is the place where all the action starts. And trust me — they’ve done a neat job organizing everything. The rules are split into two main categories : 1. Attack Types Think of these like the “what is the attacker trying to do?”  side of things . Each type reflects the attacker’s primary goal — whether it's phishing for creds, spreading malware, or just trying to socially engineer someone into transferring funds. Here are some examples: BEC/Fraud  – Business Email Compromise. These are those sneaky emails where someone pretends to be your CEO, a vendor, or someone else important, trying to get you to send money or share sensitive info. No malware, no malicious links — just pure social engineering. Callback Phishing  – This one’s clever. The attacker tricks you into calling  a phone number. From there, it’s game over. They might lead you to malware, steal data, or worse. Credential Phishing  – This one’s classic. Think fake Microsoft login pages, Google Docs prompts, etc. — all designed to steal your usernames and passwords. Extortion  – Like the old "we’ve got your data, now pay us" scenario. Malware/Ransomware  – Where attachments or links lead to malware payloads. Reconnaissance  – This is like the attacker dipping their toe in to see if your email system bites back. They’re testing spam filters, checking which emails land in inboxes, and mapping targets before launching the real deal. Spam  – Not all spam is evil, but it’s annoying and sometimes a smokescreen for worse things. 2. Tactics and Techniques This section dives into how  the attackers are doing what they’re doing . You get insight into the tools and tricks used to evade detection. Some cool examples: Encryption  – Emails that are encrypted just enough to sneak past scanners. Evasion  – Tactics like obfuscation, spoofing headers, hiding links in weird places. Free Email Providers  – Attackers love using Gmail and Outlook to look “normal.” Free File Hosts  – Dropbox and Google Drive links aren’t always innocent. HTML Smuggling  – A technique where malware is hidden inside HTML files. ... and the list goes on. 🛠 Why I Absolutely LOVE This Now, you might ask — “Dean, why are you geeking out over this?” Let me tell you why: Sublime lets you apply actions per category or even per rule . That’s right. You’re not locked into a single response for every kind of threat. ( There is better method as well, we will discuss in next article :- automation, but yeah this ability also given by sublime, you have to make choice what you are going to choose) For example: You’ve got 74 BEC/Fraud rules . (Kept increasing or you can add your as well) And 35 Spam rules . Let’s say: For all BEC/Fraud  emails → you want them to be auto-quarantined  or Auto-review ( malicious .) Before Applying any action: Let apply action: After Applying action: But for Spam  → maybe you just want to move it to the spam folder  and add a warning banner . --------------------------------------------------------------------------------------------------------- One thing keep in mind which is Lets suppose the one rule which was under BEC fraud might come under SPAM as well, So don't get confused or worried: Now you will ask question Dean, than how the action will work remember the Hierarchy i told you! If multiple rules try to classify the same message, the platform uses this order of priority: Simulation > Benign > Malicious > Spam > Graymail if one rule tags it as Simulation and another as Malicious, Simulation  wins. ------------------------------------------------------------------------------------------------------- You can set different actions per type. That flexibility? HUGE. And yes — you can mix and match: Set a warning banner   plus  move to spam. Or trigger user reporting . Or simply alert only , if you want to monitor before acting. This level of control is something most EDRs or email gateways charge a premium for — Sublime gives it right out of the box. 📈 What’s Rule Effectiveness? So there's this nifty section called Rule Effectiveness . Basically, it gives you insight into how well your detection rules are working. Key points: It only shows data from live-processed  emails. So your test emails or old logs won’t count. You can see: Who created or last updated the rule, How many emails were flagged, What actions assigned to rule, How many reviewed. It’s perfect for fine-tuning your rules, especially if you want to weed out false positives or catch things your current posture misses. ⚠️ One Thing to Remember By default, all rules are alert-only when you enable them . So no actions will be taken until you  define them. That’s kind of a good thing because it gives you time to understand how your rules behave. you can assign actions . : Quarantine, Add warning banners, Enable user reports, Auto-delete (if you dare), Or just monitor. Totally your call. 🧪 What About ASR Rules? We’ve talked about ASR (Advanced Security Rules) in a previous article , but I might just copy-paste that again or share a link, Lol😄. Basically it also contain rules Attack Surface Reduction in Sublime Security is a specialized category of MQL Detection Rules  that target abnormal or risky patterns in emails. Think of it as your "proactive threat filter" for Microsoft 365 and Google Workspace environments. --------------------------------------------------------------------------------------------------------- Detection Methods Rules Before we wrap up, let’s touch on the Detection  section of the analysis view, specifically the Detection Methods Rules . This section highlights the technical methods and Sublime’s custom rule-based techniques  that identified and flagged the threat. T hese rules often represent the logic or patterns the system detected in an email—such as suspicious sender behavior, impersonation attempts, or malicious links. 💡 Tip:  These are editable rules—if you see something that needs adjusting or tuning to better fit your environment, you can modify them. It’s an excellent way to fine-tune detection for your organization. Historical Ingestion Another important capability of Sublime Security is Historical Ingestion . What is Historical Ingestion? Historical Ingestion is a powerful feature that allows you to ingest and analyze past email messages  to build contextual baselines  for better real-time detection and tuning. When you first deploy Sublime or activate new mailboxes , it prompts you to run historical ingestion so that it can learn from your environment. Why it matters: Establishes behavioral baselines  for what’s normal across your org. Helps reduce false positives  by learning from how you label previous threats. Gives you insight into how Sublime would have flagged past messages , so you can tune and adjust before going live. Key Steps: Review and label results  from historical analysis. Labeling helps train Sublime’s models and improve future detections. You can also exclude safe messages  during this review to fine-tune detection and prevent noisy alerts. Once you complete labeling, activate your rules  for real-time detection. Running historical ingestion doesn’t impact mail flow —it’s a passive process designed to improve accuracy. 🔧 For best results, make sure all mailboxes are activated and configure message retention to allow analysis as far back as you’re comfortable. --------------------------------------------------------------------------------------------------------- I will suggest, wait for my next article before enabling Action on Detection Rules you might find that way better right!!!!!! ------------------------------------------------------------------------------------------------------------- 🎯 Final Thoughts Sublime Security is truly building something special — like an EDR, but for your email . The detection rules tab is where it all comes together: visibility, customization, and control — all in one dashboard. Try it out — play with the rules. Trust me, you’ll enjoy the control it gives you over your email security like never before. --------------------------------------------Dean---------------------------------------------------- Upcoming Article: Automations in Sublime Security: A Smarter Way to Respond to Email Threats https://www.cyberengage.org/post/automations-in-sublime-security-a-smarter-way-to-respond-to-email-threats ---------------------------------------------------------------------------------------------------

The Remediate Threats  section in Sublime Security is a powerful place to review and take action on suspicious or malicious emails. It's organized into multiple sub-tabs designed to help SOC analysts or IT security teams streamline email threat response. Let’s walk through each part, focusing on the Flagged  tab — which shares similar structure and logic with the User Reports  tab. Remediate Threats Tab Breakdown The tab is divided into the following parts: 📌 Flagged Emails automatically flagged by Sublime's detection engines. All Unreviewed Attack Surface Reduction Auto-Reviewed Auto-Remediated 🧑‍💼 User Reports Emails reported by users manually (similar to "Flagged", so we'll skip this in detail as the layout is the same). Flagged > All Unreviewed When Sublime flags an email, it shows up under “All Unreviewed” . This is where analysts start their review process. 🧠 Key Elements of the Email Detail View Clicking on a flagged email expands a panel containing all related data. Here's what you see: ✅ Verdict Sublime's classification (e.g., Malicious , Spam , etc.).In our example, the email was marked Malicious . 📊 Attack Score Signals This section shows why  Sublime determined the message to be malicious. 📬 Message Group Details Details include: Subject Sender Recipients Who opened  the email, replied to email. Whether it was forwarded 🕵️ Message Insights This section summarizes key indicators such as: First-time sender domain/email Low reputation links Mismatched links Unsolicited sender Brand logos used in the email Domains in body and headers Sender’s timezone offset Sender prevalence (e.g., new or known) 📑 Message Content This area shows a preview of the email as seen by the user  — essential for understanding how convincing the phishing attempt was. You can also: Download the .eml  file for deeper forensics or sandboxing. 📧 Sender Details Shows reputation history and authentication status: Email: chrome@servicealerts.net Past reviewed messages: 0 First Seen: New to your organization Authentication: SPF: ❌ Failed DKIM: ✅ Passed DMARC: ❌ Failed 📜 Message Activity History This timeline shows all events related to the message: Open timestamps Forwarding trail Full recipient list and their actions 👨‍⚖️ Review Status You can take manual actions from here: Select classification: Malicious , Spam , Graymail , Benign , or Simulation Action Taken: e.g., Quarantine , Allow , etc. If you issue Quarantine it will remove the email from all users group (How awesome is that) ----------------------------------------------------------------------------------------- I will show you another example of email than we move next Email Mail details: Analysis details: (Which rules triggered the alert:) Message group details Message details: Message content: Sender details and authentication: Message activity history: Review status basically for you ----------------------------------------------------------------------------------------- Lets moved to next tab which is ASR (Attack surface reduction: Attack Surface Reduction (ASR) ASR is Sublime’s way of proactively reducing exposure to attacks  before they happen — much like hardening an endpoint. 🧬 What is ASR? ASR uses custom MQL (Mail Query Language)  rules to detect and block abnormal or suspicious behaviors. Examples include: type.inbound and any(attachments, .file_type in $file_extensions_common_archives and any(file.explode(.), any(.scan.javascript.identifiers, strings.ilike(., 'ActiveXObject', 'ShellExecute')) or ( length(.scan.javascript.strings) > 0 and all(.scan.javascript.strings, strings.ilike(., 'Shell.Application', '*.exe')) ) ) ) and ( profile.by_sender().prevalence in ("new", "outlier") or profile.by_sender().any_messages_malicious_or_spam ) and not profile.by_sender().any_messages_benign This rule flags messages when Javascript contains identifiers or strings that may attempt to execute files. 📥 What You’ll See Alerts generated by ASR rules will appear under this tab. You can set ASR rules in “alert-only” mode or configure automatic actions such as: (I will do not recommend i will give you better method later- than you can decide which method you want to use and proceed with ) Quarantine Move to Trash Insert Warning Banner Webhook Trigger Slack Notification This allows teams to enforce strict hygiene policies  on Microsoft 365 or Google Workspace — reducing phishing and BEC risk significantly. ----------------------------------------------------------------------------------------- Lets talk about third tab called Auto reviewed Auto-Reviewed  – Let the Platform Handle the Obvious If you're overwhelmed by flagged emails that are obviously spam or benign, Auto-Review  is your best friend. What is Auto-Review? It’s an action you can assign to high-confidence rules . When triggered, it will: Automatically classify the message (e.g., spam, malicious, benign) Mark it as “auto-reviewed” Hide it from your default triage view (unless you explicitly go to the Auto-Reviewed  tab) How to Set It Up Open a specific detection rule. Click Edit  or Edit Metadata . Add the Auto-review  action. Choose a classification  like: Malicious Unwanted (Spam or Graymail) Simulation Save the rule. Or Else Go to detection rules-> Selection which ever detection you want i will choose BEC for now-> Selection which ever detection you want i will choose BEC for now--> Click On view all Select all rule--> Click on Action--> Select Auto review--> And select classification Why It Matters Say you’ve built a rule that’s great at catching marketing spam . Instead of manually reviewing those every day, enable Auto-review  and classify them as Graymai l . It keeps your analyst queue clean and focused on true threats. Auto-Review Hierarchy If multiple rules try to classify the same message, the platform uses this order of priority: Simulation > Benign > Malicious > Spam > Graymail So if one rule tags it as Simulation and another as Malicious, Simulation  wins. ----------------------------------------------------------------------------------------- Last tab Auto-Remediated Here you will see Emails automatically taken action upon using predefined automation rules. ----------------------------------------------------------------------------------------- ✅ Final Thoughts Sublime Security’s Remediate Threats  section helps you: Investigate flagged emails deeply Reduce noise with auto-review Proactively block risky patterns using ASR rules Give end users a way to report threats easily With a mix of automation and human oversight, it's a powerful way to stay ahead of phishing and email-based threats. ----------------------------------------------Dean-------------------------------------------------- Upcoming Article : Let’s Talk About Detection Rules in Sublime Security (EDR for Email!) https://www.cyberengage.org/post/let-s-talk-about-detection-rules-in-sublime-security-edr-for-email -----------------------------------------------------------------------------------------------------

Alright folks — let’s dive in! Now that I’ve hyped up Sublime Security  in the last post (with good reason 😎), it’s time to show you how this beast of a platform actually  looks and what kind of visibility you get once it's live in your environment. We’re starting with the two most straightforward but powerful pages : The Overview  tab And the User Reports  tab I know — it’s pretty self-explanatory. But I’m still going to walk you through it because even simple things can show big impact when done right. 📊 Page 1: The Overview Dashboard So the moment you log into Sublime, this is your command center. The Overview page  gives you a real-time pulse on what’s happening inside your email environment — and honestly, it’s clean, informative, and actually useful (not just pretty graphs). Let’s break it down 👇 ✅ High-Level Stats Right Up Top The first thing you'll see: How many mailboxes are protected How many messages have been analyzed How many detection rules are active This gives you instant feedback on how wide your protection spans and how active your defenses are. No need to dig through config menus. 📈 Attack Remediation Timeline Next up — a timeline chart  that shows how many attacks were remediated per day. This is 🔥 because it lets you see the ebb and flow of attacks over time . You’ll notice spikes — and those spikes tell stories. Was there a burst of phishing on a Monday? Did something sketchy happen over the weekend? This is where you start spotting patterns. 🏷️ Top Labels: See What’s Being Flagged Scroll a bit, and you hit the Top Labels section , broken down by: Attack Types  – What was the goal? (BEC, credential theft, QR scams, etc.) Tactics & Techniques  – How did they try to pull it off? (HTML smuggling, spoofing, obfuscated links...) Detection Methods  – How were these threats caught? Was it AI, a custom rule, a community rule? You’re not just seeing “what got blocked” — you’re seeing how and why it was caught , which is gold for any security team trying to improve detection strategies. 🔍 Top Detection Rules You’ll also get a list of: Detection Rules that fired the most Based on how many attacks each rule caught This helps in two major ways: You know which rules are working You can prioritize tuning the ones getting noisy or low-confidence hits 🎯 Top Targets This section shows the mailboxes getting attacked the most . Very useful to: Identify high-risk users (like finance, C-levels, HR) Correlate with investigation timelines Build custom protection (like VIP inbox rules) ⚙️ Actions Summary A breakdown of: Remediation actions applied  (e.g., quarantined, moved to junk) Alert actions  (like notifying SOC or ticket creation) You see what actually happened  after the detection — and whether automation kicked in or manual action was needed. 🚨 Message Classification At the very bottom, you get a clear picture of: How many messages were classified as malicious , spam How many were automatically remediated  vs manually handled This gives a snapshot of human vs machine balance — and you’ll start to see how much time you’re saving through automation. And don’t worry — we’ll dig deeper into these remediation details in a future post. 📬 Page 2: User Reports Overview The next tab is super useful, especially if you have an organization where users report emails to the SOC or security team. This section basically shows: Emails reported by users What action was taken: Quarantined Moved to spam Marked clean Ignored Further investigated You don’t need to be a genius to use it — just click, review, and go. It helps the SOC team verify whether a report was valid or not, and it builds confidence with users that their reports are being looked at. 🧠 Why These Two Pages Matter (More Than You Think) While these two tabs seem “basic,” they actually offer: Instant operational visibility Historical awareness (timeline + trends) Confidence in what's working and where to tune Context for each mailbox, rule, and user action In the old days, we’d have to pull logs from the SEG, correlate with EDR alerts, and chase people down for context. Sublime brings all that into one place , focused purely on email. --------------------------------------------------------------------------------------------------------- 🎤 Wrapping Up That’s the bird’s eye view of your Sublime dashboard. In the next upcoming articles, I’ll dive deeper into custom rules, retro hunting, and how to use MQL  like a pro. Because honestly, that’s where the magic happens — and it’s where you get to turn this tool into your own personalized email defense engine . Until then — stay safe, stay curious, and watch those inboxes!Let’s keep digging. 🔍 ----------------------------------------------------------------------------------------------------------- Upcoming Article: Understanding the “Remediate Threats” Tab in Sublime Security https://www.cyberengage.org/post/understanding-the-remediate-threats-tab-in-sublime-security -----------------------------------------------------------------------------------------------------------

Hey folks! You know there are certain tools you just can’t ignore anymore — not because of hype, but because they actually deliver . One of those tools, for me, is Sublime Security . Now let me be real with you — I was never super excited about email security tools. Yeah, we’ve got the old-school secure email gateways (SEGs), filters, allowlists, blocklists, SPF/DKIM/DMARC setups... we’ve all been there. But when I came across Sublime , something clicked. And I finally got a chance to work with it — so I’m going to take you on that journey. Because trust me, this tool? It’s a game-changer  — especially when we’re talking about Business Email Compromise (BEC), phishing, QR code scams, and all the sneaky stuff attackers use to target our inboxes. 🛡️ Why I Call Sublime Security the “EDR for Email” Okay so hear me out — e ven Sublime itself calls it that . And honestly, they’re not wrong. When you think of EDR (Endpoint Detection and Response) , what comes to mind? You get: Full visibility into behavior Custom detection logic Historical hunting Rapid response and remediation Transparency, not just a black box Now imagine if you could do that, but for email. Not just after something gets delivered. But even after it was missed by your secure gateway or native Microsoft/Google controls. That’s what Sublime does. 🤖 What Exactly Is Sublime Security? At its core, Sublime Security is an open, programmable email security platform  designed to run detection logic and visibility across your cloud inboxes (M365 and Google Workspace). It combines: ✅ AI-powered detection ✅ Behavioral analysis ✅ Open detection rules written in MQL  (more on that in a sec) ✅ Community-driven content ✅ Retro hunting  — you can go back and look for past threats ✅ Self-hosted or SaaS options  — and yes, the first 100 inboxes are FREE! 🧠 What’s MQL? And Why Should You Care? Message Query Language (MQL)  is one of the coolest parts of Sublime. Think of it like Sigma/YARA , but for email. You’re not just setting filters — you’re writing actual logic: Find if an email has a suspicious HTML attachment Flag any sender impersonating your CEO Catch QR code phishing attempts (you'd be surprised how common these are now!) Detect reply chain hijacking And the best part? The community contributes hundreds of rules  — and they’re available on GitHub. So it’s not just Sublime doing the work; we’re all doing it together. 🌐 The Main Components of Sublime Here’s what makes this platform tick: 🔍 Sublime Defend Their detection engine — runs all those AI + custom rules to flag suspicious emails. 📥 Sublime Triage Automates analysis of user-reported emails. It basically reduces the noise and helps you focus on real threats. 🕵️ Sublime Hunt Now this is 🔥 — retroactively hunt down threats that slipped past your defenses. Like going back in time to catch that attacker before they cause real damage. 🎯 Why This Matters — Especially for BEC In my career investigating incidents, I can confidently say: 50–60% of compromises start with email . Especially BEC — and you know what? Those don’t always involve malware. They’re sneaky. Sometimes it’s a fake invoice, a reply-chain hijack, or someone pretending to be your vendor. Traditional tools miss these. Because they’re not weird  enough to trigger AV. They don’t have links. They just look  real. That’s where Sublime shines. It understands email context . It lets you build rules based on behaviors, headers, timing, content patterns — real security logic, not just signatures. 🚀 Why I’m Hyped About Sublime And no, this isn’t a sponsored post. I’m just honestly excited to finally have a tool that treats email security the way we treat endpoint security — seriously. ------------------------------------------------------------------------------------------------------- 🔜 What’s Next? In this series, I’ll walk you through Sublime Security . If you’re tired of black-box tools and want full control over email security — this might just be your new favorite toy. Till then, buckle up. 🛡️Let’s build a better email defense together. -------------------------------------------------Dean----------------------------------------------- Upcoming: Sublime Security – Dashboard Walkthrough (Overview + User Reports) https://www.cyberengage.org/post/sublime-security-dashboard-walkthrough-overview-user-reports --------------------------------------------------------------------------------------------------

In this guide, we'll cover the last section of the Carbon Black Cloud console : the Settings  tab. This area is crucial for managing your environment, configuring users, roles, notifications, and more. Let’s dive into each subsection and see what they offer. 1. General The General  subtab provides essentia l information about your Carbon Black account and its configuration . Here’s what you can find: Enabled Products : Displays the list of products activated for your account. For additional tools, links to relevant documentation are available if you’re considering a purchase. Account Details : OrgID & OrgKey : These are unique identifiers for your account, necessary for API integrations. Keep these handy if you're making API calls. DNS Suffix : Defines the domain suffix your devices use, such as yourcompany.com. It’s an organization-specific identifier set during DHCP configuration. Reachable Hosts : This is the IP address or fully qualified domain name (FQDN) of an internal host, like your DNS server. It's used to confirm on-premises reachability and must avoid private IPs like 10.x.x.x or 172.x.x.x. Windows Registry Key : This permanent setting ensures compatibility with Windows security updates (e.g., KB4072699). Once enabled, it cannot be modified. 2. Users The Users   subtab allows you to manage who has access to your console. Add new users and grant them specific permissions. View logs related to user activity, ensuring accountability and transparency. 3. Roles Roles are critical for managing permissions across your organization. Use prebuilt roles  for common needs or create custom roles  tailored to your environment . Assign roles to users based on their job responsibilities, ensuring a least-privilege approach to security. 4. Notifications Want to stay informed? The Notifications  subtab lets you set up alerts based on specific conditions. Scenarios where notifications can be triggered: Alert Thresholds : When an alert exceeds a predefined limit. Specific TTPs or MITRE Techniques : Be notified when certain tactics, techniques, or procedures (TTPs) are detected. Policy Actions : Alerts when specific policy actions are applied 5. API Access API Access enables seamless integration with other security tools in your ecosystem. Generate API keys to authenticate your integration with external systems. For detailed guidance, check Carbon Black’s official API documentation . 6. Data Forwarder The Data Forwarder  feature lets you send bulk data to external storage for advanced analytics and reporting. Supported Destinations: AWS S3 Buckets : Create an S3 bucket and configure a bucket policy to grant necessary permissions. Use prefixes to send data to specific sub-folders. Microsoft Azure Blob Storage : Authorize Carbon Black Cloud using a Federated credentials-based Managed Identity. Note: Unlike AWS S3, Azure requires individual blob containers for each forwarder. Tip : This is useful for integrating with SIEM tools or for maintaining historical logs outside of Carbon Black. 7. Audit Log The Audit Log  subtab provides a trail of actions performed within the console. Track login attempts, configuration changes, and user activity. Use this feature for compliance audits and internal investigations. Wrapping Up: With its comprehensive features and intuitive interface, Carbon Black Cloud empowers organizations to take control of their cybersecurity posture. From endpoint protection to advanced threat hunting, the platform provides everything needed to stay ahead of emerging threats. By mastering these tools and features, you're not just enhancing security—you're building a resilient defense against the challenges of tomorrow. That wraps up our deep dive into Carbon Black! See you in the next series of articles—until then, stay curious and stay secure. Bye-bye! 👋

The Feature Inventory  in Carbon Black Cloud is an essential tool that helps administrators and security professionals manage and investigate their endpoint security posture effectively. Let’s dive into its key components, starting with the Endpoints  tab, and explore the features and capabilities it provides. Endpoints Tab The Endpoints  tab is your starting point for managing and investigating endpoints in your environment . Below is an overview of its layout and functionality: Filters for Investigation On the left-hand side of the tab, you’ll find several filters that simplify endpoint investigations. These filters include: Sensor Status : Displays whether sensors are active, inactive, or in an error state. Operating System (OS) : Allows you to filter endpoints by their operating system. Sensor Version : Helps identify which version of the Carbon Black sensor is installed. Other Metadata Filters : These include options for grouping endpoints by their organizational unit, IP range, or other custom tags. Each filter is self-explanatory and designed to make pinpointing specific endpoints quick and efficient. Top-Right Controls At the top-right corner of the screen, you’ll find two key options: Sensor Options The Sensor Options  menu provides several actions to manage sensors: Manage Sensor Settings : Enables deletion of unused sensors. View Company Code : Displays the company code required during sensor installation. Download Sensor Kit : Offers the installation package for the sensor. Send Installation Request : Allows you to email installation instructions by entering the recipient’s details. Add Group: The Add Group  feature helps you dynamically assign sensors to specific groups based on predefined criteria : Sensors matching all criteria for a group are added automatically. If a sensor does not match any group’s criteria, it is assigned to the default Standard policy . Group assignments are dynamic and will change if a sensor no longer meets the criteria for its current group. You can define group criteria using “AND” or “OR” conditions, offering flexibility in your configurations. Note : Sensors can belong to only one group at a time. If multiple groups match, the sensor is assigned to the group with the highest priority. Sensor Update Status Adjacent to the Endpoints  tab, you’ll find the Sensor Update Status  section. This feature displays: Sensor versions installed across your environment. Details of sensors requiring updates or showing errors ------------------------------------------------------------------------------------------------------------- Live Example: Viewing Sensor Details When sensors are available, you’ll see details organized by status. Filters such as Sensor Status  or Signature Status  provide critical insights: Sensor Status: Carbon Black provides detailed statuses for sensors, including connectivity and operational health. For example: Active : Sensors reporting data and functioning correctly. Inactive : Sensors not reporting or disabled. Error : Sensors with connectivity or configuration issues. Signature Status : The Sig  column in the interface indicates the status of sensor signatures: Signature version status Circle : Signatures are up to date (released within the last 7 days). Triangle : Signatures are outdated (older than 7 days). Square : Signatures are unreported or unidentifiable, possibly due to local scan configuration issues or connectivity errors. These visual indicators make it easy to assess and prioritize updates or troubleshooting efforts. Sensor update status: Actions on Endpoints When managing endpoints in Carbon Black Cloud, you can take the following actions: Add to Asset Groups Add selected endpoints to specified asset groups (if you’re using this feature). Remove from Asset Groups Remove endpoints from specific asset groups. Assign Policy Assign a prevention policy to determine sensor behavior. Update Sensors Update the sensor version on selected endpoints. Start Background Scan Initiate a one-time inventory scan to identify pre-existing malware. If the controlling policy includes background scan settings, the scan type (standard or expedited) will follow that policy. Otherwise, the default is a standard scan. Pause Background Scan Temporarily stop the background scan. It will restart when the service or endpoint restarts. Enable/Disable Bypass Enable bypass: Temporarily disable policy enforcement on the endpoint. Disable bypass: Reinstate policy enforcement. Quarantine/Unquarantine Assets Quarantine an endpoint to limit its outbound traffic and block inbound traffic. Release an endpoint from quarantine when it is no longer a threat. Uninstall Sensors Remove macOS and Windows sensors. After removal, the sensor will appear as deregistered until deleted. Delete Deregistered Assets Fully remove a sensor from the Carbon Black Cloud console. Disable Live Response Disable Live Response for remote investigations and remediation. Re-enabling it requires sensor reinstallation. Query Assets Run SQL queries against endpoints to gather specific information. Manage Sensor Gateway Connection Control whether endpoints communicate directly with Carbon Black Cloud or through a Sensor Gateway. Investigate and Go Live: Threat Hunting and Commands Each endpoint provides several options for deeper investigation. Below are some key features: Investigate This is your go-to option for threat hunting . If you want detailed steps on this, check out our article below Mention Link: Go Live The "Go Live" option allows you to run live commands on an endpoint. These commands can be invaluable during an active investigation. Query Asset Last Option (Prebuilt queries) USB Devices Management Under the "USB Devices" tab, you can monitor connected USB devices. The filters and options available here are self-explanatory, as shown in the screenshot below (see attachment). However, you might wonder, how do I block USB devices? The answer lies in creating a policy. When setting up a policy (as detailed in this article), you can include rules for blocking USB devices. Once a device is blocked, you will see an option to approve or reject it directly under the "USB Devices" tab. Example Scenario: A USB device is blocked by policy. Navigate to the "USB Devices" tab to see the blocked device. Approve the device if needed, or leave it blocked. Sensor Groups We’ve discussed sensor groups earlier. For more details, refer to the "Actions on Endpoints" section above. Sensor groups are an efficient way to manage multiple endpoints with similar configurations or policies. Conclusion By understanding these features, you can take full advantage of Carbon Black Cloud for endpoint management, threat hunting, and USB device control. Use the tools wisely to enhance your organization's cybersecurity posture. Keep experimenting with these settings, and don’t hesitate to tweak configurations based on your organization's needs. I’ll leave you here for now, but stay tuned for my next guide—there’s always more to learn! Upcoming Article: Carbon Black (P6:Settings): A Practical Guide/An Practical Training

---------------------------------------------------------------------------------------------------------- Clarification Note: I've noticed that this article has sparked some important discussions, and I truly appreciate the feedback. To clarify, I’m not suggesting that the PICERL model is the only correct approach, nor am I claiming that the DAIR model is superior. The intent here is simply to provide a structured, understandable way to view the incident response lifecycle—especially for organizations that currently lack any formal process. If your team prefers a dynamic or adaptive approach, or chooses to follow the DAIR model or a customized version of PICERL, that’s absolutely valid. The goal is not to force a one-size-fits-all solution but to encourage more structured and thoughtful incident response planning. This article is meant to provide a foundational understanding, and I fully support adapting the model to fit your organization’s maturity level, threat landscape, and operational style. --------------------------------------------------------------------------------------------------------- If you guys remember, I had written a post a while back about the DAIR model  — and honestly, the response was wild. I got so many messages, and follow-ups asking for a deeper dive into the topic. So here I am, trying to break it down better, one phase at a time. https://www.cyberengage.org/post/rethinking-incident-response-from-picerl-to-dair https://medium.com/@cyberengage.org/rethinking-incident-response-from-picerl-to-dair-7b153a76e044 Let’s get into it. ------------------------------------------------------------------------------------------------------------- 🚨 First, let’s be clear: Incident Response is not  linear There’s no magical 6-step recipe to handle incidents. Real-world incidents are messy. You’ve got multiple events happening in parallel , your alerting system is going off, someone’s panicking, and maybe your containment plan just half-worked. Things overlap  — and a linear approach just doesn't hold up anymore . For example: You detect something sketchy — cool, that’s your detection phase, right? But what if during containment or eradication, you uncover a whole new set of TTPs  or realize that another part of the system was compromised before detection even kicked in? Now you’re circling back. This is where DAIR  — the Dynamic Approach to Incident Response  — steps in. It’s not about replacing PICERL. It’s about shifting our mindset to a flexible, outcome-driven process . ⚙️ DAIR: Dynamic. Not Chaotic. DAIR breaks down into waypoints  rather than locked steps. Think of it like GPS rerouting in real time — you still want to reach your destination (containment and recovery), but you may need to take a few turns based on roadblocks you hit along the way. Here’s the core flow: Detect Analyze Improve Respond But in real life, it's more of a loop  than a line. ------------------------------------------------------------------------------------------------------------- 🧠 Preparation: The underrated superhero of IR Before you even start thinking about detection, you’ve gotta "know thy organization." Not just buzzwords — I’m talking about: What actually matters to the business? What’s your visibility like — do you have endpoint telemetry? Firewall logs? Sysmon? Or are you just hoping EDR will save the day? Who’s reviewing the logs, and how often? What’s your backup recovery process? Ever tested it? (Spoiler: most haven’t.) Also, can your IR team actually respond ? Do they get tabletop exercises , actual practice runs , or are they just hoping Google + gut feeling = success? Too many IR teams get stuck during a real event because they weren’t prepared for their own tools, their own network, or their own people. The DAIR model, just like PICERL, starts with preparation  because without it, everything else falls apart fast. ------------------------------------------------------------------------------------------------------------- 🔍 Detect: It’s not about noise — it’s about meaning Detection is where most IR teams spend their lives. But let’s break it down: IOA (Indicator of Attack)  = something an attacker does to get what they want (e.g. lateral movement, bypass attempts, privilege misuse) EOI (Event of Interest)  = “Hey, does this event actually matter to us  based on our  risk and context?” You can get a million IOAs, but if they don’t align with what your organization cares about, it might not even qualify as an EOI. That’s a big difference. Not every alert needs panic mode. Now, detection can be passive  (you get alerted from your SIEM, a user reports weird behavior, etc.), or active  — a.k.a. threat hunting. Active detection is where you're out there looking  for trouble. And once you detect something, that’s when clock starts ticking. Also, don’t underestimate human signals : A sysadmin noticing weird CPU spikes, or your helpdesk getting calls about failed logins — these can be golden early indicators . Blend your tech intel  (logs, EDR, network alerts) with your people intel , and your detection game gets way stronger. ------------------------------------------------------------------------------------------------------------- 🔍 Verifying & Triage — Don’t Just Jump the Gun Alright, so just because you spotted something weird doesn’t mean it’s go-time.This is where verify and triage  come into play — and trust me, this step saves you from chasing ghosts or overreacting to a false alarm. So what are we really doing here? We're asking basic but critical questions : “Is this actually a real incident?” “Is it something that impacts our environment or our business?” “Is it worth pulling in the full IR team, or can we handle it quietly?” Let’s be honest — not everything weird is worth a full-blown IR war room.Sometimes it’s just noise.Sometimes it's someone forgetting their password and triggering alerts with failed logins from five devices at once. So we verify : Is this event something that should even be on our radar? And then we triage : Based on what we know so far, who do we need in the room? For example, if it’s someone threatening a coworker over email, maybe that’s an HR + legal thing, not just IR. If it's ransomware in your backups? That’s game-on. Also — don’t skip getting management input here. You don’t want to be guessing whether something is “business-critical” or not. Always align technical actions with business priorities. That’s how you earn trust. ------------------------------------------------------------------------------------------------------------- 📏 Scoping: How Bad Is It, Really? Once we know it’s real, the next question is: How deep does this thing go? Scoping is about figuring out the blast radius. Which systems are affected? Which users? Which parts of the network? Maybe you found a malicious registry key with an encoded blob in one system — cool, but how many other systems have that same key ? Maybe an attacker used a known IP — where else did that IP touch your infrastructure? To do this right, you’re gonna pull from a ton of data sources : EDR, SIEM, logs, threat intel, PowerShell outputs, config files, even registry snapshots if needed. Sometimes the scoping phase alone is a full-on detective mission. And here’s the catch: you’ll probably do this more than once. The DAIR model treats response phases as a loop , not a one-and-done checklist. So as you uncover new info (TTPs, new users, lateral movement), you’ll loop back and rescope  again — and again — until you're confident you’ve mapped the full picture. Skipping or half-assing this step is what leads to "Oops, we missed that second C2 channel."  Don’t be that IR team. ------------------------------------------------------------------------------------------------------------- 🛑 Contain — Stop the Bleed Alright, now that we know what we’re dealing with, it’s time to freeze the attacker  in place. Containment  is all about one thing: making sure the bad actor can’t keep doing damage  while we plan next steps. This isn’t just pulling the plug. It’s smart isolation : Throw the host into a private VLAN Block known attacker IPs Change DNS routes Lock compromised user accounts Cut C2 channels with some smart ACL magic Now, containment doesn't always mean full-on disconnection. Sometimes you want to watch what they’re doing for a little longer — gather more data before cutting them off. And speaking of data: this is a golden time for evidence collection .If you isolate a host, grab logs, memory dumps, network traces — before  the system reboots or changes state. But don’t go overboard. If leadership doesn’t care about forensic review or court action, maybe you don’t need a full 100GB image of that file server. Balance data collection vs. business value . Also — everything you do during containment should support what’s coming next. For example, if you’re revoking credentials now, you’re also laying the foundation for eradication  and recovery  later. That’s why DAIR is a loop — not everything is siloed. ----------------------------------------------------------------------------------------------------- 🚨 Eradicate: Time to Clean House Once you’ve caught wind of the attacker’s activity and put up the initial blocks (aka containment), it’s time to get serious: erase their fingerprints from your house . Eradication isn’t just about kicking them out. It’s about reversing the damage they did , and making sure no doors are left open for them to stroll back in. Here’s what this really looks like: Wipe out malicious processes, hidden users, or rogue scheduled tasks. Roll back from known-good backups — assuming you’ve got some. Remove persistence mechanisms (e.g., registry tweaks, rootkits, or cron jobs). Patch up the hole they crawled through — whether it was a CVE, weak creds, or a bad config. If they messed with source code or tried sneaky fraud tricks (hello, bogus transactions), unwind all of that too. This phase leans heavily on your earlier investigation work. What you learned while analyzing logs, running memory forensics, or doing packet captures — that’s what guides your clean-up operation. 🧠 Tip: Containment ≠ Eradication.  One stops the bleeding, the other heals the wound. ----------------------------------------------------------------------------------------------------- 🔧 Recover: Don’t Just Reboot — Reinforce Alright, so you’ve cleaned up the mess. Now what? Recovery  isn’t about just flipping the switch and saying, “We’re good.” It’s about making sure we don’t end up in this same mess again. This is where root cause analysis  comes into play. Not just what happened — but why  it happened. Ask yourself: Why was this even possible? Was it a bad policy, or a good one nobody followed? Did our alerts fire and nobody noticed? Was that admin using the same password since 2017? Recovery also means: Rebuilding or restoring systems with clean images. Changing compromised credentials and revoking tokens. Reissuing API keys or cloud creds. Validating app integrity (especially for dev or prod environments). Getting SMEs to test the system before it goes live again. And yes — test everything. Don’t just patch and pray. Make sure everything works as expected before  you bring it all back online. And when you do go live? Watch those systems like a hawk. Assume the attacker wants back in. ----------------------------------------------------------------------------------------------------- 🔁 Repeat: Because One Loop Is Never Enough Let’s be real — IR isn’t a one-and-done process. During the recovery or eradication phases, you’ll often discover more indicators, more footholds , or other places where the attacker left a mark. And when that happens? You don’t just patch and move on. You loop back : Re-scope the incident based on new findings Re-contain the new areas Re-analyze logs or malware samples Re-do eradication if needed Expand recovery if more systems are impacted You’ll rinse and repeat this until: There’s nothing left of the attacker’s presence Stakeholders are confident the threat is neutralized You’ve implemented proper safeguards to prevent a repeat This isn’t just busywork. It’s how real IR works in the field . Especially when you’re dealing with APTs or any attacker with actual skills, you’re going to learn more as you go . ----------------------------------------------------------------------------------------------------- Debrief: Let’s Talk Real Talk Post-Incident Alright, the chaos has settled, the alerts have calmed down, and you’ve officially closed the incident. But we’re not done yet. It’s time to debrief —and no, this isn’t just about typing up a long, boring report. This is your chance to actually learn something  from the whole mess. This is where we sit down and talk: What worked? What completely flopped? What can we do better next time? Sometimes this is a polished PDF with a cover page and timeline. Sometimes it’s just well-documented notes in your IR platform or ticketing system. Format doesn’t matter. Value does. So what should the Debrief look like? Capture what happened (timeline, impact, decisions made). Be honest. No fluff. Just facts (and where you’re not sure, make it clear it’s conjecture). Record what tools and people helped vs. slowed things down. Highlight wins—your team did something right in the heat, so give credit. Then, use it! Share it with key stakeholders (they might finally approve that EDR upgrade you’ve been asking for). Use it to fix broken playbooks , fine-tune escalation paths , and close the feedback loop . Schedule a follow-up (don’t ghost your own process). Did the changes you suggested actually happen ? Pro Tip: Right after an incident, security is fresh in everyone’s mind. It’s the perfect moment to ask for improvements: better logging, better tooling, more training, etc. The biggest mistake is skipping the debrief. That’s how lessons get lost. And remember:  The next incident is coming . What you learn here will determine whether you’re sprinting or stumbling when it hits. ----------------------------------------------------------------------------------------------------- Stay flexible. Stay curious. And stay humble — because attackers love when defenders get lazy.

When managing Carbon Black, the Enforce  tab plays a pivotal role . It houses the tools for creating and managing policies , which dictate how sensors interact with assets, prevent threats, and allow or block specific behaviors. Introduction to Policies Policies in Carbon Black are collections of prevention rules and behavioral settings. These define how sensors interact with endpoints to: Allow or block specific behaviors. Implement custom blocking rules. Modify communication between sensors and the Carbon Black Cloud. Interface Overview When you click on the Policies  section, you’ll find: Left Panel:  Lists all your created policies. Main Panel:  Contains tabs like General , Prevention , Local Scan , and Sensor  for each selected policy. ------------------------------------------------------------------------------------------------------------- Policy Tabs and Their Functions 1. General Tab This section provides basic information about the policy: Policy Name  and Description. Additional configurable settings. 2. Prevention Tab This is the core of policy management. It allows users to configure: Permissions : Permissions in Carbon Black involve whitelisting paths or applications . Unlike other tools like SentinelOne, Carbon Black uses flexible path-based formats for exclusions: Example: C:\windows\carbonblack\** **\carbonblack\** Core Prevention Settings : Use Carbon Black’s backend engines for threat detection and response . These s ettings allow you to configure actions like terminating processes or generating alerts. Blocking and Isolation Rules Carbon Black offers robust capabilities, such as path-based blocklisting: Example: Block PowerShell and Python executables using: **\powershell*.exe **/python USB Blocking Enable or configure USB restrictions as per your organizational requirements. 3. Sensor Settings Fine-tune how sensors operate, including options for auto-deleting known malware and enabling local scanners. ------------------------------------------------------------------------------------------------------------- Creating a New Policy To create a policy: Click New Policy . Fill in details like: Name  and Description. Copy Settings From : Use predefined templates provided by Carbon Black for common use cases. These serve as baselines that you can modify to suit specific needs. Predefined Policies Predefined policies are templates that: Establish a baseline level of enforcement. Can be assigned to sensors. Allow customization but cannot be deleted. Each Predefined policy with description: Now after Writing description and Policy name next tab you have to configure - Core prevention and Permission (I am Leaving those as default because these are testing policies) In Below screenshot if see there are few process which are predefined by Carbonblack. Example in case of Carbonblack thinks its Adware it will terminated to process automatically. (How cool is that!) For My perspective, Do not touch below configuration even you creating new policy for production environment (Leave those as default) . If you want to add any other path or file name you can add by clicking add file path Last thing to configure in Policy is USB Blocking: If needed, you can add rules to block USB devices. This is optional and depends on your use case. Once you’ve configured the required settings, your policy is ready to go! ------------------------------------------------------------------------------------------------------------- Reputation Management The Reputation  tab is where you can manage files and applications based on their reputation. Blocking Hashes : You can block specific SHA-256 hashes if you know they’re malicious. Adding Exclusions : Similarly, you can add hashes to an exclusion list to avoid false positives. This feature provides flexibility and precision for managing files based on their known behaviors. ------------------------------------------------------------------------------------------------------------- Malware Removal Managing detected malware is one of the core features of Carbon Black Cloud. Here’s how to handle it effectively: Detected Malware : The Detected  tab shows files classified as KNOWN_MALWARE, SUSPECT_MALWARE, or PUP (Potentially Unwanted Program) . You can: Search for specific files by hash or filename. Take action to delete malware directly from the Investigate page. Auto-Deleting Known Malware :You can configure policies to automatically delete known malware after a specified time. Go to Enforce > Policies . Select the desired policy and enable Auto-delete known malware hashes after . Choose the time frame and save. Deleted malware moves from the Detected  tab to the Deleted  tab. Remember, once malware is deleted, it cannot be restored, so proceed carefully. ------------------------------------------------------------------------------------------------------------- Cloud Analysis The Cloud Analysis  feature integrates with Symantec CYNIC to improve protection against unknown threats. Here’s how you enable it: Navigate to Enforce > Policies . Select a policy. Enable Submit unknown binaries for analysis  under the Sensor tab. This submits "NOT_LISTED" binaries (e.g., .exe, .dll) to Symantec CYNIC for automated analysis. It’s worth enabling this feature to bolster your defenses against new and evolving threats. ------------------------------------------------------------------------------------------------------------- Recommendations Carbon Black Cloud generates recommendations to improve the health of your environment. These suggestions are based on: Blocked events in your organization. Global insights from other organizations. Accepted reputation rules. You can review these recommendations and apply them to optimize your configurations. ------------------------------------------------------------------------------------------------------------- Wrapping Up That’s all you need to know about policy management in Carbon Black Cloud! From exclusions and blocking rules to handling malware and leveraging cloud analysis, you now have a solid foundation to manage policies effectively. Keep experimenting with these settings, and don’t hesitate to tweak configurations based on your organization's needs. I’ll leave you here for now, but stay tuned for my next guide—there’s always more to learn! ---------------------------------------------------------------------------------------------------------- Upcoming article: Carbon Black (P5:Inventory): A Practical Guide/An Practical Training ----------------------------------------------------------------------------------------------------------

The Investigate  feature in Carbon Black is a powerful tool that allows you to perform deep searches, analyze details, and hunt for suspicious activities across your environment . It’s like a forensic magnifying glass, enabling SOC analysts to dig into both failed and successful operations  performed by applications and processes on endpoints. While I won’t dive into a full analysis tutorial here, this is an overview of how the feature works and why it’s so useful. Let’s break it down. ------------------------------------------------------------------------------------------------------------ Overview of the Investigate Page When you open the Investigate  page (screenshot provided below), you’ll notice its similarity to SentinelOne’s timeline feature. Filters on the Left : These allow you to refine your search. Search Bar : Positioned at the top, you can run queries tailored to your investigation needs. Search Guide : Found at the top-right, this embedded guide assists you in crafting advanced queries. Carbon Black markets this feature as a way to analyze every observation stored in the cloud , allowing you to: Identify failed or successful operations. Collect and act on data from your search results. Use advanced search techniques for detailed visibility into events, processes, and observations. ------------------------------------------------------------------------------------------------------------ How to Use Investigate: A Basic Example Let’s revisit a scenario from a previous article: you’ve created a rule to block wmiprvse.exe when invoked by cscript.exe. Now you want to investigate. Run a Simple Query : process_name:cscript.exe This query fetches all processes matching the name cscript.exe. Below the search bar, you’ll find three tabs: Observations Processes Auth Events ------------------------------------------------------------------------------------------------------------ The Observations Tab The Observations Tab  provides a list of all interesting activities in your environment that didn’t necessarily trigger an alert. Use Case : You detected a suspicious file and want to hunt for related activity. Observations allow you to search for processes, registry modifications, or other actions tied to the file. Filters on the Left : These can be used to narrow your hunt and pinpoint specific activities. Action Tab : Clicking on the graph-like structure (Process Analysis) lets you investigate further. Example Query for Hunting : alert_category:THREAT OR sensor_action:DENY OR ttp:FILELESS This expands your search scope, focusing on threats, denied actions, or fileless attacks. ------------------------------------------------------------------------------------------------------------ The Processes Tab The Processes Tab  gives details of all processes that ran in your environment based on your query. Example : fileless_scriptload_cmdline:.ps1 This query filters for PowerShell script (.ps1) executions. The output lists processes tied to such executions, enabling you to spot any malicious activity. ------------------------------------------------------------------------------------------------------------ The Auth Events Tab This is one of the standout features of Carbon Black. The Auth Events Tab  provides detailed insights into Windows authentication events, supplementing process activity logs. What You Can Investigate : Who logged in to an endpoint during suspicious activity. Failed login attempts and brute-force attacks. Privilege escalation attempts and lateral movement. Remote logins from anomalous sources. Insider threats or use of stolen credentials. Why It’s Valuable : SOC analysts gain critical context during threat hunting and incident response. Carbon Black’s ability to correlate authentication events with process activity  reduces response times and minimizes reliance on third-party tools. Example Search : Failed Login Attempts on a Specific Endpoint : (With Search/Filter) Remote Logins : (With Search/Filter) ------------------------------------------------------------------------------------------------------------ Why I’m a Fan of This Feature Carbon Black’s I nvestigate  tool offers simplicity and depth, eliminating the need to manually sift through logs. You can: Quickly search for anomalies. Export details for reporting. Investigate further with ease. Real-World Benefits: The seamless integration of authentication data with process analysis enhances visibility, making it easier to detect and respond to threats like lateral movement, privilege escalation, or brute-force attacks. ------------------------------------------------------------------------------------------------------------ Stay tuned for the next article!Until then, keep learning and growing. See you soon! 😊 Upcoming article : Carbon Black (P4:Enforce): A Practical Guide/An Practical Training ----------------------------------------------Dean-------------------------------------------------