SOAR-EDR

Implements an automated cybersecurity response system using LimaCharlie, Tines, and Slack to detect, alert, and isolate threats on a Windows server

SOAR-EDR Implementation Guide

Part 1: Design Objectives:

• Create a Playbook Workflow
• Brainstorm actions to include in the playbook.

Notes:
Use draw.io to visualize the workflow.

---

Part 2: LimaCharlie Setup

1. Install and Configure LimaCharlie
   • Choose Vultr as the cloud provider to deploy a Windows Server machine.
   • Install LimaCharlie on the Windows Server to log and monitor all events.

Note:
Screenshot of the Windows Server setup

2. Setup LimaCharlie

---

Part 3: Telemetry Generation

1. Generate Telemetry with Lazagne
   • Disable Windows Security temporarily
   • Download and execute Lazagne.exe (a vulnerability demonstration tool).

Note:

• Screenshot of Lazagne running in PowerShell

  

• LimaCharlie should detect the download of Lazagne. Include a screenshot of the detection log

2. Create Detection & Response (D&R) Rule
   • Navigate to Organization > Automation > D&R Rules > New Rule
   • Locate the event in the LimaCharlie logs and add it to the rule.

Note:

• Screenshot of the rule creation and test output

• Screenshot of the detection result

  

---

Part 4: Slack & Tines Integration

1. Configure Slack and Tines
   • Set up a dedicated Slack channel for notifications.
   • Configure Tines for playbook setup.

Note:

• Slack channel setup

  

Tines

2. Connect Tines with LimaCharlie
   • Go to Sensors > Outputs > Add Output > Detections > Tines in LimaCharlie.

Note:

---

Part 5: Automation and Playbook Creation

1. Develop the Playbook
   • Objective: Automate responses including sending a Slack message, an email with detection details, and generating a user prompt for machine isolation.
   • If the response is “Yes,” proceed to isolate the affected machine.

Note:

• screenshot of the playbook and, a demo video

Watch the demo video

Note: Clicking the link in the Slack message or email takes you directly to the specific LimaCharlie event, providing detailed insights for further investigation.

Takeaways

• Created Custom Detection & Response Rules with LimaCharlie.
• Developed a response playbook incorporating Tines, Slack, and email notifications.
• Enhanced response capabilities to include automated machine isolation based on user prompts.