Message platform for automated threat simulation, reporting, detection, and remediation
摘要
說明書
Both the cluster summary and the message summary may also have a rule creation button (button 1130 and button 1230). The rule creation button 1130 and/or button 1230 allow for the administrator to create a rule from the reported message, as will be discussed in detail below. The cluster summary and the message summary may also have a recipe creation button to create a recipe from the corresponding cluster or message, as will be discussed in further detail below.
Rules Module
The network server can include a rules module for the creation, modification, and application of rules to the messages reported. The rules applied to the messages can identify textual or binary patterns in message data, such as the body, headers, or attachments of a message using wild-cards, case-insensitive strings, regular expressions, special operators, or other operations. In some embodiments, as a non-limiting example, the rules can be YARA rules. The rules can be used to detect malicious messages based on local threat information. In an example process flow, a message is received at the network server and is processed by the rules.
The system rules module can be configured to process the messages received at the network server that have been identified as suspicious by a user. For the received messages, the system can process the messages with a pattern matching tool, according to pattern matching rules provided to the system. As a non-limiting example, YARA can be used as the pattern matching tool.
