Name: The Threat Hunting Roadshow: Your Road to Resilience
Uploaded: 2025-11-13T17:20:25.684Z
Duration: 51 min 47 s
Description: The Threat Hunting Roadshow: Your Road to Resilience

Transcript for "The Threat Hunting Roadshow: Your Road to Resilience": Looks like we're good. You can see my presentation. Fantastic. Okay. Welcome everyone to the Threat Hunting Roadshow. I'm very excited to, do this presentation today. I usually do it for, like, specific customers, so doing it in more of a wider audience, I think is great. So I can have a little bit of a further reach and and, really show off what the Centrix platform can do for threat hunting and how you can, leverage it for those type of activities. So this is just our agenda. We'll get started. We'll develop some skills. We'll be in the console. We'll be in a demo tenant, but please join along in your own tenant. It will be more relevant information than the demo tenant. So feel free to have that up in an extra tab or an extra window and and look at yours, while we're going along. We're gonna have some exercises usually in a classroom kind of environment. I would have you guys go in and and try to answer these, but we'll solve them together. So it's a little bit more collaborative for this, webinar, and then we'll have a wrap up and some questions. Alright. So this is me. I am Ky Thompson. I'm a manager of threat hunting here at Armis. I've been at Armis for about three and a half years. Basically, our team is the managed threat service team or MTS. So we provide a managed threat service to our customers who subscribe. And that includes, you know, reporting and IT, OT. We have a continuous threat hunt report report that we release monthly for kind of top items in the news trending. And then also, we do some other things as well to to help out internally and help out with some other customers who aren't necessarily subscribed to us, but that's what I do here. And then I've had about, actually, about twelve years, but ten looked better on that on the logo there for, industry experience. So a lot of, prevention, detection, and response work. I've done awareness and communications. I was a vehicle security engineer for a number of years. So, and I've worn many different hats, but, my heart truly is in the threat space, and I really enjoy, the work that I've been doing for the last three and a half years. Okay. So to kinda level set and get us started, I just wanted to talk about how SentriX is really so rich in data, and you can leverage it for threat hunting activities. And I think maybe some people don't always do that, but it's really great. So we have our integrations that feed into it. So we have hundreds of those. If you have some those set up and your tenant can really enrich the data there. We have, of course, the telemetry, so everything on the wire, and then we have our asset intelligence engine and others that are really feeding into the platform. And it just gives us really great, data that we can use and and and hunt in. So what does it do for us if we hunt in Centrix? It establishes connect contextual foundation through deep passive visibility into all devices, distinguishes between normal and abnormal for every asset type, environment, and business context. It can help you reduce attacker dwell time and instant response time as well, and it helps you, adapt rapidly to new and emerging threats. So how you would go about starting generating your kind of threat hunting hypothesis. So we have our Citrix platform here that has all of those data feeds that feed into it, like I said. And then you can take your own use cases. So those can be around critical assets. They can be business objectives, security concerns, you know, previous, security events that happened. Maybe you are very conscious of those. You wanna make sure they don't happen. So you take those use cases, and then you also add on threat intelligence, so open and close. Also zero days, critical vulnerabilities. You take all that together, and it helps you generate a threat hunting hypothesis. Okay. So now we're gonna get into the meat of it. And I will kind of say that this could be a three hour presentation, but I'm gonna try to keep it succinct and, briefer than I normally would. But I still wanna look at some really great stuff. So, basically, I'm going to show you, how I use SentriX to threat hunt and the types of data activities, devices, all those things, that I find really relevant to threat hunting activities. So there's a couple different text techniques for threat hunting. We have structured hunting, and we have unstructured hunting. So structured hunting is indicator based and intel informed. So you can receive an, you know, piece of intelligence, that has, you know, IPs, domains, certain applications, file names, ports. So those are things that you know they're bad or suspicious. You've received that intel on them. You know they're an indicator of something, and then you go in there and you structured you you do a structured hunt, essentially. An unstructured hunt. So you're gonna be more focused on just analyzing generally network traffic or user behavior. So you're gonna be looking for activities like beaconing or lateral movement possibly, protocol anomalies, traffic spikes, authentication failures, kind of like brute force activities. So that's what the unstructured hunting is. So you don't really have that intel. You don't know what you're looking for, but you want to go into the platform, you wanna go into your tenant, and you wanna look for strange things. This would be considered unstructured hunting. I'm just gonna briefly talk about devices, because they are helpful for a number of reasons. So we have various categories. If you're familiar with Armis and Syntrix and your tenant already, then you know this. And we have, you know, hundreds of device types as well. So really a a breadth of, different device knowledge there. And then in the devices so this is handy. So if you have again, say it's a structured hunt. Right? You have a specific device that has a vulnerability that's being targeted for, you know, certain exploit or an operating system that is being targeted specifically for a malware. So you can leverage these, within the tenant by looking up that specific information, and then you can kind of pivot from the devices to the activities for those devices. Or devices are also helpful when you're kind of in the investigative mode. So you find the activity that's strange or concerning, and then from there, you wanna pivot and then go into devices and see what it's all about. This is all information that can help you with that investigation. So you have model, you have brand, operating system. You can leverage boundaries as well, visibility for devices, so full visibility, Mac and IPs and, risk level as well. You can, use to refine kind of your activities. I also wanna call out, a little bit of OT in this. I know it could be a a whole other presentation and a whole other beast of itself, but, I do wanna call out some specific OT, activities and device, things as I go through. So devices for OT and ICS, we you can use the category manufacturing equipment includes a lot of different device types. Some of those that are listed there, SCADA engineering workstations, historians, switches, PLCs, those things. And then also, you can leverage Purdue level. So we have Purdue level zero, one, two, and three, which is usually associated with OT. So that's helpful for an OT specific device, view. And then also, if you're in devices and you look for the, PLC module parameter, you can actually look at a few different things. So end of support and then status. So if there's, like, a major fault or stopped, that may be something that's interesting to investigate a little bit further. And then also one that I, don't always see, people, aware of is this, remote mode remote mode enabled, which can be, very helpful. Right? Because, it means that you can remotely access, the PLC. And whether or not you want that, then that can help you, kind of do an audit of that. Okay. Activities is where I live. So we're gonna be more deep into this. We're gonna get into the demo tenant and kind of go through some of these. But just to refresh, we have, you know, multiple type groups, OT, security, high level traffic, wireless, all sorts of other, type groups there, and then about a 150, you know, seems to grow every day of activity types. And then this is very important. So when I'm hunting, I don't want all the noise. I don't want, you know, to be overwhelmed. I want to be able to pare down to what's most important. So how do we refine and prioritize? These are the things that we can use to refine and prioritize our results. And they're not always available for all activities. That's why I listed multiple of them, because, you know, some of them you can use for certain activities and some of them you can't, but those things are decision data, content, device. So on device, you would have, like, boundary visibility, those things. We'll take a look at it in a minute, and then source and destination. So these are all things that can help us really get a clearer, view of what's important and kind of clear out all that noise and maybe, what would be distracting so we can really get to the meat and potatoes of our hunting. Okay. So I'm going to get on screen share mode. So we're gonna go into the tenant. Okay. So the first one we're gonna take a look at is application usage. I'm just gonna put this down to fourteen days, so it's a little bit faster. So application usage can be useful for a number of things. So you can use it if you are looking for say, there is a, a tool that's, you know, used for red teaming activities. And that could be, you know, legitimate for those security folks within your environment. But say it's not. So let's take a look and what we can use. So, again, we're gonna prioritize. So if we're just looking at application usage for the demo tenant, there's 7,000 some activity. So that seems a little bit overwhelming. Right? So we can go in here and we can add our filter, and we can say, let's do decision data and then application name. And then let's see if there is one for PowerShell. I'm gonna try to go for a common one that's might be in the dem demo tenant, but please follow along on your own. You might find something more interesting in your own, tenant. Yay. Okay. Great. So, by going into the decision data, we were actually able to say, okay. We actually went to look for the application. In this case, we searched PowerShell. So this would be, helpful if you're trying to look for, applications that are being used that maybe they're not supposed to be. We can also try something like let's see if we have something for InMAP. Yes. We do. So, you can look for those and then you can check and say, okay, let's take a look at this device. Let's go and look at the user associated with this device. Okay. It looks like, you know, John Smith is a security engineer. He does use Nmap. That's allowed. That's fine. But you might possibly find something that's not allowed or that's surprising. You can also use application usage for, say, there is a exploit out there that maybe leverages, a certain application. So if you see a spike in let's see. Can this one do, like, Internet Explorer. Okay. So let's say this was a, application that is used from a threat actor. There's a recent malware where recent attack that's out there. And then you see a spike in this application that's being used that maybe you would be used, you know, more infrequently, but all of a sudden you're seeing hundreds and hundreds of activities for this certain application that you know is being used by a threat actor for their own, activities, then that would be a a great way to, look at that information as well. For the sake of time, I'm gonna keep on moving on. Like I said, I can really get in the weeds here. Okay. So user agent found is another good one. How you can use this is you can if you're doing unstructured hunting, you can go through here and look for the odd ones. You can export. I do this quite often, export and then essentially stack and and pivot on the data. So say you're looking for the user agents that there's only one or two of them. So, you have the, you know, power shells of the world. Okay. That's allowed in the environment. We know that, you know, social media. Sure. But then maybe there's one user agent that's just weird, and it doesn't have it's not being used very often. Maybe you do a little bit more investigation on what that user agent is, what the device is that's using it, and then see if there's kind of, further interaction in your environment with that user agent. It's although also really nice to see, user agents can be used for, like, I wanna say rogue, but, like, remote access, applications that maybe are unexpected or are used as, like, a, what's approved for the company. So that'd be another good way to look for it as well. And then also, you can, of course, use the user agent for, utilize the content. Again, we're finding and prioritizing Celeste. For the application usage, we use decision data. For this one, we're looking at content. So say there is a malicious user agent, you received the piece of intel. It is called Twitter. I'm just gonna say that as an example. Okay. Then we're able to say, okay. We have nine instances of the Twitter user agent, and then you can go and do your investigation from there. So, again, you can use it for structured or unstructured. Okay. The next one I wanna take a look at is HTTP request. So this one, you can leverage a couple different pieces in the decision data. So if you know what host you're looking for, and then I'll do an example of this in just a second, and then you can use that method. So connect, post, git, you can, narrow down the results there if you're looking for a specific HTTP method, server port. So it's gonna be, you know, 80, you know, eighty eighty, what these other ones are as well. And then you can actually, leverage a user agent in here too. But let's say I wanna look at HTTP request, for geo external traffic to do ends with CN. Okay. So now I know we have, HTTP traffic. So, insecure traffic, going to, geo external hosts in China. So then I wanna go and say, okay. This is legitimate. Yes. Okay. Sure. This is a, global employee. Makes sense. And then you can either check it out or you can see something that maybe is suspicious and then do your investigation from there. Again, you drill down into your device. You look at the other activities at that time. You can look at, you know, IP connections, open ports, destination ports. But investigating in and of itself can be a whole other presentation. Okay. DNS query is another good one, that you can use. So HTTP request and SSL connection, I use a a little bit more than DNS query, but DNS query can still be refined to be, helpful. So you can do certain things within decision data, like look for answer IP. So if you have, say you have a IP and we're just gonna copy this one as an example. Oops. So you have an IP that you received through, a piece of intel that's a, you know, bad address associated with some malicious activity. So we're doing structured hunting. We can go into decision data, and then we can say the answer IP was this. And then, it helps us, find what the domain is. Right? So in this case, it's Microsoft. But let's say it's something, you know, bad and malicious. So then we have this piece of information, and then we can go ahead and pivot on that and start looking at, host, kind of activities as well instead of the IP. So we know what the IP resolves to, then we can go ahead and continue on our investigation and maybe see, you know, how far that, malicious, address really reached. Okay. That was the high level traffic group. The security group is, quite, helpful as well for threat hunting activities. I know there's not a suspicious URL, example within, the demo tenant, but I still wanted to be able to, show this to you because so maybe you can have your tenant up and you can follow along and see what I'm talking about. So we can't necessarily search file name indicators, within Centrix, but there are some ways you can do it not so explicitly. So one of those, that's quite helpful is the suspicious URL. So, basically, if there is a file that's attached to a suspicious URL, say it's an a phishing message, so you have the URL and then them tagged on the end as an executable or a DLL file. So these are often indicators that you see, in intelligence briefings. So what you can actually do is go into the decision data and then URL. And you could say contains, and you can say dot e x e or dot d l l. So then you can actually see file name indicators potentially within the suspicious URL, activity type. So we leverage that, quite often in our threat hunting activities as well. It's a way to kinda get around and still see those, file names that may be malicious, but we don't, you know, explicitly have a file activity type. Suspicious host is another good one. Decision data for this. Let's just take a look at what it would be before we do the decision data. So fourteen days, we'll do thirty. So we have more data to look at. Okay. So 49 activities. So decision data for this one, let's say the connection is established only. So we don't care about the attempted suspicious host communications. We only care about those established connections. So let's narrow it down. Now we're at 44. So the next thing we can leverage is our confidence here. So let's say we only want to look at high and highest. In this case, there are none, but that's a way that you can refine, what the highest confidence is, and that's what the suspicious suspiciousness is. The suspicious level is a high confidence. And this is from the virus total enterprise fee that's adjusted. So you can use that, and it would narrow it down even more. You can also utilize let's try to do let's get rid of the confidence so we get some more results back, and then let's see if we have any for 80. Great. So now we have suspicious host. In our decision data, we're only looking at the connections that are established. And then we're looking at the suspicious host established connections over port 80. So if we take a look at what those results are, then we can do a little bit of an investigation on these, and, then we can also pivot. You can take the host and do more host based activity type searches as well and really see if there's any other, devices that are, touching it outside of the suspicious host activity type. Okay. Let's take a look at BruteForce. We're not gonna have too many examples on this one in the demo tenant, but I'm glad there's one. So this is another one where, this content field, you can leverage, like, specific information in it. So if we go to decision data and then we're going to go to results. So just like, with suspicious host, we looked at those established connections only. For the result, we can look for a brute force that is successful only. In this case, the example that we have is not a success, but we'll still take a look there. And then for the decision data here, I mean, there's a lot that you can use for this one, which I think is important because it depends on what the threshold is, for your environment and what the more kind of, severe, you know, attempt counts or, you can look at usernames as well. So you can say, you know, I only wanna look at admin or anonymous, those sorts of things. So the the high high value users that maybe malicious brute force activity would target. So, again, decision data content, leverage it as much as you can to refine those results and really get rid of that noise. We also have credentials activity. So, we have, two of them. One of them is plain text, and then one of them is default credentials. So this can more so be used for, I would say, kind of cyber hygiene. For the default credentials, you can go in there and then see what the device is and then find that device owner, make sure those default credentials are updated. That's kind of, how you can use those activity types. Oops. Port scan detected is another good one. Let's see if we have anything on the demo tenant. We do great. So this is another one. Okay. So, again, we have almost 2,000 activities. It's kind of overwhelming. So how can we narrow that down? We're gonna use our decision data again. So number of ports scanned, scan type, target IPs, target ports. So let's just say do twenty two and eighty. See what results we have. Great. So we went from almost 2,000 to 89 activities that are targeting twenty two and eighty. So this is more manageable for, you know, reviewing and seeing if it is actually something suspicious or if it ends up being legitimate. And I don't believe let me double check. I don't think there are examples of this in the demo tenant, but let's see. Oh, there is. Great. So this first one, anomaly detected, is for device, device anomaly. So, and then there's traffic anomaly detected as well. So, it's basically specific to a device, and it's if you open up this and look at it doesn't give the explicit, description on this one. But like I said, if you're in your own tenant, it's a lot it's a lot better, and you have a lot more relevant information to, book at. But this specifically so if there is a spike, in traffic for this device, the confidence is high. So this is really abnormal, for this device, And then the total traffic is that. And then if we do traffic anomaly detected So this is another one, where it tells you the total traffic. It tells you the server port, the confidence, and this is another one where you can leverage that decision data. So let's say we only care about the highest confidence of abnormality, then we have 10 that we can go in and we can look at, and that's manageable for us to go and and do a little bit of a further analysis on. Okay. Let's go into this next one. I'm not gonna go into this into the tenant for the sake of time, but these are also some good ones I wanted to call out for the OT environments. And I think it's also interesting to, call out that there if you see when you're looking at activities, there are some that explicitly say PLC in them, and there are some that do not. So the online edit, configuration change, mode change, and, again, these are just examples. They're not, all of the activity types related to OT. But these ones are related to just in general manufacturing devices. The ones that explicitly say PLC are related to specifically PLCs. But I like to call that out just because, it can give you a little bit of a wider view, if you expand to those other just general manufacturing, device activity types as well. And these are some good ones that I listed here that may lead to some interesting, you know, hunting hypotheses or, findings. So firmware downgrade, you know, that could be, an issue there, trying to reintroduce, you know, vulnerabilities, or, you know, certain things like that. If you see that happen, that would be good to investigate to see whether or not it was legitimate or whether or not something suspicious did happen. And I also think it's important to call out, IP connections are used to I use them. We use them to confirm traffic. So let's go back to our example of h t t p request. And then let's do the example. We said it was geo external. So ends with okay. So let's say we want to see if there actually is traffic, that was successfully, connected. So we would go to IP connections. And then let's say, endpoint a, we're going to do network location as internal. And endpoint b, we're gonna do external host address ends with c n. And then we know from HTTP request that we were looking at, I'll just do I'll do port port 80. See if we have any for this. Perfect. So then we can see here, these are some of the ones that also showed up for the HTTP activity. So we're validating that HTTP activity with these established IP connections. And then we can see, you know, the total of traffic exchanged and other details as well. But it's helpful to leverage IP connections to really validate traffic. You can also use it for suspicious hosts to confirm if those, the traffic was exchanged. Okay. I didn't touch on vulnerabilities, because that's something, again, in and of itself. But vulnerabilities can be leveraged as well, for hunting activities. So you can use it to look at a specific subset of, vulnerable devices and then look at activities like suspicious hosts, application usage from those, critically vulnerable devices and look for, possible threat actors that are leveraging the the vulnerability to exploit. So that's a good way to use that. But I also wanna talk about briefly, on alerting. So alerts can be used, or policies can be defined to generate alerts. And then you can also have certain actions that are, associated to those, policies as well. So, you know, device quarantine or or things like that. But, a a good way to do false positive reduction on some of the existing policies that you may have, exclude the vulnerability scanner device type, and then also white list sources of benign threat activity. So, again, you're trying to get rid of that noise, which I think is most important. When you're hunting, you don't want the excessive, noise, and it really just muddies the water. So those are things that you can do there. I'm not gonna get into policies again because it's like a huge one, but we do have in the standard library, the global threat detected policy is a great one to enable. I wanted to share that for, like, a suggestion if you don't have it already enabled in your tenant. It leverages a database of signatures and patterns. It has, you know, knowledge of behavioral analytics, has threat intelligence, deep packet inspection. So those are, good, usually high fidelity, As long as you exclude out those, vulnerability scanners, then those are usually, good, policies to have enabled. Also, from a threat hunting perspective, say you're going through you found, you know, a really good finding. You wanna go ahead and and turn that into a policy. You can. You can create a custom policy. Just use that same query that you built for your, threat hunting, and then put it in there. And then you can turn that into a a kind of, continuous monitoring as well, and it would alert on similar activities. So that's a really good one to kind of convert those high fidelity findings into, policies. You can also do things, we call them centricions. They're, you know, bear traps or trip wires. You can also use policies, in a custom way to kinda set those as well. I wanted to give one example for gap IPs just because it's fairly, interesting and to kinda set these traps, so to say. So let's say, and, again, this is the demo tenant. So not the the breadth of data that maybe your own individual tenant has, but we'll we'll do a little brief example. So, we're gonna look at devices, and then we're going to do device type. And we're gonna look at servers. Those are the crown jewels, say. So that's what we're most worried about. And then let's say we're gonna look at a specific site. Okay. And then let's take a look at our IP addresses here. So, again, I'm showing an example of what a gap IP, tripwire, bear trap, centrician, whatever you wanna call them, would be. So let's take a look at so okay. So these two are in the same, subnet. So we have ten, two forty seven, thirty five, fifty nine, and then we have three five, 58. So let's say this is a much longer group of devices. We have 59, 58, 57, 56, 55. We skip 54, and then we have 53. So the gap IP would be the 54. Because we had 55, we had 53, but we didn't have 54. So why is that interesting, and what does it mean to create a tripwire for it? So considering what has to you have to consider how your IP addressing is in your environment as well, whether you have d DHCP and those things. But say you wanted to set a trap so that IP that is not in use, say it's never gonna be in use, that one is gonna be reserved for that entire subnet of those, you know, crown jewels. So then what you can do is you can go and create a policy. We're gonna call this gap IP trip wire. So then what you can do is in activity, and then let's say, type activity type. Say port scan detected. And then let's do target IP. Is that, you know, x dot x dot x dot fifty four address that we're talking about? So why is this interesting? Because a threat actor wouldn't know that there is one IP address that's been reserved or is not in use for that entire subnet. So if they're going to do kind of recon activities, they're going to do a little bit of a port scan or they're going to do, you know, any other type of activity. Then they would go for that entire subnet. So if you see a port scan detected show up for this 54 address, but you know it's not in use in your environment, either something has changed in the environment or something suspicious is happening. Because the threat actor wouldn't know that that address isn't in use. And when they hit that, it would essentially, trigger an alert. And then you could go and investigate and see whether or not, it was something suspicious or whether or not it it was okay. And then you can also to kind of help, like, a feedback loop of this, you can also do, do the activity type of address associated. And then you're gonna look at the IP, and then you're gonna do x dot x dot x dot fifty four. So in this case, if you see the address associated, it means the address has been assigned to a device in your environment. And, you know, it's no longer a good gap IP to use for a tripwire. But that's something interesting. You can set those kind of in your, you know, high value, device groups, sites. There's a little bit more of a science that goes into to finding, the right, candidates to to do this in, but it's a good example of how you can do a custom policy. Okay. Let me get back and see if I have any questions that I've missed. Okay. Alright. So now we're going into our next exercise. So this in the classroom, like I said, it would be a little bit more, like, you would try to do this, and then we'd go over it. But because we're here in this webinar, we can do it together. So for the first exercise, and feel free to pull up your own tenant and do this in another tab, like I said, build an activity query with specific parameters to refine and prioritize results. So this is kinda similar to what we did a little bit ago, but it's gonna add in a few more, of those, specific parameters. So let's say let's take a look here. Get around this. Go back. So the first thing we're doing is we know it's a suspicious host. Okay. What's our next piece? We wanna look at the established only. Okay. So we know that's in our decision data. We talked about that earlier. We're gonna go into decision data connection established only. And we're interested in traffic that's only over port 80. And our time frame is gonna be fourteen days. And then our device risk level. So we only care to look at suspicious host activities that are for devices that have high and critical risk level. And we also want to exclude the boundary of guest. So I know there's not gonna be, a result within the demo tenant for this, but look at all of the specific parameters that you can define to really narrow the scope of your view and get to what matters. So we're saying, okay. You know, low risk level for device. Sure. Let's only look at those high and critical. Those are the most vulnerable devices. If it's a malicious, you know, suspicious host that's communicating to it, Maybe those would be, more so a victim than those low risk level devices. And then, okay, you know, desk, let's that's gonna be noisy. Let's exclude that. We only wanna focus on corporate and our others, you know, specified boundaries that we have for our environment. And let's only look at those, suspicious host connections over port 80 because it's an insecure traffic. And, again, we're only looking at established. So I'm going to push enter. Let's see if we get anything. Oh, we got one. Fantastic. So and this is actually, this is actually a known suspicious host. I'm familiar with this one. But, so yeah, this is a great example of how if I were to back out of all of this that I put in here, it's 49. And then when we added all those in, we got to one activity. So it's really helpful, like I said, to clear out that, noise. Okay. And then here's the answer. So we already did that together. And then here's another one. So say you're a security analyst who just received threat intel regarding potentially malicious geo external traffic to Chinese domains over HTTP. Build a query to investigate. Hint. There is more than one correct answer. I'm gonna make this bigger so you can see the next little bit. Okay. So just like we did earlier, we can do the HTTP request. And then also like we did earlier, we can do IP connections. But instead of using that port, we can call out the protocol. And then the endpoint is gonna ends in CN for this, example. So we did those. But there are other activity types that not exactly you can't necessarily look at you can't define both the, port or protocol and what the host is, but it can still be informative. So inactivity, destination, endpoint ends with, in this case, our example is dot c n. But if you had a known malicious, host there, then you can put that in as well. And then you would have all the activities that have the endpoint of this suspicious host. Also, DNS query. So you can't necessarily explicitly define indecision data like the port, but you can get there and find relevant information and and kind of narrow it down from there on your own. And then also for an abnormal behavior, excuse me, that's one that we also touched on, but there's not great examples in the demo tenant. But you can use the decision data to, define the abnormal behavior protocol of HTTP as well. So this is all to say that there are a number of ways to get, similar data. So, really, it's just about getting in there and getting familiar with these different types of activities and how you can pair them together and kind of pivot and and investigate from each of them. Okay. So this one is similar to kind of what we were talking about, but I'm gonna add an additional piece on it. So create a query to identify the presence of Nmap application and then create a query to identify usage of Nmap application. So what's that look like? So we already looked at the usage, but let's just say in applications name, and then I'll do contains. Okay. So our relevant results here would be in map scripting engine and then in map. So we know these applications exist, but are they being used? And then that goes into how we went back to activity and our activity type application usage. And then within the decision data, this is an example that we already looked at earlier, but I wanted to show how you can go from an applications to detecting the presence of an application and then an activity to detect the actual application usage. And, again, that can be helpful too if you have, like, a known malicious application or those, you know, information stealers that are masquerading as, you know, PDF editors or whatever. You can see that, okay. It does exist on these devices, but has it been used recently? And then you can validate that with this specific activity of application usage. Okay. Okay. So just to briefly share some real word real world scenarios. These aren't gonna be in the demo tenant, so I'm not gonna try to replicate them. But I wanted to share, from our NTS team, our managed threat service team, some cool findings that we've had, in the last, you know, few months. One of them is we detected, pre ransomware deployment activity, with SMB share access, but the specific decision data was, SMB command delete, and then SMB share name was admin. I do wanna say if you do this in your tenant, it can totally be, you know, normal, legitimate activity. But this is a good activity type to be able to find the illegitimate activities as well. And then it could obviously show you if there's some kind of, pre ransomware, activity going on where they're deleting those files. Right? So you don't have access to them, and they call them ransom and then say, oh, we'll give you your files back. So that was an interesting one as well. Also, you know how I was talking about the threat detected activities, and you can also, enable the, threat detected policy within, the policies, tab of the, tenant as well. So, one of those, threat detected, threat properties are infected device and then Conficker, which is a kind of legacy, malware. And we actually, discovered a legacy infection, a device that had been previously infected. So that's still a really relevant activity type as well that threat detected. Also, this is kind of an interesting one that you might necessarily think about, but, we detected sanctioned peer to peer file sharing, specifically podcast sites for a couple different, companies. And, so you can see in the decision data, the host is contains .fm. Again, there are some legitimate services that have those .fm hosts. But there are some illegitimate ones where, they say, you know, oh, this copy of this popular podcast. You don't subscribe to it. You don't have to, you know, pay for the subscription, but we have all that hosted on this site, and then they're actually infected files. So but, again, just because it ends in dot FM, that does not mean it is malicious, but you can find those instances. So it's just an example again of when you're looking at that data. There are some interesting things that you can find in there as well. Also, this one was from a while ago, but it's really interesting, Found in IoT devices, a robot vacuum. Somebody got off of, you know, Amazon or something, but it actually had a, backdoor built into it. And it was, you could see it, consuming gigs of data, in the environment. So, that was an interesting one as well. There's some literature out there on, this specific model, and it's, you know, kind of backdoor listener that has that that's built into it. But that's just something that you think about. Again, it's something that, you know, employees want a nice office, so they bring in that, you know, smart coffee maker. They bring in that robo bag. They bring in that, you know, Xbox, whatever, and those all can introduce, risks. Okay. To wrap it up, broader use cases outside of threat hunting, cyber ops, and engineering. You can use you can use it SentriX for unified asset discovery, real time inventory. We have tons of integrations, that you can integrate with your core security infrastructure, your tooling that you already use. Instant response can use this for, forensics and artifact collections. Great for investigations. PCAP support for deep investigation as well for those activities that support that. Threat detection, so proactive hunting, like we went into detail about today, also integrated intelligence, for data protection and insider threat groups. You can see visibility into sensitive data flow, such as the plain text default credentials. We also have PII, health PII activity types, and then we have the UEBA as well that's, built in that kind of abnormal activity types, as well. And then red team, red teams can leverage, Centrix for end to end adversary simulation, the text of this benchmarking. Basically, there's a lot of use cases, and I truly love using, our tool for threat hunting activities. I think it's great. It's robust. It provides, us a lot of data to be able to go in and and find those outliers and and do our investigations. And it really supports, detailed investigations as well, being able to pivot into, you know, devices and finding similar activities. And it's just, a really great, tool to be able to use for threat hunting. And I wanted to share that with you all today, and hopefully, now you'll be able to go and and leverage, Centrix a little bit more for those type of activities and, have some interesting findings out there. Amazing. There's actually one quick question that, Brian. It's okay. And and and he posted it right as you, moved on to the next thing. Does that like, this was this was a little bit farther back. Okay. Does. that your vulnerability scans? Okay. I'm oh, the trip work. That's. a really that's question. the context. Yep. Yeah. Sorry. Thank you, Brian. I was like, alright. That's a very good question. So, it does not in and of itself, but that's exactly a piece that you can build into there as a parameter as well. So you can do, you know, device type exclusion of vulnerability scanners, and that is a great callout because you will get that noise from vulnerability scanner sometimes hitting those. So that's a it's a really good call out. But, yes, you'd have to build that into your parameter. Excellent. Alright. We are down to the last few seconds. I am going to, we're gonna do two two things at the same time. Please give a round of