Security Trails Meets Gigasheet: Taking Your Recon Analysis to a Whole New Level

SecurityTrails Blog - A podcast by SecurityTrails

Categories:

Humans, in most cases, are not built to process and conceptualize data in any significant measure or speed. Notwithstanding, the last several years have seen an unprecedented growth in data collection and ingestion techniques driven by newer forms of network and cloud technologies, arousing a particular (and ever-growing) concern among the cybersecurity community as diminished visibility threatens to grow proportionally to the degree of integration. In other words, organizations should be asking themselves if the logs and data they're collecting are actually telling the whole story and, if they are, is the human component, namely the incident responders and threat hunters at the crossroads, able to quickly align itself with what really took place. There is, however, a new tool on the horizon that threatens to disrupt the old paradigm of looking endlessly at relational entities, such as spreadsheets, in search of the mythical "Aha!" moment. Gigasheet. Combining the succinct dimensionality of structured data with a powerful analytics engine capable of handling billions of data points at a time, Gigasheet will certainly innovate the prescriptive space where data can be manipulated, aggregated, queried, and analyzed under a single web-based ecosystem that is as broadly intuitive as it is powerful. Incidentally, given this project's characteristics and the demands currently placed on good data quality, we could think of no better tool than our very own SQL Explorer to generate large recon activity that could be easily consumed and analyzed, a collaborative endeavor that surely did not disappoint. Enter Gigasheet The future belongs to big data; there's very little doubt about that. The terminology, in all its rich diversity, dominates just about every aspect of our digital lives, including niche (e.g., non-tech) environments that once exhibited a smattering of it, with the cyber security industry being a definitive, representative sample of the ongoing trend. For instance, in cyber, data flows in from a multitude of services often in disparate formats and lattices underscored by the originating application. As the pipeline grows, analysts can be easily caught in a never-ending cat-and-mouse game of chasing after interesting artifacts and traffic, especially if their toolset of choice lacks important filtering, joining, and intersecting capabilities, for the latter, large data dumps can dramatically compound on the problem by requiring significant processing times even when pitted against robust hardware specifications. When the early adoption of cloud-based analytic tools became the dominant narrative, many seized the opportunity to integrate the emerging technology into their processes. This, however, entailed aggregating and normalizing, slicing and dicing, and similar operations, just to arrive at a suitable model capable of interoperability. Thus, when presented with these and similar challenges, many chose (and still do) to resort to off-the-shelf applications (think Microsoft Excel here) for quick data representation, others preferred more programmatic approaches, such as the acclaimed Pandas library, but these precluded many entry-level professionals from expeditiously manipulating the data due to a substantial learning curve. To break down some of these important barriers, Gigasheet's team realized that accelerating analysis meant removing the initial scaffolding, reducing the setup effort to a small number of clicks. This is SaaS at its best, conducting resource-intensive tasks with ease and scalability without worrying about the underlying infrastructure, reliability, and accessibility for all team members who no longer need to be sidetracked by maintenance windows or hardware issues, resulting in increased collaboration, as well as overall faster response times to critical items in need of immediate attention. Best of all, Gigasheet's 24 by 7 development cycle directly translates to optimizations and fixes that are rol...