Work · HSBC · Aug 2019 to Oct 2020
Phishing triage from 45 minutes to under 8
As a Tier II analyst in HSBC's global SOC, I led a project to automate the most repetitive work an analyst does: checking a reported phishing email.
- 45 → <8minutes per phishing case
- 50+SIEM use cases engineered against ATT&CK
- 1OT machine caught beaconing, and contained
The problem
Reported phishing arrives all day in a large bank, and each case took an analyst about forty-five minutes of largely repeatable checks before a decision could be made.
What I did
- SOAR playbooks. Built the triage as playbooks on Splunk Phantom, so the enrichment and the lookups ran on their own and the analyst started from a prepared case. Triage time fell from 45 minutes to under 8 per case.
- Use-case engineering. Engineered and tuned more than 50 SIEM use cases against MITRE ATT&CK techniques, cutting false positives and speeding triage in a 24×7 SOC.
- An OT case. Detected malicious DNS beaconing from a legacy machine on a production line, identified the command-and-control pattern, and contained it before it spread.
Described at the level of my public CV. No confidential detail is published here.