OpenAEV Brings Attack Chaining to Security Validation

Hey, everyone. Welcome back here to Techstrong TV. My next guest is Sébastien Miguel.

Sébastien is the senior product manager of Open AEV at a company called Filigrand. Not to worry if you're not familiar with any of these things, Sébastien's going to tell us all about them. But first, let's welcome Sébastien to the show.

Hey, Sébastien. How are you? Hey, everyone.

Thanks. I'm good. Hope you are too as well.

Really nice to meet you, all of you guys, and to join. Yeah. Hi.

So Sébastien, I mentioned you're senior product manager over at Filigrand, but let's talk a little bit, give people a sense of your journey, your background, if you don't mind. Yeah, sure. So yeah, basically I started to work 10 years ago in IT networks and telecommunication systems.

Then I switched into cybersecurity more than five years ago. So I started to work in a French MSSP on the blue team, as a SOC member. So I almost built the SOC with two teammates, and we built the SOC, worked on both the build and the run side, so that means we deployed security platform like EDA, XDA, SIEM, and then do the run on that.

So that means working the on-call, handling the alerts, improving the security posture by creating some rules, avoiding the false positive and so on. So I did that two years ago on the same MSSP. Then I switched on to red team side as a pentester for the same MSSP.

So I switched into pentest, so did a lot of pentest. So whether it was external, internal, a lot of Active Directory assessment, of course. Some physical assessment as well, so going into the locals, like a James Bond approach.

So it was really exciting stuff, and always the same logic, improve the defense for the customer we had. And I closed the loop in the purple team as head of purple in CSIRT. So yeah, two hats once again.

One to improve the detection based on the attack as the head of purple. So MSSP, you have a lot of customers in the SOC, and you have to prove you are the best MSSP, so you have to create some rules and show to the customers you are going in a good way, meaning the security posture is going in a good way, you can find the new threats, detect them, and you have some good MTTD, mean time to detect, and mean time to react indicators. So you have to good KPIs, you have to show them, and so on.

And the CSIRT, which was an exciting stuff as well, where you have to collect the data, the artifacts, make the forensics, and understand what really happened on the customer under attack, what the customer have to do next on the mitigation, and yeah, those kind of stuff. So basically, yeah, I work on the different aspects on the cybersecurity, more on the operational side I would say. And yeah, I've joined Filigrand almost two years ago as senior product manager for Open AEV.

AEV means adversary exposure validation, and it's a tool which is, yeah, we'll discuss about it just after, but it's mainly used a lot by purple team. That's the kind of tool I used before joining Filigrand, basically. I love it.

Thank you very much for your time. Let's talk about Filigrand a little bit. Sure.

What would you tell people about it? Yeah, sure. Filigrand started almost four years ago in 2022.

So the Filigrand start was around OpenCTI. I guess a lot of you people are aware about OpenCTI, but if you're not, a quick reminder. So OpenCTI is the cyber threat intel, which is a threat intel platform basically used a lot by the CIRT and the CSIRT, and the CTI teams, whether on the SOC and other teams, to understand the attacks, make some case reports, and so on.

So Filigrand's journey start by OpenCTI almost four years ago. And along that journey, the vision, the XTM vision, meaning extended threat management, grew up. Which means with OpenCTI as a core, we added other products.

So we had at the beginning OpenBAS, which became Open AEV. We start the connection between the CTI and the AEV. The same, based on the attack, on what really matters on your company, which can be targeted by some threat actors.

You have to know how the threat actors operate, and then you can validate based on the intelligence you have from them, thanks to OpenCTI or the threat intel platform you have. You can validate you are well protected against them. And that's really the approach, the Filigrand's vision we had when Open AEV was launched.

And now, yeah, the platform is evolving, so we now have XTM 1, which is the whole AI capability we have, with a specific vision as well, where you can add your own agents, bring your own LLM, you can update everything because as always in the Filigrand DNA, everything is customizable. So you can do really what you want. You have that openness behind that, the transparency, so you can see everything, you can update everything based on the use case you can have, which can be specific.

And so yeah, that's the core. We have the XTM 1 on the AI capabilities, the Open AEV for the validation and exposure management validation, the CTI for the threat intel side, and we have a new one which is coming, which is Open CRQ, or cyber risk quantification, meaning, okay, if I'm under attack, what's the ROI on that? How could it cost?

Some kind of stuff like that. So that's the whole XTM vision we have. And plus on that, we have something which is called the XTM Hub, which is really the community hub we have because the whole Filigrand products are both community and enterprise edition.

So we have a community, and the idea is to share a lot with the community, and that's the XTM Hub purpose, share the knowledge, like the dashboards from OpenCTI, the scenario for Open AEV, and other things like that through the XTM Hub. So yeah. Very good.

Very good. Sébastien, how would you explain attack chaining? All right, let's start with attack chaining, then we'll go to AI-driven attack chaining.

Mm-hmm. Yeah, sure. That's a good question.

So when we launched Open AEV, at that time it was OpenBAS, or open attack simulation, kind of tool used a lot by the purple team. It was in a unitary mode, meaning I do a test once, then this one test once, and so on. But the reality is whether the bad guys or the pentester, which are good guys of course, don't think like that.

It's not you do that, then you do that. It's more an event-based approach instead of a time-based. So when we launched OpenBAS at the beginning, we were in that time-based approach, which changed now thanks to Open AEV, and through the attack chaining mainly, to an event base.

So what's the difference? It's quite simple. Today we can say, okay, if you found a password, then you can try that password to my web application, my cloud provider, my Active Directory, my anything you want.

You can do the same for the whole things you want, like an open ports, a specific technology like WordPress websites, that could be based on other things like a misconfiguration, an Azure tenant ID, or AWS information. Yeah, really whatever you want. And based on that, you can trigger some actions.

So instead of being in that time-based approach where you have to specify everything at the beginning, which is delayed by the time, now you are in an event-based approach as a pentester. You do an assessment, you find some information based on the organization you did on the first phase, which is maybe the first important one, collect the data you can about the threat you're working on, about the website or the asset you're working on, collect any data, any information, and based on that, you will do some stuff. If the website is WordPress, you will check some WordPress misconfiguration, WordPress vulnerability, and so on.

It's the same approach we did when we moved the OpenBAS to the Open AEV approach, the time-based to the event based. So that's the core of Open AEV now, and that's the attack chaining we did. Yeah.

Got it. If you don't mind, I'm going to ask you to Put on maybe a sales engineer's hat. Explain to people in our audience, this is something that they say, "Okay, this sounds great.

I want to use this. " What's the on-ramp? How do people go about going to Filagrann?

Or maybe they use the open one. If you don't mind, give people sort of the on-ramp. How do they get to this?

Yeah. So that's a good point. We have a lot of people starting by trying the products, whether it's OpenAV or OpenSTI, or others.

And they can start by the community edition, so you start to use the product, understand the value of the product, what's the use cases, and so on. And based on that, and because a lot of enterprise features are, of course, enterprise edition. So if you want to do data training or specific stuff based on the enterprise needs, you have different solutions.

The first one, and maybe the simple one, is we can ask trials from the product itself. So that means you can go from the OpenAV as a community edition and ask a trial, which lets you try OpenAV as an enterprise edition user for a month. And then you can try while the month is running on, you can try the whole capability of the platform, and you can do it for each product.

Which can let you have an overview on the capability on it. And based on that, after, yeah, the sales will contact you and let you know, based on the needs you have, it can be deployed on-premise, on SaaS, and so on. But yeah, that's the way we can do it, yeah.

Excellent. I don't know if we mentioned the websites. Did we?

I don't think so, but- Well, then we should We probably should, indeed, yeah. Yeah. So Filagrann?

io. io is the- On IO. Yeah.

And you can go on it, and from the Filagrann IO website, you can also ask a trial as well. So if you don't want to go starting by the community edition, you can start directly through the trials as an enterprise edition. We can provide to you a SaaS platform, a dedicated one.

We also have a public demo instance, which can let you just use OpenAV or OpenCTI without any deploying services, which can be hard at some point, depending the users and the skills they have. So if you don't want to take care about that part, you can just go through the website, and it will let you know where you can start buying. So yeah.

Excellent. And the OpenAV and so forth, where can people access that if they wanted to go community? So basically, whether it's OpenSTI or OpenAV, everything is on GitHub, so you can access from GitHub the whole code base.

So you can access it, you can download it and try it as a community edition. We provide some Docker images. You can pull them from the Docker registry, and so on.

So yeah, basically, the Filagrann website can redirect you to the GitHub we have, or you can start directly from the GitHub. Yeah. I love it.

Hey, Sebastien, thank you very much for coming out here and explaining this to us. People don't realize, maintaining an open source community product is expensive, it's time-consuming, it's a lot of work. It's great when you have a company like Filagrann that, in essence, sponsors that, supports that.

Because without that support- Sure. Definitely ... it's crazy, right?

It's very hard. So thank you to Filagrann for supporting it. Thank you for doing what you do.

And thanks for being on "Techstrong TV" with us today. Yeah, pleasure. Thanks to you.

Thank you. Sebastien Miguel, Senior Product Manager for the OpenAV project at Filagrann, as part of Filagrann. We're going to take a break.

We'll be back.