{"id":100875,"date":"2019-08-13T02:00:54","date_gmt":"2019-08-13T09:00:54","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=100875"},"modified":"2019-08-13T02:01:53","modified_gmt":"2019-08-13T09:01:53","slug":"help-soc-analysts-fight-alert-fatigue","status":"publish","type":"post","link":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/2019\/08\/help-soc-analysts-fight-alert-fatigue\/?lang=ko","title":{"rendered":"SOC \ubd84\uc11d\uac00\ub4e4\uc774 '\uc54c\ub9bc \ud53c\ub85c'\uc5d0 \ud6a8\uacfc\uc801\uc73c\ub85c \ub300\ucc98\ud558\ub294 \ubc29\ubc95"},"content":{"rendered":"

Palo Alto Networks \uc124\ubb38 \uc870\uc0ac \ub370\uc774\ud130\uc5d0 \ub530\ub974\uba74 SOC \ubd84\uc11d\uac00\ub4e4\uc740 \ubcf4\uc548 \ub3c4\uad6c\uc5d0\uc11c \uc0dd\uc131\ub41c \uc54c\ub9bc \uc911 14%\ub9cc\uc744 \ucc98\ub9ac\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4. \ub300\ubd80\ubd84\uc758 \uc54c\ub9bc\uc774 \uc624\ud0d0(false positive)[1]<\/a>\uc784\uc744 \ubcf4\uc5ec\uc8fc\ub294 IDC \ub370\uc774\ud130\ub97c \uace0\ub824\ud574 \ubcf4\uba74 \uadf8 \uacb0\uacfc\ub97c \ub2e4\uc74c\uacfc \uac19\uc774 \uc608\uce21\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4. \uc54c\ub9bc\uc740 \ubb34\uc2dc\ub418\uace0<\/strong>, <\/strong>\ubd84\uc11d\uac00\ub294 \uc798\ubabb\ub41c \ub2e8\uc11c\ub97c \ucad3\ub294 \ub370 \uc2dc\uac04\uc744 \ub0ad\ube44\ud558\uba70<\/strong>, <\/strong>\uc2e4\uc81c \uc704\ud611\uc744 \ub193\uce58\uace0 \ub9d9\ub2c8\ub2e4<\/strong>.<\/strong><\/p>\n

\"\"<\/span><\/div><\/p>\n

\ub300\ub2e4\uc218\uc758 \ubcf4\uc548 \ub3c4\uad6c\ub294 \ucd08\uae30 \uc608\ubc29 \uc678\uc5d0\ub3c4 \uc54c\ub9bc \uc0dd\uc131 \ubc0f \ub300\uc751\uc774\ub77c\ub294 \ud55c \uac00\uc9c0 \ud575\uc2ec \uae30\ub2a5\uc744 \uc218\ud589\ud569\ub2c8\ub2e4. \ud76c\ub9dd\uc801\uc778 \uac00\uc815\uc740 \ubd84\uc11d\uac00\ub4e4\uc774 \uc774\ub7ec\ud55c \uc54c\ub9bc\uc744 \ud1a0\ub300\ub85c \uc758\uc2ec\uc2a4\ub7ec\uc6b4 \ub3d9\uc791\uc744 \uac80\ud1a0\ud558\uace0 \ud3ec\ucc29\ud560 \uac83\uc774\ub77c\ub294 \uc810\uc785\ub2c8\ub2e4. \uadf8\ub7ec\ub098 \ubd84\uc11d\uac00\uac00 \ub9e4\uc77c \ucda9\uc2e4\ub3c4\uac00 \ub0ae\uc740 \uc54c\ub9bc \uc218\ucc9c \uac74\uc744 \ubc1b\uae30 \uc2dc\uc791\ud558\uba74 \uc774 \uc804\ub7b5\uc740 \ube60\ub974\uac8c \ubb34\uc6a9\uc9c0\ubb3c\uc774 \ub429\ub2c8\ub2e4.<\/p>\n

\uc54c\ub9bc \ud53c\ub85c \uac10\uc18c \uccb4\ud06c\ub9ac\uc2a4\ud2b8<\/strong><\/p>\n

\uc54c\ub9bc \uc0dd\uc131 \uc13c\uc11c\uc640 \uc2dc\uc2a4\ud15c\uc744 \uc81c\uac70\ud558\uba74 \ubcf4\uc548 \uc0ac\uac01\uc9c0\ub300\uac00 \ubc1c\uc0dd\ud558\uc9c0\ub9cc \uc815\ubcf4\uac00 \ub108\ubb34 \ub9ce\uc73c\uba74 \uc815\ubcf4\uac00 \uc804\ud600 \uc5c6\ub294 \uac83\uacfc \ub2e4\ub97c \ubc14 \uc5c6\uc2b5\ub2c8\ub2e4. \uadf8\ub807\ub354\ub77c\ub3c4 \uc54c\ub9bc\uc774 \ud544\uc694\ud558\uba70 \uc880 \ub354 \uc815\ud655\ud55c \uc54c\ub9bc\uc774 \ud544\uc694\ud569\ub2c8\ub2e4<\/strong>. <\/strong>\ub2e4\uc2dc \ub9d0\ud574, \ub3c4\uad6c\uc640 \ud504\ub85c\uc138\uc2a4\ub97c \uace0\ub824\ud560 \ub54c \ub2e4\uc74c \uac1c\ub150\uc744 \uc218\uc6a9\ud574\uc57c \ud569\ub2c8\ub2e4.<\/p>\n

    \n
  1. \uc790\ub3d9\ud654<\/strong><\/li>\n<\/ol>\n

    \uccab\uc9f8, \uae30\uc5c5\uc740 \uc790\ub3d9\ud654\ub97c \uc0ac\uc6a9\ud558\uc5ec \uc54c\ub9bc \ubd84\ub958 \ud504\ub85c\uc138\uc2a4\ub97c \ud06c\uac8c \uac1c\uc120\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4. Palo Alto Networks\ub294 \uc0ac\uc804\uc815\uc758 \ud50c\ub808\uc774\ubd81\uc744 \uc0ac\uc6a9\ud558\uc5ec \ub300\uc751 \uc791\uc5c5\uc744 \uc790\ub3d9\ud654\ud558\ub294 SOAR \uae30\uc220\uc744 \ud65c\uc6a9\ud558\uc5ec \ubaa8\ub4e0 Tier 1(\uc54c\ub9bc \ubd84\ub958) \ubcf4\uc548 \uc791\uc5c5\uc744 \uc790\ub3d9\ud654\ud560 \uc218 \uc788\uc5b4\uc57c \ud55c\ub2e4\uace0 \uc0dd\uac01\ud569\ub2c8\ub2e4. \uc54c\ub9bc \ubd84\ub958\uc758 \uacbd\uc6b0, \uc774\ub7ec\ud55c \uc791\uc5c5\uc5d0\ub294 \uc54c\ub9bc \ubd84\uc11d, \uc54c\ub824\uc9c4 \ubb38\uc81c\uc778 \uacbd\uc6b0 \uc0ac\ub840 \uc5c5\ub370\uc774\ud2b8, \uc54c\ub824\uc9c4 \ubb38\uc81c\uac00 \uc544\ub2cc \uacbd\uc6b0 \uc0ac\ub840 \uc5f4\uae30, \uc54c\ub9bc\uc758 \uc2ec\uac01\ub3c4\ub97c \ubd84\ub958\ud558\uc5ec \ubd84\uc11d\uac00\uc5d0\uac8c \ubcf4\ub0b4\ub294 \uc791\uc5c5\uc774 \ud3ec\ud568\ub429\ub2c8\ub2e4. \uc774 \ud504\ub85c\uc138\uc2a4\ub97c \uc790\ub3d9\ud654\ud558\uba74 \ubd84\uc11d\uac00\uac00 \ub300\uc751\ud574\uc57c \ud558\ub294 \uc54c\ub9bc \uc218\uac00 \ud06c\uac8c \uc904\uc5b4 \ubd84\uc11d\uac00\ub294 \uadc0\uc911\ud55c \uc2dc\uac04\uc744 \ub85c\uadf8\ub97c \ud655\uc778\ud558\uae30\ubcf4\ub2e4\ub294 \ubb38\uc81c\ub97c \uc870\uc0ac\ud558\ub294 \ub370 \ud560\uc560\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n

      \n
    1. \ub370\uc774\ud130 \uc5f0\uacb0<\/strong><\/li>\n<\/ol>\n

      \ub458\uc9f8, \ubcf4\uc548\ud300\uc740 \uac00\uc2dc\uc131\uc744 \ud5a5\uc0c1\uc2dc\ud0a4\uae30 \uc704\ud574 \uaca9\ub9ac\ub41c \ub3c4\uad6c\ubcf4\ub2e4 \ud1b5\ud569 \ub3c4\uad6c\ub97c \uc6b0\uc120\uc21c\uc704\uc5d0 \ub450\uc5b4\uc57c \ud569\ub2c8\ub2e4. \uc11c\ub85c \ud1b5\uc2e0\ud558\uc9c0 \uc54a\uace0 \uac01\uae30 \ubcf4\uc548 \uc778\ud504\ub77c\uc758 \ud2b9\uc815 \ubd80\ubd84\uc744 \uc0b4\ud3b4\ubcf4\ub294 7\uac00\uc9c0 \ub3c4\uad6c\ub97c \uc0ac\uc6a9\ud558\ub294 \uacbd\uc6b0, \uc774\ub7ec\ud55c \ub3c4\uad6c\ub294 \uc704\ud611 \ucd94\uc801\uacfc \uc870\uc0ac\uc5d0 \ub3c4\uc6c0\uc774 \ub418\ub294 \ucee8\ud14d\uc2a4\ud2b8\ub97c \uc81c\uacf5\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4. \uc989, \uc790\uccb4\uc801\uc73c\ub85c\ub294 \uc591\ud638\ud574 \ubcf4\uc774\ub294 \uc77c\ub828\uc758 \uc791\uc5c5\uc774 \uc2e4\uc81c\ub85c\ub294 \uc2dc\uc2a4\ud15c\uc5d0 \uc545\uc758\uc801\uc778 \uc0ac\uc6a9\uc790\uac00 \uc788\uc74c\uc744 \ub098\ud0c0\ub0b4\ub294 \uc21c\uc11c\ub85c \uc2e4\ud589\ub418\uace0 \uc788\ub294\uc9c0 \uc54c \uc218 \uc5c6\uc744 \uac83\uc785\ub2c8\ub2e4. \ub610\ub294 EPP\ub97c \ud1b5\uacfc\ud55c \uba40\uc6e8\uc5b4 \uc77c\ubd80\uac00 \ubc29\ud654\ubcbd\uc744 \ud1b5\ud574 \ucc28\ub2e8\ub418\uc5c8\ub2e4\ub294 \uc0ac\uc2e4\uc744 \ucc3e\uae30\uae4c\uc9c0 \ud55c \uc2dc\uac04\uc774 \uac78\ub9b4 \uc218\ub3c4 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n

        \n
      1. \uba38\uc2e0 \ub7ec\ub2dd<\/strong><\/li>\n<\/ol>\n

        \ub9c8\uc9c0\ub9c9\uc73c\ub85c EDR \ub3c4\uad6c\uc5d0\ub294 \ud328\ud134\uc744 \uc778\uc2dd\ud558\uc5ec \ud559\uc2b5\uc744 \ud1b5\ud574 \uac1c\uc120\uc774 \uac00\ub2a5\ud55c \uba38\uc2e0 \ub7ec\ub2dd \uae30\ub2a5\uc774 \uc788\uc5b4\uc57c \ud569\ub2c8\ub2e4. EDR\uc740 \ub370\uc774\ud130 \uc18c\uc2a4\uc5d0\uc11c \uac00\uc838\uc640 \uc6b0\uc120\uc21c\uc704\uc5d0 \ub530\ub77c \ucda9\uc2e4\ub3c4\uac00 \ub192\uc740 \ud2b9\uc815 \uc54c\ub9bc\uc744 \uc0dd\uc131\ud558\ub294 \uc54c\uace0\ub9ac\uc998\uc744 \uc9c0\uc18d\uc801\uc73c\ub85c \uc138\ubd84\ud654\ud574\uc57c \ud569\ub2c8\ub2e4.<\/p>\n

        Cortex XDR<\/strong>\uc774 \uc81c\uacf5\ud558\ub294 \ubcf4\ub2e4 \uc2a4\ub9c8\ud2b8\ud55c \ud0d0\uc9c0<\/strong><\/p>\n

        Cortex XDR<\/a>\uc740 \ubcf4\uc548 \uc704\ud611\uc744 \uc2dd\ubcc4\ud558\ub294 \ub370 \uac00\uc7a5 \uc720\uc6a9\ud55c \ucda9\uc2e4\ub3c4 \ub192\uc740 \ucd5c\uc0c1\uc758 \uc54c\ub9bc \uc870\ud569\ubfd0 \uc544\ub2c8\ub77c, \uc870\uc0ac \ubc0f \uc704\ud611 \ucd94\uc801\uc744 \uc704\ud55c \ud48d\ubd80\ud55c \uad00\ub828 \uc6d0\uaca9 \ubd84\uc11d \ub85c\uadf8\ub97c \uc81c\uacf5\ud558\ub294 \uac83\uc73c\ub85c \uc785\uc99d\ub418\uc5c8\uc2b5\ub2c8\ub2e4. \uc774\ub7ec\ud55c \uc720\ud615\uc758 \uc54c\ub9bc\uc744 \ud1b5\ud574 \uae30\uc5c5\uc740 \uc624\ud0d0(false positive) \uc815\ubcf4\uc758 \ubc94\ub78c\uc744 \ucc28\ub2e8\ud558\ubbc0\ub85c \ubd84\uc11d\uac00\ub4e4\uc740 \uc2e4\uc81c \uc704\ud611\uc744 \uc870\uc0ac\ud558\ub294 \ub370 \uc9d1\uc911\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n

        \ucd5c\uadfc MITRE ATT&CK\ub97c \ud1b5\ud574 APT 3 \uadf8\ub8f9\uc758 \uc2e4\uc81c \uacf5\uaca9 \uc5d0\ubbac\ub808\uc774\uc158\uc744 \uc0ac\uc6a9\ud558\ub294 EDR \ub3c4\uad6c\ub97c \ud14c\uc2a4\ud2b8\ud55c \uacb0\uacfc, Cortex XDR \ubc0f Traps\uac00 \uc5d4\ub4dc\ud3ec\uc778\ud2b8 \ud0d0\uc9c0 \ubc0f \ub300\uc751 \ubca4\ub354 10\uac1c \uc911 \uac00\uc7a5 \ub9ce\uc740 \uacf5\uaca9 \uae30\ubc95\uc744 \ud0d0\uc9c0\ud55c \uac83\uc73c\ub85c \ub098\ud0c0\ub0ac\uc2b5\ub2c8\ub2e4. \uc774 \ud3c9\uac00\ub294 EDR \uc2dc\uc7a5\uc758 \uc2e4\uc81c \uae30\ub2a5\uacfc \uc131\ub2a5\uc5d0 \ub300\ud55c \uc5c5\uacc4 \ucd5c\ucd08\uc758 \uac1d\uad00\uc801\uc778 \uacf5\uac1c \ud3c9\uac00\uc600\uc2b5\ub2c8\ub2e4.<\/p>\n

        \"\"<\/span><\/div><\/p>\n","protected":false},"excerpt":{"rendered":"

        Palo Alto Networks \uc124\ubb38 \uc870\uc0ac \ub370\uc774\ud130\uc5d0 \ub530\ub974\uba74 SOC \ubd84\uc11d\uac00\ub4e4\uc740 \ubcf4\uc548 \ub3c4\uad6c\uc5d0\uc11c \uc0dd\uc131\ub41c \uc54c\ub9bc \uc911 14%\ub9cc\uc744 \ucc98\ub9ac\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4. \ub300\ubd80\ubd84\uc758 \uc54c\ub9bc\uc774 \uc624\ud0d0(false positive)[1]\uc784\uc744 \ubcf4\uc5ec\uc8fc\ub294 IDC \ub370\uc774\ud130\ub97c \uace0\ub824\ud574 \ubcf4\uba74 \uadf8 \uacb0\uacfc\ub97c \ub2e4\uc74c\uacfc \uac19\uc774 \uc608\uce21\ud560 …<\/p>\n","protected":false},"author":657,"featured_media":100226,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3555],"tags":[],"coauthors":[6810],"class_list":["post-100875","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-3555"],"jetpack_featured_media_url":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-content\/uploads\/2019\/07\/Mitre-blog-illustration-01-1.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/100875","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/users\/657"}],"replies":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/comments?post=100875"}],"version-history":[{"count":2,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/100875\/revisions"}],"predecessor-version":[{"id":100877,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/100875\/revisions\/100877"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media\/100226"}],"wp:attachment":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media?parent=100875"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/categories?post=100875"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/tags?post=100875"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/coauthors?post=100875"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}