Get a Demo
Under Attack?
Circular diagram with a central orange scroll icon, surrounded by concentric circles of blue and pink dots. The upwind logo is in the top left corner.

Connect the Dots for Security Findings with Upwind’s Threat Stories

Joshua Burgin June 12, 2024

Connect the Dots for Security Findings with Upwind’s Threat Stories

We are excited to announce the release of Upwind’s “Threat Stories” – a GenAI-based capability designed to address the challenge of connecting the dots between seemingly isolated security findings.

By providing a unified narrative that consolidates and contextualizes events Upwind has determined to be related, Threat Stories enhance the comprehensiveness of our detections with detailed timelines.

A detailed security report with a timeline and events log. It shows multiple security alerts, including a high-severity alert related to a user executing commands in a container identified as je-ne-suis-pas-malicious. Various actions and timestamps are displayed.

Threat Stories act as incident summaries, consolidating multiple detections, events, and SSH login activity. This unified perspective offers a deeper understanding of security events by detailing the sequence of events, their implications, and their impact within a single narrative. Attacks often begin with subtle reconnaissance actions that might be tagged as separate events. With Threat Stories, these events are contextualized as part of the full attack sequence, allowing for a clearer picture of how an incident unfolds. 

Threaat Stories transform security investigations by addressing alert fatigue, providing context, and enabling timely responses. By consolidating relevant data points into a clear narrative, Threat Stories allow teams to focus on the bigger picture and prioritize threats more effectively. They detail the sequence of events, including detections and login activity, giving a deeper understanding of the “why” behind an event. This comprehensive view streamlines investigations, allowing for faster and more efficient threat responses.

“Upwind Threat Stories has drastically reduced triage and investigation time by correlating runtime detections with audit logs and giving us end-to-end visibility. Understanding who did what, how, and when, at a single glance has been a major game-changer”

Dobromir Kosev, Security Engineer, Yotpo

Beneficial not only to security teams but also to developers and DevOps engineers, Threat Stories bridge the gaps between these domains, surfacing and contextualizing all relevant issues. This unified narrative enhances collaboration and strengthens the overall security posture.

To learn more about Upwind’s Threat Stories and risk prioritization, schedule a demo.

Contents

Further Reading

Yuval_ArgoCD Research

ArgoCD repoURL XSS: How a Missing Scheme Check Becomes Cluster Takeover 

Executive Summary  This stored cross-site scripting (XSS) vulnerability in ArgoCD [versions <= 3.4.4] allows an attacker who can create or modify an Application to persist a malicious repoURL, which is subsequently executed in an administrator's browser within the Argo CD origin. Because the payload executes in the context of the administrator's authenticated session, and because…
Custom-Reporting-Hero

Security Reporting Built Around Your Program

We've all been there: it's 3:00 PM on a Friday, and you get that "quick" request for a specific security status report. Suddenly, your afternoon is gone as you juggle filters, export CSVs, and try to explain to someone outside the security team why these numbers actually matter. Reporting shouldn't feel like a fire drill…
Blue-agent-blog

Introducing the Upwind Blue Agent: Autonomous Threat Investigation for the SOC

We’re excited to announce that the Upwind Blue Agent is now available in Beta. Blue is an AI-powered SOC investigator that autonomously investigates Upwind Threat Stories end to end. It gathers and correlates security context across the customer environment, evaluates the available evidence, and delivers one of three clear verdicts: Each verdict includes supporting reasoning…
Add the Upwind RSS Feed to Slack
Connect the Upwind RSS Feed to your Slack.
Follow the how-to here.
Threat RSS
Add the Upwind RSS Feed to Slack
Connect the Upwind RSS Feed to your Slack.
Follow the how-to here.
Main RSS