Tactical intelligence: findings a security team can act on the same day
A test report that says “SQL injection found” tells engineers there is a problem, but not what to do about it. At one bank, that gap meant fixes sat for weeks while teams passed tickets back and forth. We changed what the bank received, so each finding arrived with everything needed to detect, contain and fix it.
Evidence
Req/resp, screenshot
IOC & Hunt
SIEM query ready
Contain
WAF / block rule
Fix diff
Patch suggestion
A bank with a busy security operations center
The bank ran a round-the-clock security operations center (SOC), the team that watches for and responds to attacks. Its tools included Splunk for log analysis, a web application firewall (WAF) and endpoint detection software on its computers. Penetration test reports arrived as long advisory PDFs, and each fix bounced between the SOC, the developers and the infrastructure team. Engineers kept having to call the testers to ask what exactly they should change.
What the SOC asked for
The bank wanted technical information its engineers could use straight away. For every finding, that meant the evidence, the systems affected, ready-made detection searches, a quick way to contain the issue and a proper fix, all in a format its tools could read automatically.
What we handed over for each finding
- Evidence of the weakness (the exact request and response, and log excerpts), plus the affected hosts, web addresses and software versions, a CVSS severity score and an exploitability rating
- A hunting kit: saved searches for the bank’s log platforms (Splunk and Elastic), endpoint hunts, firewall and intrusion-detection signatures, and indicators of compromise (the file names, IP addresses and domains that betray an attacker) in STIX or CSV format, with each technique mapped to the MITRE ATT&CK catalog of attacker behavior
- A short-term blocking rule to contain the issue, plus the long-term code or configuration change with file and line references
- Delivery through a dashboard, an API and attachments on the bank’s own tickets
What the hunt turned up
The engagement produced 28 findings. With them came 41 detection searches, 19 firewall rules and more than 60 indicators of compromise. Most were applied without a follow-up call to us.
Running the hunt queries turned up two more staging servers carrying the same web shell (a hidden backdoor planted on a server), so the bank declared an incident early. The hardest finding, a way to replay single sign-on tokens, was contained with a gateway rule within about three hours. The full code fix took six days.
How the work flows now
The bank’s automation platform (SOAR) now takes in our findings directly. Tickets close automatically once a retest confirms the fix. The same packs are reused every quarter in purple-team exercises, where our testers and the SOC replay attacks together to check that detections still work.
Security teams whose findings tend to stall somewhere between “reported” and “fixed” will recognize this bank’s starting point.