{"id":402235,"date":"2024-06-29T16:22:16","date_gmt":"2024-06-29T16:22:16","guid":{"rendered":"http:\/\/savepearlharbor.com\/?p=402235"},"modified":"-0001-11-30T00:00:00","modified_gmt":"2024-06-29T16:22:16","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=402235","title":{"rendered":"Chatbox on Top of SIEM Solution<\/span>"},"content":{"rendered":"
<\/div>\n
\n
\n
\n
\n

One of the most time-consuming steps while implementing a SIEM solution is writing and tuning «Playbook» document \u2013 a set of reaction procedures SOC Team has to follow in case of alert triggering.<\/p>\n

During one of our implementation projects I stoped for a moment and thought: how can I optimize (ideally automate) the Playbook execution \u2013 in a playful way?<\/p>\n

<cut\/><\/p>\n

First of all \u2013 how does Playbook looks like? Here is a basic snippet of this document:<\/p>\n

\"Playbook
Playbook document<\/figcaption><\/figure>\n

One of the ideas I could come up with was \u2013 hey, why don’t we add some AI on top of it? Everyone is doing AI nowadays, isn’t it? Can we automate SOC activities with some extra help of a Chatbot? <\/p>\n

TensorFlow is one of the well known free and open-source libraries available for machine learning and deep neural networks and it was the first thing to investigate.<\/p>\n

OK, now I forgot to mention one substantial fact \u2013 our SIEM solution (Enterprise Threat Detection, or SAP ETD) comes from SAP SE, which means this SIEM solution runs on SAP HANA as a platform. How can I integrate Tensorflow into HANA platform? <\/p>\n

Quick research confirmed that it was possible:<\/p>\n

Tensorflow Machine Learning Model Integration with SAP HANA<\/a><\/p>\n

Nowadays we can integrate TensorFlow even with ABAP environment:<\/p>\n

How To Use TensorFlow Seamlessly Inside ABAP<\/a><\/p>\n

OK, Google, that goes far beyond my humble research..<\/p>\n

So I decided to focus on end-to-end solutions. Let’s try to make use of SAP Conversational AI (CAI). Luckily, there is a trial service available, hopefully no programming skills is necessary.<\/p>\n

Now that I am logged onto a trial version CAI, let’s create a «performing actions» Chatbot named «SEC», which would be (at least) able to participate in some basic discussions, such as greetings, small talks and weather:<\/p>\n

\"Steps
Steps 1-2<\/figcaption><\/figure>\n
\"Step
Step 3<\/figcaption><\/figure>\n

This newly born bot is already able to do some basic activities, but let’s add some extra security-relevant capabilities (intents) to it:<\/p>\n