TechPrufer
Get started
Dropbox
Dropbox logoDropbox · Feature trail

Threat Detection and Incident Response Platform

1 post · Oct 2019

What this trail covers

Dropbox's security team has developed a comprehensive platform for threat detection and incident response. This platform integrates security logs from various data stores, provides a unified interface for querying and analysis, and automates alert contextualization and response workflows. Key components include Alertbox for automated alert processing, a datasources library for abstracting data access, Covenant for interactive threat hunting using Jupyter notebooks, and Forerunner to orchestrate the integration between alerts and investigation notebooks. This capability aims to improve the efficiency and effectiveness of the security team in identifying and mitigating threats.

All Dropbox trails
  1. How Dropbox Security builds tools for threat detection and incident responseThis post details the development of Alertbox, a system that automates alert response runbooks by executing code in response to security alerts. It also describes the creation of a 'datasources' library to abstract away the complexities of querying disparate data stores and encapsulating logic for common security investigations. Finally, it introduces Covenant, an investigation tool built on Jupyter notebooks that leverages the same data abstractions as Alertbox for threat hunting, and Forerunner, which acts as an orchestrator between Alertbox and Covenant to generate and embed investigation notebooks for alerts.