GRAPH FOR SECURITY WORKSHOP || Graphs in Security, Ian Hellen

### Overview In this presentation at the Graph for Security Workshop, Ian Hellen, a principal security engineer at Microsoft, discusses how Python Jupyter notebooks and entity-centric graphing techniques can be applied to cybersecurity investigations and threat hunting. While referencing the classic John Lambert quote that "attackers think in graphs, defenders think in lists," Hellen emphasizes that defenders are increasingly shifting toward graph-based thinking. Rather than relying on static tables or spreadsheets, analysts can use notebooks to orchestrate investigation workflows, extract suspicious subgraphs from massive telemetry sets, and avoid analyst fatigue.

### Key Topics - **Extracting Attacker Graphs from Telemetry:** Modern security operations are inundated with granular logs from agents and cloud services. Hellen identifies three ways to isolate suspicious subgraphs: appending detections/inferences to label nodes and edges, identifying known-bad indicators (such as C2 IP addresses from threat intelligence), and detecting anomalous graph structures or chained behaviors directly. - **Graph Structure Anomaly Detection:** Hellen shares prior work analyzing corporate host-to-host lateral movement chains to identify attacks. He also highlights an approach by a former Google security team member using natural language processing (NLP) to model network syntax and identify anomalous graph paths as grammatical or vocabulary errors. - **Advantages of Jupyter Notebooks:** Notebooks address the limitations of traditional investigation tools like Excel or ephemeral cloud query consoles (e.g., Azure Sentinel Log Analytics). Notebooks make query workflows repeatable, persist queries and retrieved data in a single document, support interactive visualizations, and serve as presentation media for technical and non-technical stakeholders. - **MSTICPy Open-Source Toolkit:** Hellen showcases `msticpy`, a Python package designed to encapsulate complex security analysis tasks. Features include process command-line clustering, rarity index scoring to highlight uncommon logon sessions, layered network flow visualization, time-series anomaly detection, nested de-obfuscation (base64/gzip decoding), regex IoC extraction, and multi-provider threat intelligence enrichment (e.g., VirusTotal, X-Force, AlienVault OTX).

### Technical Details Hellen demonstrates two "Entity Explorer" notebooks powered by Azure Sentinel and MSTICPy: 1. **Host Explorer:** Queries a Windows host to display interactive logon timelines and network flows categorized by Layer 7 protocols (such as inbound SSH and Terminal Services). Hellen demonstrates clustering 26,000 process execution events to compute a rarity index—the inverse of cluster size—allowing analysts to strip away repetitive administrative activity and surface rare events like user creation or group manipulation. 2. **Account Explorer:** Starts with a user account ("Ian") to dynamically map host logons, associated source IP addresses, automated alert correlation, geolocation/ASN data, and host-level alerts. Even without complex graph layouts, progressively appending alerts and threat intelligence transforms ordinary telemetry into an intuitive, explainable attacker subgraph.

### Takeaways Jupyter notebooks combined with targeted, small-scale graphing provide a practical way to tame data overload in security operations. By automating repetitive queries, clustering noisy data, and layering threat intelligence directly into entity-centric graphs, analysts can build reproducible, explainable investigation artifacts that bridge the gap between low-level telemetry and actionable incident response.