LoRD: Load, Reshape & Detect

Process description – Intro document.

Leonardo Carlos Armesto, March 2022

This document aims to explain the motivations for the LoRD security process.  This
document does not attempt to describe in depth every possible detail of the process,
but hopefully explains the key points and should allow me to spot any obvious mistakes
ahead of time.

This document aims to answer questions not only about how we’re going to apply this,
but also why we’re applying it, what it will be used for, and who will be using it.

Definitions

Load is the transfer of data sources to an environment for processing needs.

Reshape is the transformation of a data structure (i.e., DataFrame, DataSets) in order

to make it suitable for further process or analysis.

Detect is the identification of potential threats based on the outcomes.

Background & Motivations

Incident Response
Logs and event data are key to any incident response analysis to get more detailed
information.

The primary goals of adapting LoRD in organizations are to:

 Create a consolidated view of security insights based on different data structures

and locations.

 Streamline the analysis process leading to better response decisions.

 Reduce incident response times.

LoRD: Load, Reshape & Detect by Leonardo Carlos Armesto is licensed under CC BY 4.0

Leonardo Carlos Armesto - pg. 1

Proposed solution
Use data notebooks for exploratory development to allow combining code with
visualizations and insights.  These data notebooks will manage consistent
environments that are shareable across users and teams to generate security reports
or triggering more complex workflows.

Architecture

Load process
The first challenge is obtaining data from data storages (application logs, databases,
etc.) which will be momentarily buffered on different dataframes.
Based on the results the second challenge is obtaining reliable data from online threat
research and intelligence services which will also be buffered on other dataframes.

Reshape process
As the data come in multiple formats and structures it needs to be converted or flatter
into a tabular form and again buffered to dataframes as well.

Detect process
Finally, the dataframes should be merged/joined so the resulting combined-dataframe
will contain all flagged/tagged event data to generate threat reports or for alerting
purposes.

LoRD: Load, Reshape & Detect by Leonardo Carlos Armesto is licensed under CC BY 4.0

Leonardo Carlos Armesto - pg. 2