Robocert : Traitement semi-automatisé des incidents sécurité grâce à des web-services

Together, the IT department and the Osiris CERT deal with 600 security incidents every year. Such a large number of incidents is difficult to process manually. The first attempt at automation was a simple script that simplified processing by bringing together the various steps of the process: opening an incident, collecting information, analysis, blocking the relevant IP address or account if required, tracking the incident, and closing the incident. This script already used a ticketing tool and a number of databases. Gradually, the idea developed to make the processing more automatic by using a structured representation of incident data in order to have a format that could be understood by a program. In collaboration with the RENATER CERT, incident notifications were transferred to us in a structured representation in IODEF format. To give a very simple explanation of how it works, our new tool, Robocert, decodes this format and collects as much information as possible to simplify the work of the operator who processes incidents.This article describes the various structured representations currently used for security incidents. It also details how Robocert and the web services it uses work, and finally considers possible developments for this tool.