getting security operations right with ttp0ismael valenzuela sans instructor, mcafee @aboutsecurity...
TRANSCRIPT
![Page 1: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/1.jpg)
0
Getting Security Operations Right with TTP0
Ismael Valenzuela
SANS Instructor, McAfee@aboutsecurity
Rob Gresham
Splunk> Phantom@SOCologize
![Page 2: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/2.jpg)
Where were you in 1986?
![Page 3: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/3.jpg)
![Page 4: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/4.jpg)
0
![Page 5: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/5.jpg)
What is the story?
https://securingtomorrow.mcafee.com/mcafee-
labs/emotet-trojan-acts-as-loader-spreads-
automatically/
Google Market Summary
![Page 6: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/6.jpg)
We keep seeing the same situation...
![Page 7: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/7.jpg)
SOC Strategic Mission: manage & report risk
Success: interrupt adversary activity to mitigate loss, managing and communicating risk
Requires a strategic and tactical approach to security, where Cyber Threat Intelligence (CTI) is central to this mission
![Page 8: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/8.jpg)
10,000 hours or 6 months?
![Page 9: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/9.jpg)
So we sat down...
• And started to think about what works...
![Page 10: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/10.jpg)
0Monitor
Discover
RespondMeasure
Automate
Transform
Lear
n
![Page 11: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/11.jpg)
0Security Operations Story
30 9060
Understand the business, set initial goals & outline a realistic, high-impact plan
Create awareness, maintain focus and augment visibility
Report & celebrate success, identify points of change, increase scope in spiral
motion
![Page 12: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/12.jpg)
0Security Operations Story: NSM
30 9060
Understand the business, set initial goals & outline a realistic, high-impact plan
Create awareness, maintain focus and augment visibility
Report & celebrate success, identify points of change, increase scope in spiral
motion
DISCOVER… the businessMONITOR… define zones, critical assetsRESPOND… define IRP for themAUTOMATE… core actions (Create tickets, data transfer processes)MEASURE… time to notify, remediate
TRANSFORM… create awarenessDISCOVER… anomalies or gapsMONITOR… critical, high alertsRESPOND… refine IRPAUTOMATE… contextual dataMEASURE… time to investigate, recovery
TRANSFORM… analytical qualityDISCOVER… hunt retroactivelyMONITOR… new attack points (scope)RESPOND… apply lessons learnedAUTOMATE… response scenariosMEASURE… alignment to business goals
![Page 13: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/13.jpg)
0Discover
What’s important, Crown Jewels, save one’s SOEL
• Understand the Business Units and talk to your IT cohorts• Understand what’s critical to enterprise operations• Review the Business Continuity Plan (if they have one)• Start early, don’t wait...
“In preparing for battle I have always found that plans are useless, but planning is indispensable.” - Dwight D. Eisenhower
![Page 14: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/14.jpg)
0Monitor
SOC Zoning
Using the concept of SOC Zones to defend your organization allows for both IT and business context in order simplify building effective Use-Cases
Set the stage to build efficient response processes around...
• Zones• Categories• Severity• Sensitivity • Resource Tiers
![Page 15: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/15.jpg)
0Monitor
Other Examples:
• OT/ICS • Manufacturing• R&D• PCI Zones• business-critical
application• Cloud critical hosting • DMZ
Zoning should be implemented in a way that reflects business-critical capability
![Page 16: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/16.jpg)
0Monitor
Determine essential security feeds and intelligence sources
![Page 17: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/17.jpg)
0Monitor
Effective application of content
(threat content engineering)
![Page 18: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/18.jpg)
0Response
Block Processes and C2 Channels
• External Contextualization• Internal Scoping (beyond reporting)• Root Cause Analysis
• Triage Forensics• Contain not remediate
• Eradicate / Recovery• Lessons Learned
![Page 19: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/19.jpg)
0
AUTOMATE: Introducing TTP0 DRONE
![Page 20: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/20.jpg)
0Automate
Configure & automate ticket creation with DRONE, by @DFIRENCE -https://github.com/TTP0/drone
![Page 21: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/21.jpg)
![Page 22: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/22.jpg)
![Page 23: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/23.jpg)
![Page 24: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/24.jpg)
![Page 25: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/25.jpg)
![Page 26: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/26.jpg)
![Page 27: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/27.jpg)
![Page 28: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/28.jpg)
![Page 29: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/29.jpg)
![Page 30: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/30.jpg)
![Page 31: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/31.jpg)
![Page 32: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/32.jpg)
![Page 33: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/33.jpg)
![Page 34: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/34.jpg)
![Page 35: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/35.jpg)
![Page 36: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/36.jpg)
![Page 37: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/37.jpg)
![Page 38: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/38.jpg)
![Page 39: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/39.jpg)
![Page 40: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/40.jpg)
![Page 41: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/41.jpg)
![Page 42: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/42.jpg)
0Check out our WIKI
• https://github.com/TTP0/drone/wiki/OVERVIEW
![Page 43: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/43.jpg)
0TRANSFORM
Create awareness by telling a story -https://github.com/TTP0/ttp0_community_templates
![Page 44: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/44.jpg)
TLP: RED TLP: RED
44
JAN FEB MAR APR MAY JUN
JUL AUG SEP OCT NOV DEC
FEYE - APT1
Blog/Report
Victim
Weapons
<ActorNameHere> - <YYYY>
SPEARPHISHING
![Page 45: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/45.jpg)
00Tier Threat Response TeamThreat Mitigation and Recovery Team (12 - Team)
Incident Leader
Hunt
Scan & Assess
Vulnerability Analysis
Risk Assessment
Find & Analyze
System Integrity
Forensics
Monitor
Network (SO, Bro, Snort)
Host (HIPS, Raptor, ePO)
Harden
Windows (Applocker, GPO,
EMET)
Linux/Unix
(IPTables, rkhunter)
Infrastructure
(ACLs, MAC Blocks)
Intelligence - LE Liaison
Incident Response Lead
Incident Responder
SOC IR
SOC Analyst
Red Teamer
CTI Analyst
Host Forensics
Net Forensics
Host Discovery
![Page 46: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/46.jpg)
0
![Page 47: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/47.jpg)
0www.ttp0.io
![Page 48: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/48.jpg)
0What is available today
- TTP0 DRONE by @DFIRENCE
- Automates incident creation with zones, tiers, etc
- Requires python 2.7, installed TheHive
- GitHub: https://github.com/TTP0/drone
- Opbrief PPT templates by TLP
- Actor Tracker PPT templates by TLP
- 0Tier Threat Response model vs 3Tier Traditional SOC
- A curated list of awesome GitHub resources we use
![Page 49: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/49.jpg)
0What we are working on
- Security Operations Story templates- Tying Use Case to Responses Playbooks- Investigation and Response Metrics
- Security Operations Templates for Managers- Tools matrix- SWOT * TWOS Analysis- Staff management & SOC scheduling configurations
- How To Guidelines:- Zoning, tiers, etc.- Use Case prioritization- Standardize Automation Investigation Playbooks
![Page 50: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/50.jpg)
0Thanks! Follow us @TTP_0
TTP0 Founders:
Ask us how to contribute: [email protected]
@dfirence @carric
Carlos Diaz Carric Dooley Rob Gresham Ismael Valenzuela
@SOCologize @aboutsecurity
![Page 51: Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier](https://reader030.vdocuments.us/reader030/viewer/2022040511/5e5c34d700c27e6b4626cb3d/html5/thumbnails/51.jpg)
Thank you!