We all know that the SOC team’s job is getting harder and harder. The increasing volume and sophistication of attacks is plaguing under-resourced teams with false positives and analyst burnout.
However, like many other industries, cybersecurity is now starting to rely on and benefit from advances in automation, not just to maintain the status quo, but to achieve better security outcomes.
Automate across multiple phases of SOC workflows
The need for automation is clear, and it is clearly becoming table stakes in the industry. IBM estimates that 62% of all cyber-resilient organizations have adopted automation, AI, and machine learning tools and processes.
To date, many of these advances in automation have focused on response, with SOAR and incident response tools playing a key role in addressing the most urgent phases of SOC workflows.
However, focusing only on the response means that we are treating the symptom, not the root cause of the disease. You can easily see the improvement cases.
Four phases that can increase the scope of automation include:
- Data acquisition and normalization: Automating data ingestion and normalization allows teams to handle massive amounts of data from multiple sources, laying the foundation for additional automated processes
- detection: Offloading a significant percentage of detection rule creation frees up time for security analysts to focus on threats specific to their organization and market segment.
- Research: Offload manual tedious work to shorten the investigation and triage process
- response: Automatically respond to known and discovered threats for rapid and accurate mitigation
Data: laying the foundation for automation
Ingesting large amounts of data can sound overwhelming to many security teams. Until now, teams have had to struggle to connect data sources or simply ignore unmanageable data volumes due to the exorbitant cost models of traditional tools that charge you for the amount of data you store. I had to.
As the world continues to move to the cloud, it’s imperative that security teams don’t shy away from large amounts of data. Instead, they should enact solutions that help them manage it and achieve better security outcomes by increasing visibility across the attack surface.
Security data lakes have introduced a paradigm shift in security operations. They support the ingestion of large amounts of diverse data at cloud speeds, allowing security platforms to reduce complexity on top of that and perform analytics at predictable costs.
Detection: 80% automated
As more data is ingested, more alerts are inherently detected. Again, this may sound intimidating to an overworked security team, but automated processes (such as out-of-the-box detection rules across attack vectors) are another 1 A perfect example of one.
Generally speaking, there are many similarities in how networks are attacked, and approximately 80% of threat signals are common to most organizations.
Modern SOC platforms provide out-of-the-box detection rules that cover this 80% by plugging into threat intelligence feeds, open source knowledge bases, social media, or dark web forums, and the most common Create logic to protect against threats. Combined with additional rules created by our in-house security team, the platform stays up-to-date with threat techniques and leverages automated detection.
Investigation: Separating signal from noise
The Investigation phase of the SOC workflow is not often associated with automation. Traditionally, security teams have been bogged down by a multitude of tools and manual investigations that limit their efficiency and accuracy.
Processes that can be enhanced with automation during the investigation phase include:
- Threat-centric clustering of alerts: Security tools issue thousands of warnings, but in reality these threats are very few. At scale, this is a huge waste of resources. When alerts are automatically grouped based on threat context, security analysts can more easily understand and respond to single incidents instead of chasing hundreds of alerts and false positives .
- concentrated: By automatically enriching the entities associated with each signal or alert with additional information from various data sources, your team gets all the context available to understand the risk of an alert.
- correlation: By automatically correlating events, you can better understand an attacker’s path through your organization’s network.
- Visualization: Once correlated, the “story” of the attack can be mapped and visualized in an easy-to-read timeline, making it easier for analysts and other stakeholders to gain clear insights.
By combining these automated tasks, analysts can quickly learn which incidents are the highest priority and warrant further investigation. This is a significant improvement over traditional systems where analysts constantly check and recheck incidents, investigate redundancies, and manually stitch together events.
Automated investigations, when used in conjunction with manual search techniques, can lead to more realistic incidents that are more accurately investigated, triaged, and understood.
Respond: act quickly and confidently
Once a threat has been identified, the natural next step is to respond to it. As mentioned earlier, SOAR is great for automating the known threat response phase.
However, the efficiency of this automation is highly dependent on data provided by other sources. That is, early in the SOC workflow, when it can provide usable and reliable output that can be sent to response software.
Integrating more accurate data, normalized and interrogated by expertly designed automation, greatly increases the reliability and effectiveness of response tools.
Clearly, not all responses can be automated as attackers continue to evolve their tactics. Analysts often have to thoroughly investigate and manually respond to incidents. However, as with other phases of the workflow, the more you can automate these tasks, the better your security team can handle more complex attacks.
So why aren’t more companies using automation?
Many teams know that automation increases productivity, but changing processes and software is often difficult for several reasons.
- Replacing legacy software is time consuming, expensive and potentially dangerous.
- Obtaining stakeholder approval for large-scale implementations is difficult and time-consuming
- Training analysts on how to use new software requires time and resources
- Constantly evolving attack techniques keep security teams focused on the here and now.
These obstacles add up to extreme staffing shortages and make this task seem daunting.
However, as automation continues to play a central role, the industry has seen significant increases in total cost of ownership (TCO), mean time to detect/response (MTTD/MTTR), analyst burnout, and CISO frustration. continues to be reduced.
SOC platform to the rescue
Combining and automating several parts of your SOC workflow starts to take the weight and pressure off your regular workloads. Analyst will be able to say goodbye to spending long hours moving from tool to tool, chasing down false positives, or simply maintaining her legacy SIEM solution .
The new generation SOC platform has a lot of features to offer at every stage of the SOC workflow. Born in the cloud, SOC platforms take advantage of modern data architectures to more easily develop additional features and extensions. This has led to an increasing trend of automation built into them, with the advantage of ingesting all security data at a fraction of the cost of traditional tools.
 |
| Automated investigation of the Hunters SOC platform showing the key entities and associated risk scores for alerts generated after a user logged into the Okta web console from an unmonitored device without an active EDR agent. sample overview |
One example is threat research. Most analysts know that this is a tedious manual task, sorting endless false positives. However, today his SOC platform introduces automation to greatly improve the investigation process. Improvements such as automated cross-source correlation, ML models, and built-in data investigation queries empower analysts to perform repetitive and most arduous threat investigation tasks.
Now is the time to start leveraging automation as it continues to transform the industry. Teams that aren’t actively adopting these innovations can find themselves falling behind, leaving their organizations vulnerable and their staff overwhelmed.
For more information on how the Hunters SOC Platform can help your SOC, visit www.hunters.ai.
