In order for SOAR systems to function properly, they need a set of predefined playbooks that are created to characterize threats and how to respond to them utilizing repeatable, automated security workflows. These playbooks, however, are only as sophisticated and useful as the information utilised to create them. Security teams encounter the following issues with their SOAR technology in the absence of actionable, real-time data on current and emerging risks:Information OverloadLack of Context From Internal SystemsLimited View of External ThreatsTo overcome these challenges, and effectively perform Incident Management and Vulnerability Management, security teams need actionable, real-time intelligence on active and emerging threats integrated directly into their SOAR solutions.
Incident Management Use Case with SOAR !
During the second quarter of 2022 itself, internet users worldwide saw approximately 52 million data breaches, cyberattacks, and incidents across the globe. The idea here is not fear mongering but to decode why organizations having superior security operations centers with solutions such as SOAR, SIEM, XDR aren’t able to take a preventive approach towards these cyber attacks, incidents and data breaches. The playbooks in SOAR are as good as the intelligence fed in it. Security teams often see the following obstacles while leveraging the SOAR to its full potential:
- Information overload: Thousands of security alerts and triggers are sent to the SOAR every day by numerous security technologies. Although this information is essential for decision-making and task automation, it is typically not provided in a context or in a way that can be used. As a result, many security breaches go undiscovered for months, giving hackers free rein and time to wreak havoc.
- Lack of Context From Internal Systems: Logs and events feeding the SOAR are often riddled with false positives or missing the vital information that’s necessary to make the best decision. To act effectively on these alerts and properly triage them, analysts often need to spend hours performing research and analysis. The decision on how to respond and decode should be chosen such that it works for that event or incident, but also considers the threat’s historical context and ability to stand the test of time.
- Limited View of External Threats: The SOAR needs a complete, integrated view of external threat and underground intelligence in order to provide useful data for analysis and automated decision-making. The IR team and the SOAR playbooks won't have a complete picture of what is happening without a large collection of contextualized and pertinent data, which will prevent organizations from being aware of potential external threats to them.
How can the CloudSEK Platform help rev up SOAR’s Incident Management capabilities?
- Asset Exposure Monitoring: This gives an umbrella view of exposure of company assets in various modules. By leveraging this, the analyst can understand patterns of exposures, potential attack vectors, predictions of attacks and corresponding prioritization of the securities operations. The following Asset Exposure Monitoring plus the Vulnerability Intelligence can be leveraged by SOAR in preventing incidents which would have otherwise occurred due to open critical vulnerabilities.
- Contextualised Underground Intelligence: Most of the incidents require relevant intelligence for being mitigated, whether it is Vulnerability Intelligence, Malware Intelligence, Adversary Intelligence or TTPs. The Underground Intelligence Module in CloudSEK Platform can equip the SOAR Playbooks with the same. For example, when a playbook in SOAR is triggered from an alert received by SIEM, the analyst can add TTP Identification Nodes or Subplaybook which would query the Underground Intelligence module in CloudSEK Platform to fetch relevant and contextual Intelligence.
Vulnerability Management Use Case with SOAR
Over the past few years, cyber security has made its way onto every organisation’s radar. Hardly a week goes by without another high-profile breach. Vulnerabilities in software present threat actors with the best opportunities to get access to exposed systems. Meanwhile, security teams are working to identify the vulnerabilities that present the greatest risk and need to be patched on priority. Asset Proliferation: With the proliferation of mobile devices, servers, and the motley assortment of devices that represent the internet of things, there’s good reason to bet that the targeting of vulnerabilities will continue and even grow. The basic SOAR playbook without integration with Vulnerability intelligence and Asset visibility will never be able to measure the risk and threat that the organisation is facing.
- Monitor Internally: The Infrastructure Risk Management Module allows the analyst to add all the crown jewels of the organization in a single place. The platform also equips the analyst to run ad- hoc scans on these internal assets to identify vulnerabilities.
- Monitor Externally: An intelligence solution that draws sources like chatter on dark web forums or monitors code repositories for examples of code that target a specific vulnerability will help alert you to a vulnerability that you’ve left unpatched.
- Analyze: The CloudSEK Platform allows you to set custom rules and alerts. The ML algorithm correlates and connects the dots between the new vulnerabilities, zero-day vulnerabilities and internal assets.
- Predict and Prevent: This intelligence can be disseminated to SOAR via APIs to trigger the Vulnerability Management playbook without human intervention and also create a ticket in the ITSM tool for the Vulnerability Management Team to bridge the silos.
