July 25, 2017 By Ted Julian 2 min read

The standard for dynamic responses to complex threats is evolving. Organizations are in dire need of advanced orchestration and automation capabilities to improve response times from hours to minutes. But what’s available on the market today?

Fortunately, industry pioneers are creating innovative solutions, based on real-world feedback and problems.

Incident Response Orchestration: People, Process and Technology

The IBM Resilient Security Orchestration, Automation, and Response (SOAR) Platform has set a new standard in a market it pioneered. IR orchestration capabilities were added to the platform years ago, arguably when the automatic threat feed lookups were added in 2013.

Automation, however, is just a component of orchestration. Doing automation well requires the ability to manage people, process and technology. (For more on this topic, Bruce Schneier, the chief technology officer at IBM Resilient, discusses security orchestration and IR on his blog.)

Agility, Intelligence and Sophistication

The next big step on IBM Resilient’s orchestration journey? The Resilient dynamic playbooks. These playbooks started with the rules functionality, which provides customers with the agility, intelligence and sophistication needed to contend with complex attacks. All of these capabilities and innovations offer customers the most advanced full orchestration platform that can enable a dynamic and accelerated response program.

The Resilient SOAR Platform now features:

  • Visual workflows: Enables analysts to orchestrate IR with visually-built, complex workflows based on tasks and technical integrations.
  • Incident visualization: Graphically displays the relationships between incident artifacts or indicators of compromise (IOCs) and incidents in an organization’s environment.
  • Timers: Enables time-based rules in workflows for more proactive response and to support service level agreements (SLAs).
  • Artifact workflows: Enables tools-to-tools automation workflows, while also allowing for people-centric tasks and approvals.
  • Tasks and scripts: Adds in-platform scripting functionality to workflows, enabling in-platform automation.

Responding to cyberattacks is incredibly tough. Attacks that shift as they unfold, complicated technology environments and a growing skills gap all contribute to the challenge. These new features enable the full orchestration capabilities that customers need to address these challenges. Effectively coordinate people and technology throughout the response process, empowering your analysts to make intelligent decisions and act quickly.

Building a Next-Gen Response Function

Resilient customers are realizing significant benefits from these improvements in orchestration. For example, by automating triage and enrichment tasks, orchestration helps alleviate the skills gap. Instead of pivoting between tools, analysts can let Resilient do the grunt work and focus their energy on the investigation and response activities only they can complete.

Furthermore, by connecting Resilient with more than 100 different technologies, our customers are able to not only unlock additional value from these related systems but also demonstrate their value by relating it to incident activity.

These capabilities drive dramatic improvements in response times. For example, a large customer in the pharmaceutical business reduced the time it takes to obtain a forensics image from 84 minutes down to less than two by orchestrating the process.

More from Incident Response

How Paris Olympic authorities battled cyberattacks, and won gold

3 min read - The Olympic Games Paris 2024 was by most accounts a highly successful Olympics. Some 10,000 athletes from 204 nations competed in 329 events over 16 days. But before and during the event, authorities battled Olympic-size cybersecurity threats coming from multiple directions.In preparation for expected attacks, authorities took several proactive measures to ensure the security of the event.Cyber vigilance programThe Paris 2024 Olympics implemented advanced threat intelligence, real-time threat monitoring and incident response expertise. This program aimed to prepare Olympic-facing organizations…

How CIRCIA is changing crisis communication

3 min read - Read the previous article in this series, PR vs cybersecurity teams: Handling disagreements in a crisis. When the Colonial Pipeline attack happened a few years ago, widespread panic and long lines at the gas pump were the result — partly due to a lack of reliable information. The attack raised the alarm about serious threats to critical infrastructure and what could happen in the aftermath. In response to this and other high-profile cyberattacks, Congress passed the Cyber Incident Reporting for Critical…

PR vs cybersecurity teams: Handling disagreements in a crisis

4 min read - Check out our first two articles in this series, Cybersecurity crisis communication: What to do and Crisis communication: What NOT to do. When a cyber incident happens inside an organization, everyone in the company has a stake in how to approach remediation. The problem is that not everyone agrees on how to handle the public response to cyber crisis communication. Typically, in any organization, the public relations team handles the relationship between the company and the media, who then decide…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today