July 25, 2017 By Ted Julian 2 min read

The standard for dynamic responses to complex threats is evolving. Organizations are in dire need of advanced orchestration and automation capabilities to improve response times from hours to minutes. But what’s available on the market today?

Fortunately, industry pioneers are creating innovative solutions, based on real-world feedback and problems.

Incident Response Orchestration: People, Process and Technology

The IBM Resilient Security Orchestration, Automation, and Response (SOAR) Platform has set a new standard in a market it pioneered. IR orchestration capabilities were added to the platform years ago, arguably when the automatic threat feed lookups were added in 2013.

Automation, however, is just a component of orchestration. Doing automation well requires the ability to manage people, process and technology. (For more on this topic, Bruce Schneier, the chief technology officer at IBM Resilient, discusses security orchestration and IR on his blog.)

Agility, Intelligence and Sophistication

The next big step on IBM Resilient’s orchestration journey? The Resilient dynamic playbooks. These playbooks started with the rules functionality, which provides customers with the agility, intelligence and sophistication needed to contend with complex attacks. All of these capabilities and innovations offer customers the most advanced full orchestration platform that can enable a dynamic and accelerated response program.

The Resilient SOAR Platform now features:

  • Visual workflows: Enables analysts to orchestrate IR with visually-built, complex workflows based on tasks and technical integrations.
  • Incident visualization: Graphically displays the relationships between incident artifacts or indicators of compromise (IOCs) and incidents in an organization’s environment.
  • Timers: Enables time-based rules in workflows for more proactive response and to support service level agreements (SLAs).
  • Artifact workflows: Enables tools-to-tools automation workflows, while also allowing for people-centric tasks and approvals.
  • Tasks and scripts: Adds in-platform scripting functionality to workflows, enabling in-platform automation.

Responding to cyberattacks is incredibly tough. Attacks that shift as they unfold, complicated technology environments and a growing skills gap all contribute to the challenge. These new features enable the full orchestration capabilities that customers need to address these challenges. Effectively coordinate people and technology throughout the response process, empowering your analysts to make intelligent decisions and act quickly.

Building a Next-Gen Response Function

Resilient customers are realizing significant benefits from these improvements in orchestration. For example, by automating triage and enrichment tasks, orchestration helps alleviate the skills gap. Instead of pivoting between tools, analysts can let Resilient do the grunt work and focus their energy on the investigation and response activities only they can complete.

Furthermore, by connecting Resilient with more than 100 different technologies, our customers are able to not only unlock additional value from these related systems but also demonstrate their value by relating it to incident activity.

These capabilities drive dramatic improvements in response times. For example, a large customer in the pharmaceutical business reduced the time it takes to obtain a forensics image from 84 minutes down to less than two by orchestrating the process.

More from Incident Response

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything. But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists…

X-Force uncovers global NetScaler Gateway credential harvesting campaign

6 min read - This post was made possible through the contributions of Bastien Lardy, Sebastiano Marinaccio and Ruben Castillo. In September of 2023, X-Force uncovered a campaign where attackers were exploiting the vulnerability identified in CVE-2023-3519 to attack unpatched NetScaler Gateways to insert a malicious script into the HTML content of the authentication web page to capture user credentials. The campaign is another example of increased interest from cyber criminals in credentials. The 2023 X-Force cloud threat report found that 67% of cloud-related…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today