The standard for dynamic responses to complex threats is evolving. Organizations are in dire need of advanced orchestration and automation capabilities to improve response times from hours to minutes. But what’s available on the market today?

Fortunately, industry pioneers are creating innovative solutions, based on real-world feedback and problems.

Incident Response Orchestration: People, Process and Technology

The IBM Resilient Security Orchestration, Automation, and Response (SOAR) Platform has set a new standard in a market it pioneered. IR orchestration capabilities were added to the platform years ago, arguably when the automatic threat feed lookups were added in 2013.

Automation, however, is just a component of orchestration. Doing automation well requires the ability to manage people, process and technology. (For more on this topic, Bruce Schneier, the chief technology officer at IBM Resilient, discusses security orchestration and IR on his blog.)

Agility, Intelligence and Sophistication

The next big step on IBM Resilient’s orchestration journey? The Resilient dynamic playbooks. These playbooks started with the rules functionality, which provides customers with the agility, intelligence and sophistication needed to contend with complex attacks. All of these capabilities and innovations offer customers the most advanced full orchestration platform that can enable a dynamic and accelerated response program.

The Resilient SOAR Platform now features:

  • Visual workflows: Enables analysts to orchestrate IR with visually-built, complex workflows based on tasks and technical integrations.
  • Incident visualization: Graphically displays the relationships between incident artifacts or indicators of compromise (IOCs) and incidents in an organization’s environment.
  • Timers: Enables time-based rules in workflows for more proactive response and to support service level agreements (SLAs).
  • Artifact workflows: Enables tools-to-tools automation workflows, while also allowing for people-centric tasks and approvals.
  • Tasks and scripts: Adds in-platform scripting functionality to workflows, enabling in-platform automation.

Responding to cyberattacks is incredibly tough. Attacks that shift as they unfold, complicated technology environments and a growing skills gap all contribute to the challenge. These new features enable the full orchestration capabilities that customers need to address these challenges. Effectively coordinate people and technology throughout the response process, empowering your analysts to make intelligent decisions and act quickly.

Building a Next-Gen Response Function

Resilient customers are realizing significant benefits from these improvements in orchestration. For example, by automating triage and enrichment tasks, orchestration helps alleviate the skills gap. Instead of pivoting between tools, analysts can let Resilient do the grunt work and focus their energy on the investigation and response activities only they can complete.

Furthermore, by connecting Resilient with more than 100 different technologies, our customers are able to not only unlock additional value from these related systems but also demonstrate their value by relating it to incident activity.

These capabilities drive dramatic improvements in response times. For example, a large customer in the pharmaceutical business reduced the time it takes to obtain a forensics image from 84 minutes down to less than two by orchestrating the process.

More from Incident Response

Breaking Down a Cyberattack, One Kill Chain Step at a Time

In today’s wildly unpredictable threat landscape, the modern enterprise should be familiar with the cyber kill chain concept. A cyber kill chain describes the various stages of a cyberattack pertaining to network security. Lockheed Martin developed the cyber kill chain framework to help organizations identify and prevent cyber intrusions. The steps in a kill chain trace the typical stages of an attack from early reconnaissance to completion. Analysts use the framework to detect and prevent advanced persistent threats (APT). Organizations…

Defining the Cobalt Strike Reflective Loader

The Challenge with Using Cobalt Strike for Advanced Red Team Exercises While next-generation AI and machine-learning components of security solutions continue to enhance behavioral-based detection capabilities, at their core many still rely on signature-based detections. Cobalt Strike being a popular red team Command and Control (C2) framework used by both threat actors and red teams since its debut, continues to be heavily signatured by security solutions. To continue Cobalt Strikes operational usage in the past, we on the IBM X-Force…

What is a Red Teamer? All You Need to Know

A red teamer is a cybersecurity professional that works to help companies improve IT security frameworks by attacking and undermining those same frameworks, often without notice. The term “red teaming” is often used interchangeably with penetration testing. While the terms are similar, however, there are key distinctions. First and foremost is the lack of notice from red teams. Pen testing may be scheduled in advance to assess the ability of specific security measures to handle a simulated attack; red team…

The Role of Marketing and PR in Incident Response

Responding to a cyber incident requires teamwork across departments and disciplines. Technical incident responders must work to halt incoming attacks while the communications teams develop a public response. Clear communication is essential. Communication strategies differ before and after a cyber incident. The way a company approaches both is as important as incident mitigation itself. How a company handles or ignores public disclosure of a cyber incident will significantly affect its reputation and future revenue. Marketing and public relations (PR) teams…