Earlier this month, more than 80 security leaders entered the next-generation security operations center (SOC) experience at IBM Business Connect in London to see the difference that Watson and Resilient could make to incident investigation and response. The audience sat in a darkened room facing five large screens and took advantage of the opportunity to watch a mock SOC — complete with IBM analysts — conduct typical security business.

Following a brief introduction of what was showing on the various screens — which included a quick look at IBM X-Force Exchange, IBM’s threat sharing platform — the audience watched as a Tier 1 SOC analyst began his shift at a fictitious professional services company. Before he even had time to get his morning coffee, the fictional analyst found that something was wrong.

Using IBM QRadar as the security intelligence platform, the analyst was alerted to some potentially suspicious behavior involving a known bad IP address. Based on the suspicious activity, an Incident was automatically created in the IBM Resilient Security Orchestration, Automation, and Response (SOAR) Platform to ensure that the SOC analysts were able to follow a well-defined process to investigate and respond to the threat. Having completed some basic investigation, including gathering information from X-Force Exchange, the analyst followed the defined process and turned to Watson for Cyber Security for insight about what was happening.

Using Watson, the SOC analyst was presented with some highly visual indicators alerting him to a potential threat involving some malware and a suspicious document. Watson was able to take all the known data, query its corpus of security information and deliver deep insight to the analyst.

In this case, it showed that Locky ransomware had infected six machines and was spreading through the network. Given this new information, the analyst changed the incident type and severity in the IRP, which triggered a new workflow and alerted a Level 2 analyst to get involved.

In the final stage of the scenario, the Level 2 analyst worked through the incident response plan, owning tasks or assigning to other departments as appropriate. Based on the type of data that was breached and the operating country, the response plan included quarantining infected servers, blocking a compromised user account and notifying the Information Commissioner’s Office.

To wrap up the event, the audience reflected on how differently this could have turned out. The time to detect, investigate and respond was significantly decreased by using new tools, ensuring that the attack was contained before it was able to propagate too far through the enterprise.

Now the question is: How quickly will your company be able to respond to the next cyberthreat?

Mike Spradbery is IBM’s Technical Leader for the UKI Security Systems Business, managing a diverse team of technical specialists who work with clients across all industries. During the past 20 years, Mike has worked with security, mobile, social and web experience technologies in a variety of business leadership, sales and technical roles.