Accelerate investigations and improve analyst productivity

SOAR platforms can be programmed by security engineering teams to automate analyst tasks both upstream, ie., data collection, correlation, enhancement, and downstream ie. assisting in responding to low-level, repetitive security events. The Respond Analyst is pre-built software that automates the analysis, investigation and triage ‘at the front line’ of security decision-making, vetting all events before the SOAR needs to take. The Respond Analyst is ready to work on day one, no programming required and elevates security teams to remediation and response activity.

A security event is a single occurrence that theoretically indicates suspicious activity. Sensors like firewalls, web proxy monitors and end point protection solutions generate thousands to millions of individual events on a daily basis that may or may not be an indication of a threat. The Respond Analyst considers all available security events – analyzing, investigating and correlating them into security incidents that are scoped and prioritized for security teams to take action on. The Respond Analyst only escalates vetted security incidents and updates the scoped escalation additional related security data becomes available.

MSSP’s are challenged with the same ‘people in front of console’ as any internal SOC. MSSP’s are narrowing down the data their teams analyze use rules and something sensor filters –most likely less than 10% of your data is getting analyzed. Further, MSSP’s escalate individual events that seem suspicious. Using the same number of team members, you have today, you improve your coverage and capacity and only spend time on vetted security incidents that have the data to back them up.