Incident Response Platform: Automation and Orchestration
Organisations face growing security operations challenges – the volume and severity of cyber attacks is increasing, and at the same time hiring and retaining IT security professionals remains difficult. These factors, and others, are contributing to the need for the adoption of security orchestration automation and response (SOAR) tools that can help security teams respond to and remediate complex cyber threats.
IBM Security Resilient empowers security analysts by automating common security operations and incident response (IR) processes, guiding them through the necessary steps to resolve complex cases. They can access important security information quickly with the relevant incident context, enabling accurate decision making and decisive action. It leverages automation to increase the productivity of security analysts and improve the effectiveness of deployed technologies—
alleviating the skills gap and alert fatigue.
IBM Resilient highlights
Reduce remediation time by automating manual and repetitive tasks
Improve security effectiveness with orchestration and automation across the incident response process
Prioritise analyst workload by guiding actions with customised playbooks
Improve team collaboration with consistent processes and workflows
Embed best practices through incident response playbooks for common threats
Measure and improve security operations center (SOC) effectiveness: Reduce the manual steps in incident response through security orchestration and automation, which can be invoked at any step in the incident response process, to improve SOC productivity, processes, and time to resolve.
Streamline security operations management: A common security operations challenge is managing IT complexity. IBM Security Resilient helps security analysts to manage disparate security products across the organisation via extensive 3rd party apps and integrations for common security and IT ops tools.
Establish standard IR processes: Security orchestration and automation is a process, not a product. It requires strong foundational blocks—trained people, proven processes, and integrated technologies. With IBM Security Resilient, develop and maintain incident response playbooks for common threats that codify industry best practices and internal procedures.
Proactively manage incident response: Allow security teams to automatically adapt their IR processes to realtime incident conditions, enabling a fast and complete response, with dynamic playbooks. With agile and adaptive workflows built on a sophisticated logic engine, dynamic playbooks update IR plans automatically as new information about an incident is uncovered, using organisations’ security tools to ingest data about an incident.
Empower your security team: Enable security teams to orchestrate incident response with visually built, complex workflows based on tasks and technical integrations, and no special programming or coding skills.
Multiply your team’s effectiveness
40x faster overall response using dynamic playbooks that orchestrate your people, process and technology
IBM Resilient managed incident response platform integrates with all existing security systems to create a single hub for Incident Response, allowing easy workflow configuration and process automation to transform an organisation’s security posture. It empowers security teams to analyse, respond, resolve and mitigate incidents faster using consistent, intelligent processes.
One customer went from 20 days (on average) to close a security incident to less than 5 days – this was IBM.
The life of a security incident
Although there is strong integration between QRadar and Resilient, the infographic below on the life of a security incident is applicable to any SIEM.
For a suspected malware outbreak and based on QRadar rules, an incident is automatically created inside the IBM Resilient platform, importing relevant information about the attack and any indicators of compromise (IoCs). Resilient will then generate a detailed response plan specific to the incident type and attaches any associated IOCs like the malware hash.
Leveraging automatic enrichment capabilities, the suspected malware is compared against threat intelligence feeds like IBM X-Force Exchange which confirms it is known bad malware and other characteristics such as linked phishing attacks and associated source IP addresses. These details can then be used to orchestrate remediation, like blocking the attack source through FW changes, helping to tune the SIEM tool to be more effective.
With IBM Resilient, you can:
Empower your security team to analyse, respond to, and mitigate cybersecurity incident faster and more effectively.
Achieve greater intelligence and efficiency by integrating your existing security technologies, including SIEMs, EDR, threat intelligence, and more.
Adapt to real-time incident conditions with Resilient Dynamic Playbooks – ensuring a fast and complete response to all incident types.
Harmonise your security processes with orchestrated incident response services
Resilient’s Dynamic Playbooks share several critical and differentiating attributes:
Agile: continually react to changes by leveraging rules and scripts that implement business logic and enriching incidents as they progress.
Intelligent: leverage information from other connected systems to make rules-based decisions to take actions – such as increasing incident priority or escalating to other parts of the organisation (HR, legal). By the time an analyst opens an incident, many repetitive, initial triage steps have already been completed.
Sophisticated: keep business rules separate from workflows, eliminating the need for a proliferation of static playbooks with only slight variations and keeping management overhead to a minimum. As an example as to how this works, consider a spear-phishing attack on a work laptop used by a senior executive. Before a SOC analyst even sees the incident, rules and conditions associated with the Dynamic Playbook have used information from connected systems to determine that the user is an executive, automatically escalated the alert to tier-2 analysts, raised the official severity code for the incident and notified the company’s legal team.
In addition, Resilient’s Dynamic Playbooks support integrations with more than 100 other systems that may be present in a typical security environment, providing clients with a seamless, centralised incident response hub.
Orchestrated Response: A game-changing strategy
An orchestration strategy allows for security teams to process incidents faster and more accurately. And by automating repetitive and menial tasks and delivering the right information to the right analyst at the right time, orchestration can significantly drive down Mean-Time-To-Response.