Security Automation Approach #1: Workflow
Download as PPTX, PDF0 likes104 views
The workflow tool receives a phishing alert from a detection system. It then retrieves additional context data on related URLs, attachments, emails, and keywords. The workflow tool then opens a ticket, assigns it to an analyst based on preset rules, and includes the enriched alert data to assist the manual investigation. The analyst reviews the evidence and remediates the threat, such as imaging infected laptops, blocking senders, and deleting emails.
Related topics:1 of 6
Download to read offline
More Related Content
Viewers also liked (13)
Ad
Similar to Security Automation Approach #1: Workflow (20)
Ad
Recently uploaded (20)
Security Automation Approach #1: Workflow
- 1. Intelligent Security Orchestration and Automation hexadite.com Let’s Automate - Workflow The workflow tool receives a phishing alert from a detection system.
- 2. Intelligent Security Orchestration and Automation hexadite.com Let’s Automate - Workflow Workflow tool retrieves data to give more context to alerts. Data on entities such as: • URLs • Attachments • HTML email • Keywords
- 3. Intelligent Security Orchestration and Automation hexadite.com Let’s Automate - Workflow Workflow tool opens and assigns a ticket to an analyst based on pre-set rules
- 4. Intelligent Security Orchestration and Automation hexadite.com Let’s Automate - Workflow Ticket includes enriched alert data to assist in the manual investigation.
- 5. Intelligent Security Orchestration and Automation hexadite.com Let’s Automate - Workflow The analyst manually investigates and remediates the threat. • Review email • Analyze attachments, URLs, keywords • Determine who received the email, where it might have been opened (Pivoting) • Manually remediate (ex. re-imaging a laptop , Deleting the email from the mailbox, blocking the sender?)
- 6. Intelligent Security Orchestration and Automation hexadite.com Workflow What Time Review email 10 minutes Analyze attachments, URLs, and keywords 30 minutes Access the endpoint 1 hour Remediate 30 minutes TOTAL 2 hours and 10 minutes