How to Shrink Your SOC’s Response Time With Workflows and Real Time Response

March 04, 2021

| janani.nagarajan | Endpoint Security & XDR

As attack surfaces grow and threats become more sophisticated, your SOC team is challenged with detecting, understanding and containing an attack faster than ever to protect the organization from critical breaches. This is made even more difficult as the number of remote employees in your organization rises and your security stack increases in complexity.

To stop an attack in progress with speed and accuracy, your team needs to meet the 1/10/60 challenge, where you have an average of one minute to detect an attack, 10 minutes to understand it and 60 minutes to contain it. But as many of us know, speeding up response is easier said than done. To achieve this need for speed, your team must focus its attention on true, critical threats while minimizing repetitive and manual tasks that eat up their limited time.

CrowdStrike’s solution has been built from Day One to stop breaches and protect your organization, and in our ongoing quest to improve and enrich your user experience, we have focused on transforming your approach from detections and alerts to incident-based workflows. These improvements help customize and streamline communication across teams dealing with alert fatigue and to prioritize critical workflows with repeatability and consistency, focusing your team’s efforts on the alerts that matter most. The additions of new partner applications to the CrowdStrike Store, including Slack, PagerDuty, Tines and Vulcan Cyber, further these new enhancements by seamlessly integrating automation, orchestration and aggregation capabilities within the CrowdStrike Falcon® platform and across communication channels. These new capabilities will ensure your security tools are more effective and more efficient so you can stop breaches while driving down your SOC’s costs.

Accelerate Investigation with Incident-Based Workflows

With one minute to detect an attack in progress, your team needs to cut down on the daily tsunami of alerts and unnecessary investigations to minimize alert fatigue, prioritize critical incidents, and see threats in context. CrowdStrike’s Falcon platform has introduced enhancements to user experience to help you investigate threats faster by moving your SOC from an alert-and-detection-based workflow to an incident-based workflow. This improvement reduces duplicate investigations across incidents and detections by enabling your team to assign, update status and comment on related detections when they are updating an incident. Falcon identifies detections that are part of an incident and links to the related incident for investigation, enabling your team to easily streamline assignments and status for all detections within an incident and quickly contain all impacted hosts — including those impacted by lateral movement.

Get Ahead of Incidents with Notification Workflows

Sophisticated adversaries, complex security stacks and a shortage of skilled cybersecurity staff are deterrents that are all too common for SOCs today. Compounded by alert fatigue, false positives, disparate alert notifications from different security tools, and duplicate incidents, how can you ensure your analysts are able to understand threats efficiently to then remediate effectively? Security teams need to focus on streamlining alerts and communication to get ahead of threats and cut down on response times.

CrowdStrike Notification Workflows help you achieve scale and consistency for threat triage and communication, improving your security team’s efficacy and speed. Notification Workflows are easily delivered via email, generic webhooks, or in the CrowdStrike Store through Slack and PagerDuty integrations at no additional cost to CrowdStrike customers with Falcon Prevent™ or Falcon Insight™ subscriptions. By building repeatable and consistent workflow processes based on your security team’s unique requirements, you can scale, optimize and standardize your organization’s security posture. With this capability, Falcon Horizon™ users can also configure and distribute notifications about cloud security posture findings to fit their needs. With Notification Workflows, standardize and scale your teams and their tasks by easily surfacing important alerts and notifying the right people

automatically, reducing mean time to respond and remediate threat detections.

Speed up Response with Automation Actions

When investigating a potential incident,responders have about 10 minutes to understand the threat and 60 minutes to contain the risk. Unfortunately, it’s hard for security teams to respond quickly as the incident may require repairing damage to the OS registry pulling additional forensic data from remote machines, or killing processes that are currently running, making your team interact deeply and directly with the target system. To ensure these critical actions are enacted quickly and consistently to protect your organization, your security team needs the right tools in place that act swiftly and accurately in your environment. CrowdStrike’s powerful Real Time Response framework is now available for partners to support security teams in automating orchestration and response actions. This new capability helps your security team automate response actions for repetitive but required manual tasks through CrowdStrike Store partners’ validated scripts, including Store apps like Tines and Vulcan Cyber, which are available to try today. Leveraging CrowdStrike’s framework, Tines’ advanced security automation and response, and Vulcan Cyber’s endpoint vulnerability remediation will bring scale and speed to your distributed SOC team. With customized scripts and playbooks that use PowerShell, your team can free up resources for other critical tasks and high-impact projects.

Demand and Get More From Your Security Stack

To sum up, your SOC team should demand more from your existing security stack . By improving your solutions’ efficacy and efficiency through workflows and automation, you can drive down the total cost of ownership (TCO) and accelerate your response times. CrowdStrike’s commitment to stopping breaches fuels our desire to integrate with powerful ecosystem partners and deliver solution capabilities that surface actionable alerts that catalyze your SOC team. With our enriched capabilities, empower your team to get ahead of threats and maintain the high level of security efficacy needed to safeguard your organization from adversaries.

To learn more about today’s news, CrowdStrike’s Notification Workflows, and enhancements with our CrowdStrike Store partners, join us for our webcast on March 16, 2021!