topic Re: Incident Handling Automation and Orchestration Suggestions Needed in Member Support

Incident Handling Automation and Orchestration Suggestions Needed

SoBe8503 — Mon, 20 Nov 2017 20:22:38 GMT

Hello all,

Not sure if I posted in the best area, so please bare with me.

I have been tasked with finding some options for Incident Handling Automation/Orchestration tools for our SOC. I have no experience with these sort of tools and don't want to end up settling for something that's sub-par. I've had a few vendor presentations already and so far IBM's Resilient is taking the lead, but before I make my decision, I'd like to ask you guys for any other suggestions. Prefer to get some non-biased info instead of relying on their sites which always claim to be "the best." Environment is around 50K+ endpoints.

Thanx!

Re: Incident Handling Automation and Orchestration Suggestions Needed

markhust — Tue, 21 Nov 2017 05:23:07 GMT

good.

Re: Incident Handling Automation and Orchestration Suggestions Needed

Badfilemagic — Tue, 21 Nov 2017 11:46:42 GMT

We put CyberSponse in at a place I was at a few years ago after much looking around. I thought it was pretty good for incidenet management/handling and it had playbooks and some orchestration. I know the folks who started Phantom Cyber and for orchestrarion its definitely worth a look.

Re: Incident Handling Automation and Orchestration Suggestions Needed

dnn — Tue, 21 Nov 2017 15:40:35 GMT

Two more to check out if you have not already.

https://www.demisto.com/product-automated-incident-response/

https://www.fireeye.com/products/helix/top-5.html

Re: Incident Handling Automation and Orchestration Suggestions Needed

malte-wirz — Wed, 22 Nov 2017 08:31:51 GMT

I did a market review on Security Orchestration, Automation and Response Tools and can recommend the following:

IBM Resilient

Service Now Security Operations

Demisto

Also be advised that there is a new GARTNER report due soon: https://blogs.gartner.com/anton-chuvakin/2017/09/13/soar-research-coming-brace-for-impact/

Re: Incident Handling Automation and Orchestration Suggestions Needed

Acumen71 — Thu, 04 Oct 2018 21:40:23 GMT

I recently started using a new platform from LogicHub to automate SOC playbooks. I wrote a playbook to automate IOC's received from Google for GSuite Suspicious login alerts. I recommend the platform for SOC automation. We utilized SumoLogic as log aggregation and integrated Twilio for alerts and two way SMS communication. LogicHub has a growing list of integrations that are easy to use. SumoLogic has a list of existing API integrations that make integrated and triggering SIEM events relatively easy. With Sumo we also utilized CrowdStrike to score IP's.