Advanced SOC Operations / CSOC , Next-Generation Technologies & Secure Development , Security Information & Event Management (SIEM)

Detox Your SOC

Even after implementing SOAR, SIEM, IDPS and other technologies to improve security insights, companies still spend thousands of hours triaging alerts that are mostly false positives. Given the ever-increasing volume of alerts, SOC teams are forced into a "do what you can do" strategy that focuses on high-value, high risk assets, tuning alert thresholds to reduce alert volume, and ignoring certain types of alerts.

However, Richard Henderson, Lastline's Head of Global Threat Intelligence, cautions that these practices put an organization at greater risk for the loss of data, customers, and reputation. He shares details of a better approach that automates threat detection and response, including:

• AI that distinguishes between benign and malicious behavior to dramatically reduce false positives
• High-fidelity alerts with relevant context and linkage with data from across the network
• Real-time collaborative threat intelligence to protect against evolving threats
• Automated response enabled by accurate detection and integration with existing tools