41:02This recording is not available yet.
How to increase SOC efficiency with automatic incident detection and response
Download resourcesCategories
Security Operations & Incident ResponseDetection & HuntingIncident Response & ForensicsSecurity AutomationThreats & Threat Intelligence
Vendors and tools discussed
Sponsored by
About this session
Doron Davidson, founder of SecBI and now VP of global services at LogPoint after its acquisition, explains what security orchestration, automation and response (SOAR) is and how it lifts SOC efficiency. After a short company overview and thanks to partner GoSecure, he defines SOAR as a vendor-agnostic platform that combines workflow and collaboration, case management, playbook automation and threat-intelligence management, with the machine fetching and correlating data while the analyst makes decisions. He lists the SOC pain points it targets: alert overload, staff and knowledge shortages that playbooks address by codifying senior analysts' tribal knowledge, long manual investigations across dozens or even 130 point products, and increasingly automated, targeted attacks that evade single-source detection. Phishing is his flagship use case, since correlating mail gateway, web proxy and EDR telemetry both confirms the attack and drives response such as purging unopened copies and blocking users. A live demo shows two simple playbooks, failed-login triage with severity escalation and a password-spray investigation that returns affected users in seconds, with optional CrowdStrike containment. He closes with advice to automate only well-documented processes first, and notes that SOAR can compute MTTD, MTTR and per-analyst effectiveness for MSSPs.
The challenge of wading through billions of security events that constantly change in scope and nature is increasingly difficult. SOC analysts are faced with an overabundance of false positives and lack the tools to achieve results in required time frames. Attend this session to learn how LogPoint SOAR helps your team autonomously build investigations and accelerate response to threats to your infrastructure.
Key takeaways
- Automate only processes that are already well defined and documented; start with one or two use cases rather than trying to automate everything, which usually fails within weeks.
- Phishing is the first SOAR use case for most teams: correlate mail gateway, web proxy and EDR events to confirm the attack, then purge unopened copies and block affected users.
- Turn senior analysts' tribal knowledge into playbooks so the SOC operates at its most experienced level and junior staff learn from running them.
- Simple triage playbooks (failed logins, password spray) replace 30 to 60 minutes of manual querying with automatic severity scoring and a list of affected users.
- Let SOAR compute mean time to detect and respond, and per-analyst effectiveness, to find where training is needed and to prove threat-intelligence ROI.
Speakers
Doron Davidson
Doron has over 20 years of experience in IT security and telecommunications, leading him to coin the term “full scope incident”. Before starting SecBI, he held operational and P&L responsibilities for RSA’s EMEA professional security services… Read moreRead less
Doron has over 20 years of experience in IT security and telecommunications, leading him to coin the term “full scope incident”. Before starting SecBI, he held operational and P&L responsibilities for RSA’s EMEA professional security services practices. In this role, Doron worked with some of the world’s largest security teams and helped them to establish the systems and business processes at the heart of their incident response operations. He previously held product management and technical positions at Cyota, Beyond Security, Schema, and Amdocs. Doron led SecBI’s business development, and marketing. Doron has recently joined LogPoint as VP Global Services. Doron is a big believer in Stephen Covey’s seven habits and lectures on motivation. He is a CISSP and holds an MBA and a BSc in Computer Science.
Fun fact: In his spare time, Doron is a home brew master, producing beer with precision and innovative flavors.
