Posted
Today’s post continues an ongoing series on Polarity Security Operations Center (SOC) use cases, demonstrating how Polarity helps you to see the story in your data without sacrificing thoroughness or speed.
Despite the power and promise of SOAR capabilities, the fact remains that operational impact awareness is still often left to humans. Just because one “can” automate an action, does not always translate to “should” take an action. Humans remain in the loop when containment and remediation actions have the potential to cause operational impacts to the business that may outweigh the benefit of containment or remediation actions.
Capabilities:
- SOAR playbooks are selected and run from the Heads-Up Display.
- The operational context needed to understand an assets criticality, connectivity and location are provided in the same field of view as the playbook trigger.
Noticed the highlighted text in the above images. You can see that Polarity’s computer vision recognized the text on screen, and in real-time while the analyst is working, it has provided contextual information for the highlighted data in the Overlay Window. This contextual information has been pulled from a variety of Polarity integrations, including Demisto and Phantom, allowing the analyst to immediately see how they could potentially resolve the issue.
As shown in the above diagram, the Polarity platform provides enrichment, awareness and the ability to launch a playbook right from the Heads Up Display. All the relevant data needed to make an immediate containment or remediation action is presented right in the HUD and when the analyst is ready to pull the trigger they can launch it right from the HUD. Again, it does not matter what tool they are using, Polarity brings the enrichment, contextual awareness and actionability all in a single place on whatever screen they are working on.
Real time contextual data and operational impact awareness in Polarity has several benefits including:
- Polarity helps ensure that an action enabled by a SOAR capability is a fully informed one.
- Operational impacts can be minimized or eliminated when analysts know what function an asset serves prior to launching containment and remediation actions.
- Environmental awareness is in the same field of view and the trigger to launch the action.
- SOAR investments can be fully realized and while reducing the potential for unintended consequences of playbook launch without operational impact awareness.
Meet the expert: Terry McGraw
Background: Terrence “Terry” McGraw is a retired Lieutenant Colonel from the United States Army and now serves as the President and principal consultant, of Cape Endeavors, LLC, with over 20 years of providing expertise in cyber security architectural design and operations in both commercial and government sectors.
Terry previously served as the Vice President of Global Cyber Threat Research and Analysis for Dell SecureWorks and President of PC Matic Federal. He retired from the United States Army in 2014 completing 27 years of service; the last 10 years of his Army career were leading key Cyber initiatives for the Army’s Network Enterprise and Technology Command, Army Cyber Command and the National Security Agency (NSA). He has multiple combat tours with his culminating assignment, serving as the Director of Operations, Task Force Signal Afghanistan, 160th Signal Brigade (FWD), providing all strategic communications infrastructure in the theater of operations.
Education: BA in History, MSA in Information Systems Engineering, and a graduate of the prestigious US Army School of Information Technology’s Telecommunication Systems Engineering Course.
Relevant Experience: Terry’s work in the Army leading and operating some of the world’s largest and most complex networks as well as 6 years as Vice President of Global Cyber Threat Research and Analysis for Dell SecureWorks providing managed cyber security services to over 4,000 commercial clients and leading it’s six Counter Threat Operations Centers gives him a deep and broad understanding of the Cyber Threat Landscape. His entire professional career has been in designing and managing resilient network architectures ensuring the operational readiness thereof.