Security Automation Approach #1: Workflow

Intelligent Security Orchestration and Automation hexadite.com

Let’s Automate - Workflow

The workflow tool receives a phishing alert from a detection system.


Let’s Automate - WorkflowWorkflow tool retrieves data to give more context to alerts. Data on entities such as:

• URLs• Attachments• HTML email• Keywords



Workflow tool opens and assigns a ticket to an analyst based on pre-set rules



Ticket includes enriched alert data to assist in the manual investigation.



The analyst manually investigates and remediates the threat. • Review email• Analyze attachments, URLs, keywords• Determine who received the email, where it might

have been opened (Pivoting)• Manually remediate (ex. re-imaging a laptop ,

Deleting the email from the mailbox, blocking the sender?)


WorkflowWhat TimeReview email 10 minutesAnalyze attachments, URLs, and keywords 30 minutesAccess the endpoint 1 hourRemediate 30 minutesTOTAL 2 hours and

10 minutes

Security Automation Approach #1: Workflow

Technology

Transcript of Security Automation Approach #1: Workflow