The standard for dynamic responses to complex threats is evolving. Organizations are in dire need of advanced orchestration and automation capabilities to improve response times from hours to minutes. But what’s available on the market today?

Fortunately, industry pioneers are creating innovative solutions, based on real-world feedback and problems.

Incident Response Orchestration: People, Process and Technology

The IBM Resilient Security Orchestration, Automation, and Response (SOAR) Platform has set a new standard in a market it pioneered. IR orchestration capabilities were added to the platform years ago, arguably when the automatic threat feed lookups were added in 2013.

Automation, however, is just a component of orchestration. Doing automation well requires the ability to manage people, process and technology. (For more on this topic, Bruce Schneier, the chief technology officer at IBM Resilient, discusses security orchestration and IR on his blog.)

Agility, Intelligence and Sophistication

The next big step on IBM Resilient’s orchestration journey? The Resilient dynamic playbooks. These playbooks started with the rules functionality, which provides customers with the agility, intelligence and sophistication needed to contend with complex attacks. All of these capabilities and innovations offer customers the most advanced full orchestration platform that can enable a dynamic and accelerated response program.

The Resilient SOAR Platform now features:

• Visual workflows: Enables analysts to orchestrate IR with visually-built, complex workflows based on tasks and technical integrations.
• Incident visualization: Graphically displays the relationships between incident artifacts or indicators of compromise (IOCs) and incidents in an organization’s environment.
• Timers: Enables time-based rules in workflows for more proactive response and to support service level agreements (SLAs).
• Artifact workflows: Enables tools-to-tools automation workflows, while also allowing for people-centric tasks and approvals.
• Tasks and scripts: Adds in-platform scripting functionality to workflows, enabling in-platform automation.

Responding to cyberattacks is incredibly tough. Attacks that shift as they unfold, complicated technology environments and a growing skills gap all contribute to the challenge. These new features enable the full orchestration capabilities that customers need to address these challenges. Effectively coordinate people and technology throughout the response process, empowering your analysts to make intelligent decisions and act quickly.

Building a Next-Gen Response Function

Resilient customers are realizing significant benefits from these improvements in orchestration. For example, by automating triage and enrichment tasks, orchestration helps alleviate the skills gap. Instead of pivoting between tools, analysts can let Resilient do the grunt work and focus their energy on the investigation and response activities only they can complete.

Furthermore, by connecting Resilient with more than 100 different technologies, our customers are able to not only unlock additional value from these related systems but also demonstrate their value by relating it to incident activity.

These capabilities drive dramatic improvements in response times. For example, a large customer in the pharmaceutical business reduced the time it takes to obtain a forensics image from 84 minutes down to less than two by orchestrating the process.