Palo Alto Systems survey data implies that SOC analysts is only able to handle 14% of alerts generated by security tools. Considering IDC data showing that many alerts are false positives,[1] the outcomes are foreseeable: Alerts get overlooked, analysts spend your time chasing false leads, and actual threats get missed.
Beyond initial prevention, most security tools are made to perform one key function: create and react to alerts. Servers create alerts. Routers create alerts. Firewalls create alerts. Anti-virus tools create alerts. Security teams will frequently setup alert-only policies - instead of block policies - for potentially dangerous processes the company uses regularly.
The hopeful assumption is the fact that analysts will review and catch any suspicious behavior according to individuals alerts. However this strategy falls apart rapidly when analysts begin to receive a large number of low-fidelity alerts each day. It’s worse these alerts originate from siloed security tools that offer little-to-no context about what’s really happening.
Alert fatigue reduction listing
When we eliminate alert-generating sensors and systems, we create security blind spots - yet an excessive amount of details are badly as no information whatsoever. We have to use technology in smarter methods to help solve problems without creating brand new ones. We still alerts, but we want better alerts. What this means is embracing the next concepts when thinking about your tools and procedures:
1. Automation
First, organizations can greatly enhance their alert triage process using automation. Palo Alto Systems believes that Tier 1 (alert triage) security operations can and really should be automated using SOAR technologies, designed to use predefined playbooks to automate response actions. For alert triage, these actions include analyzing a reminder, updating a situation if it is a known issue, opening a situation whether it isn’t a known issue, after which triaging the seriousness of the aware of send it for an analyst. Automating this method greatly reduces the amount of alerts analysts must react to, allowing analysts to invest their energy investigating issues instead of looking at logs.
2. Data stitching
Next, security teams has to start prioritizing integrated tools over siloed ones if they would like to improve visibility. For those who have seven different tools, each searching in a specific slice of the security infrastructure without speaking to one another, the various tools won’t have the ability to provide context that can help with threat hunting and investigations. You will not determine if a number of actions that appear benign by themselves are really being performed inside a sequence that could indicate an foe is in your body. Alternatively, you might spend an hour or so tracking a bit of adware and spyware that snuck past your EPP only to discover it had become blocked from your firewall.
A burglar platform with integrated abilities enables for much greater insight. Cortex Data Lake, for instance, connects endpoint, cloud, and network data together. This integration between security components provides Cortex XDR with the advantage of more enriched telemetry data (for faster analysis and threat hunting) and tainted alerts (to bar actions connected with past malicious behavior).
3. Machine learning
Finally, an EDR tool must have machine learning abilities that let it recognize patterns therefore it can learn and improve. Your EDR should tap into your (hopefully integrated!) data sources to carry on to refine its algorithms for generating high-fidelity, prioritized, specific alerts.
Cortex XDR delivers smarter detections
Cortex XDR has shown it offers the greatest mixture of high-fidelity alerts, what are most helpful for identifying threats, in addition to enriched, correlated telemetry logs for analysis and threat hunting. These kinds of alerts might help organizations stem the ton of false positives so their analysts can concentrate on investigating real threats.
An evaluation of EDR tools using realistic attack emulations in the APT 3 group with the MITRE ATT&CK lately discovered that Cortex XDR and Traps detected probably the most attack techniques of 10 endpoint recognition and response vendors. This evaluation provided among the industry’s first open and objective assessments from the true function and gratifaction from the EDR marketplace.
Using its default configuration throughout the MITRE test, Cortex XDR generated 20 realtime, specific alerts and 82 enriched telemetry logs. Inside a real deployment, customers can provide Cortex XDR much more visibility and context in to the behavior of potential threat actors by connecting additional network and cloud sensors into Cortex Data Lake. Which will further reduce false positives and improve identification of malicious behavior that could otherwise appear benign.
