Upgrade Your SOC with Cortex XSOAR & Elastic SIEM

•

1 like•5,600 views

Together, Cortex XSOAR and Elastic SIEM deliver a flexible and effective solution for today's security operations teams. Combining Cortex XSOAR's robust orchestration, automation, and case management capabilities with Elastic's open collection, search, and analytics abilities provides the comprehensive end-to-end strategy SOC teams need to gain visibility to stop threats.

Technology

Cortex XSOAR
(previously Demisto)
Security Orchestration, Automation
and Response (SOAR)
David Hagy
Federal Cortex Manager

>10K alerts per week
Growing Alerts
Demisto Founded to address SOC challenges
”“Our response times are too long.
Every lost second leads to ﬁnancial
and reputational damage.” ”“Our security experts are
overwhelmed with the growing
number of alerts.” ”“I spend too much time switching
between products to effectively
respond to incidents.”
- CISO - SOC Manager - IR Analyst
2 million analysts shortage
Lack of Skilled Analysts
IR Process: no metrics/run
over email
No Consistent Process
Weeks to resolve
each detected incident
Long MTTR, High Risk

● Workﬂow automation engine
● Security ticketing system
● Collaboration platform
3 | © 2020 Palo Alto Networks, Inc. All rights reserved.
Demisto Delivered:
● Threat Intelligence Management
Cortex XSOAR Adds:
*The industry’s first extended security orchestration, automation
and response platform with native threat intel management

Cortex XSOAR is a workﬂow
automation engine
Respond to incidents with speed
and scale
● 100s of product integrations
● 1000s of security actions
● Intuitive, visual playbook editor
4 | © 2020 Palo Alto Networks, Inc. All rights reserved.

Before Cortex XSOAR
Lack of
deﬁned process
Disparate
alert sources
Repetitive and
manual actions
Lack of product
interconnectivity

After Cortex XSOAR
Standardized
and enforceable
processes
All alerts ﬂowing
into one console
Automated
high-quantity
actions
Cross-product
coordination

Cortex XSOAR is a security
ticketing system
Standardize process across
products, teams and use cases
● Ingest, search, and query
ALL security alerts
● Custom views by incident type
● Customizable dashboards &
reporting
7 | © 2020 Palo Alto Networks, Inc. All rights reserved.

Cortex XSOAR is a
collaboration platform
Improve investigation quality by
working together
● Virtual War Room for every
incident
● ChatOps & real-time security
actions
● Auto-documentation of
playbook & analyst actions
8 | © 2020 Palo Alto Networks, Inc. All rights reserved.

Threat intel feed ingestion
Analyst-driven manual
actions
SIEM Email Other
sources
ISAC Open source Premium Dark webCortex XDR
Playbook-driven
automated actions
Real-time
Collaboration
Alert ingestion
350+
Third-party tools SIEM Tools People SIEM Tools People
IOC
Prioritization
IOC
scoring
Search & IOC
matching
Case
Management
Automation &
Orchestration
BEFORE
API

350+
Third-party
tools
10 | © 2020 Palo Alto Networks, Inc. All rights reserved.
SEM Tools People API
SEM Cortex XDR Mail Other sources ISAC Open Source Premium AutoFocus
Playbook-driven automation
Alerts Threat Intel feeds
Automation &
Orchestration
Real-time
Collaboration
Case
Management
Threat Intel
Management
AFTER

Breadth of Cortex XSOAR integrations (400+ ….)
11 | © 2020 Palo Alto Networks, Inc. All rights reserved.
Analytics and SIEM
Threat Intelligence
Malware Analysis
Endpoint
Network Security
Authentication
Email Gateway
Ticketing
Messaging
Cloud

DBot: Force multiplier
for your analysts
Get smarter with each incident
DBot learns from historical actions
Suggest incident assignments
Identify experts for each type
of incident
Suggest commonly used commands
during investigation
Identify related and duplicate
incidents

Real-time
Collaboration
Case
Management
Automation &
Orchestration
Alert Ingestion
Automated
Playbook
Actions
Better Together
Data Ingest / Alerts

This presentation showcased live during the DNIF KONNECT meetup on 19th December 2019. We have our presenter: Ruchir Shah- Account Manager at DNIF, walk us through the importance of SOAR Some key points discussed during the meetup: -Understand, what is SOAR. -The problems a SOAR solution solves. -Real-time demo by DNIF expert on SOAR. Watch the full presentation here: https://www.youtube.com/watch?v=bCp-WAs6w5I

Need of SIEM when You have SOAR

Siemplify

Secure Access – Anywhere by Prisma, PaloAlto

Prime Infoserv

The purpose of the session is to ensure security on the rapidly scaled work from Home situations during the COVID-19 outbreak. The objective is to ensure that they can securely and rapidly connect to all of their applications, including SaaS, cloud, and data-center applications. The session will be delivered by Mohammad Faizan Sheikh, Channel Systems Engineer, India & SAARC for Palo Alto Networks..

SOC Architecture Workshop - Part 1

Priyanka Aash

SEIM-Microsoft Sentinel.pptx

AmrMousa51

SOAR and SIEM.pptx

Ajit Wadhawan

Falcon OverWatch Experts Hunt 24/7 To Stop Incidents Before They Become Breaches Is your IT security team suffering from alert fatigue? For many organizations, chasing down every security alert can tax an already overburdened IT department, often resulting in a breach that might have been avoided. Adding to this challenge is an increase in sophisticated threats that strike so fast and frequently, traditional methods of investigation and response can’t offer adequate protection. A new webcast from CrowdStrike, “Proactive Threat Hunting: Game-Changing Endpoint Protection Above and Beyond Alerting,” discusses why so many organizations are vulnerable to unseen threats and alert fatigue, and why having an approach that is both reactive and proactive is key. You’ll also learn about Falcon OverWatch™, CrowdStrike’s proactive threat hunting service that investigates and responds to threats immediately, dramatically increasing your ability to react before a damaging breach occurs. Download the webcast slides to learn: --How constantly reacting to alerts prevents you from getting ahead of the potentially damaging threats designed to bypass standard endpoint security --Why an approach that includes proactive threat hunting, sometimes called Managed Detection and Response, is key to increasing protection against new and advanced threats --How CrowdStrike Falcon OverWatch can provide 24/7 managed threat hunting, augmenting your security efforts with a team of cyber intrusion detection analysts and investigators who proactively identify and prioritize incidents before they become damaging breaches

introduction to Azure Sentinel

Robert Crane

Introduction - Trend Micro Deep Security

Andrew Wong

SOC and SIEM.pptx

SandeshUprety4

Security operation center (SOC)

Ahmed Ayman

How to Replace Your Legacy Antivirus Solution with CrowdStrike

CrowdStrike

THE TIME HAS COME TO REPLACE YOUR ANTIVIRUS SOLUTION Legacy AV products are failing to stop modern threats. That’s why AV replacement is a hot topic in the industry and why enterprises in every sector are looking for answers. As breaches continue to dominate the headlines, you need to know that there is a new approach that can close the wide security gap left by yesterday’s AV solutions. Defending against today’s sophisticated polymorphic threats requires new weapons and that’s just what the CrowdStrike Falcon Platform delivers. The key to this new approach is going beyond malware to addressing the most complex and persistent cyber threats at every stage of the kill chain. CrowdStrike does this by combining next-gen antivirus, endpoint detection and response (EDR), and a managed threat hunting service – all cloud-delivered with a single lightweight agent. In this CrowdCast, Dan Larson, VP, Product Marketing will discuss: --The typical challenges with legacy antivirus, from efficacy to complexity & bulky architecture --How CrowdStrike stands above competitive offerings by providing robust threat prevention leveraging artificial intelligence and machine learning --How Falcon’s lightweight sensor and cloud architecture dramatically reduces operational burden --How you can seamlessly migrate from legacy antivirus to CrowdStrike Falcon --Why CrowdStrike was positioned as a “Visionary” in the 2017 Gartner Magic Quadrant for Endpoint Protection Solutions and what it says about our standing as an effective AV replacement

Building a Cyber Security Operations Center for SCADA/ICS Environments

Shah Sheikh

Abstract: Modern day cyber threats are ever increasing in sophistication and evasiveness against Process Control Networks. Organizations in the industry are facing a constant challenge to adopt modern techniques to proactively monitor the security posture within the SCADA infrastructure whilst keeping cyber attackers and threat actors at bay. In this presentation we will cover the fundamental building blocks of building a SCADA cyber security operations center with key responsibilities such as Incident Response Management, Vulnerability and Patch Management, Secure-by-design Architecture, Security Logging and Monitoring and how such security domains drive accountability and act as a line of authority across the PCN.

Microsoft Azure Sentinel

BGA Cyber Security

IBM-QRadar-Corporate-Online-Training.

Avishek Priyadarshi

This IBM QRadar training is designed for security analysts, security technical architects, offense managers, network administrators, and system administrators using QRadar SIEM. IBM Security QRadar SIEM is a tech platform developed by IBM to provide a 360-degree overview of an organization’s security system. QRadar normalizes events that come from a security system’s log sources and correlates them according to certain rules configured in QRadar. IBM QRadar collects log data from an enterprise, network devices, host assets, operating systems, applications, vulnerabilities, user activities and behaviors. IBM QRadar performs real-time analysis of the log data and network flows to identify malicious activity so it could be stopped quickly, preventing or minimizing damage to an organization.

Vectra Concept Overview

Ilya O

Sqrrl and IBM: Threat Hunting for QRadar Users

Sqrrl

This joint webinar, in collaboration with IBM, offers a look at the industry leading Threat Hunting App for IBM QRadar. By combining the threat detection capabilities of QRadar and Sqrrl, security analysts are armed with advanced analytics and visualization to hunt for unknown threats and more efficiently investigate known incidents. Watch the training with audio here: http://info.sqrrl.com/sqrrl-ibm-threat-hunting-for-qradar-users

EDR vs SIEM - The fight is on

Justin Henderson

Many organizations and managed security providers are starting to move from SIEM, Security Information and Event Management, to EDR, Endpoint Detection and Response. The problem is this may not be the best decision for your organization. These technologies are similar but fundamentally different. This presentation also shares innovating ways to use your SIEM to catch the bad guys as well as learn some simple tricks for easing the burden of SIEM management.

Breach and attack simulation tools

Bangladesh Network Operators Group

With the focus on security, most organisations test the security defenses via pen-testing. But what about after the network has been compromised. Is there an Advance Persistent Threat (APT) sitting on the network? Will the defenses be able to detect this? This talk will discuss some of the open source tools that can help simulate this threat. So as to test the security defenses if an APT makes it onto the network.

FireEye Solutions

Prime Infoserv

Splunk Enterprise Security

Md Mofijul Haque

McAfee SIEM solution

hashnees

Security operations center-SOC Presentation-مرکز عملیات امنیت

ReZa AdineH

Cyber Security Trends Business Concerns Cyber Threats The Solutions Security Operation Center requirement SOC Architecture model SOC Implementation SOC & NOC SOC & CSIRT SIEM & Correlation ----------------------------------------------------------- Definition Gartner defines a SOC as both a team, often operating in shifts around the clock, and a facility dedicated to and organized to prevent, detect, assess and respond to cybersecurity threats and incidents, and to fulfill and assess regulatory compliance. The term "cybersecurity operation center "is often used synonymously for SOC. A network operations center (NOC) is not a SOC, which focuses on network device management rather than detecting and responding to cybersecurity incidents. Coordination between the two is common, however. A managed security service is not the same as having a SOC — although a service provider may offer services from a SOC. A managed service is a shared resource and not solely dedicated to a single organization or entity. Similarly, there is no such thing as a managed SOC. Most of the technologies, processes and best practices that are used in a SOC are not specific to a SOC. Incident response or vulnerability management remain the same, whether delivered from a SOC or not. It is a meta-topic, involving many security domains and disciplines, and depending on the services and functions that are delivered by the SOC. Services that often reside in a SOC are: • Cyber security incident response • Malware analysis • Forensic analysis • Threat intelligence analysis • Risk analytics and attack path modeling • Countermeasure implementation • Vulnerability assessment • Vulnerability analysis • Penetration testing • Remediation prioritization and coordination • Security intelligence collection and fusion • Security architecture design • Security consulting • Security awareness training • Security audit data collection and distribution Alternative names for SOC : Security defense center (SDC) Security intelligence center Cyber security center Threat defense center security intelligence and operations center (SIOC) Infrastructure Protection Centre (IPC) مرکز عملیات امنیت

Critical Capabilities for MDR Services - What to Know Before You Buy

Fidelis Cybersecurity

24/7 coverage and skills shortages for post breach detection and response are driving the need for Managed Detection and Response (MDR) Services. Analysts are predicting 15X growth for MDR services over the next few years as security leaders shift their focus from prevention to detection knowing attacks are evading existing defenses, often without malware by using macros and scripts. Managed services often use MDR marketing messages and this sometimes results in their security monitoring services not meeting expectations. Buyers must learn what to look for in an MDR solution to avoid falling into this trap.

Patch and Vulnerability Management

Marcelo Martins

SIEM Primer:

Anton Chuvakin

NXP'S-PORTFOLIO-FOR-ADDRESSING-IOT-SECURITY.pdf

ssuser57b3e5

Removing Security Roadblocks to IoT Deployment Success

Microsoft Tech Community

What's hot

Proactive Threat Hunting: Game-Changing Endpoint Protection Beyond Alerting

CrowdStrike

introduction to Azure Sentinel

Robert Crane

Introduction - Trend Micro Deep Security

Andrew Wong

SOC and SIEM.pptx

SandeshUprety4

Security operation center (SOC)

Ahmed Ayman

How to Replace Your Legacy Antivirus Solution with CrowdStrike

CrowdStrike

Building a Cyber Security Operations Center for SCADA/ICS Environments

Shah Sheikh

Microsoft Azure Sentinel

BGA Cyber Security

IBM-QRadar-Corporate-Online-Training.

Avishek Priyadarshi

Vectra Concept Overview

Ilya O

Sqrrl and IBM: Threat Hunting for QRadar Users

Sqrrl

EDR vs SIEM - The fight is on

Justin Henderson

Breach and attack simulation tools

Bangladesh Network Operators Group

FireEye Solutions

Prime Infoserv

Splunk Enterprise Security

Md Mofijul Haque

McAfee SIEM solution

hashnees

Security operations center-SOC Presentation-مرکز عملیات امنیت

ReZa AdineH

Critical Capabilities for MDR Services - What to Know Before You Buy

Fidelis Cybersecurity

Patch and Vulnerability Management

Marcelo Martins

SIEM Primer:

Anton Chuvakin

What's hot (20)

Proactive Threat Hunting: Game-Changing Endpoint Protection Beyond Alerting

introduction to Azure Sentinel

Introduction - Trend Micro Deep Security

SOC and SIEM.pptx

Security operation center (SOC)

How to Replace Your Legacy Antivirus Solution with CrowdStrike

Building a Cyber Security Operations Center for SCADA/ICS Environments

Microsoft Azure Sentinel

IBM-QRadar-Corporate-Online-Training.

Vectra Concept Overview

Sqrrl and IBM: Threat Hunting for QRadar Users

EDR vs SIEM - The fight is on

Breach and attack simulation tools

FireEye Solutions

Splunk Enterprise Security

McAfee SIEM solution

Security operations center-SOC Presentation-مرکز عملیات امنیت

Critical Capabilities for MDR Services - What to Know Before You Buy

Patch and Vulnerability Management

SIEM Primer:

Similar to Upgrade Your SOC with Cortex XSOAR & Elastic SIEM

NXP'S-PORTFOLIO-FOR-ADDRESSING-IOT-SECURITY.pdf

ssuser57b3e5

Removing Security Roadblocks to IoT Deployment Success

Microsoft Tech Community

Modern cybersecurity threats, and shiny new tools to help deal with them

Tudor Damian

With cybersecurity threats changing rapidly, we definitely need a new set of tools to be able to prevent and address them more efficiently: malware is becoming more complex and harder to detect, malicious insider attacks are on the rise and zero-day exploits make their way to the public much quicker than before. Join this session to see how Windows Server 2016 and Windows 10 can help organizations deal with this ever-changing security ecosystem by providing them with ways to better secure their environment and data. We’ll touch on topics such as malware & threat resistance, identity & access control, virtualization-based security, configurable code integrity, remote attestation and a few others.

Modern cybersecurity threats, and shiny new tools to help deal with them - T...

ITCamp

Lessons Learned Fighting Modern Cyberthreats in Critical ICS Networks

Angeloluca Barba

A presentation given in April 2019 in London during ICS Cyber Security Conference. I discuss an anonymized investigation conducted by our team to identify a real malware infection on a production network, the tools and techniques used to contain this threat and how to use threat intelligence and visibility to stay ahead of cyber adversaries. Asset visibility and network baselining Continuous network monitoring Threat intelligence ingestion Thorough incident response plans

CE Cybersecurity Trends and Strategies for Hosting in the Cloud

Case IQ

Why does security feel like the most frustrating challenge in government IT? In part, because security in a cloud-first, mobile-first world calls for new approaches. Data is accessed, used and shared on-premises and in the cloud–erasing traditional security boundaries. In this webinar, we’ll examine current trends in cybersecurity and some resulting strategy shifts that have the potential to greatly enhance public sector organizations’ ability to balance risk and access, better detect and respond to attacks and just make faster and more coordinated cybersecurity decisions overall. Finally, we’ll look at a common set of attacks occurring specifically in state and local government and steps you can take right now to help mitigate these. Join Dean Iacovelli, Director for Secure Enterprise at Microsoft, as he discusses current trends and strategies to mitigate your cybersecurity risk.

Cyber Defense Automation

♟Sergej Epp

Today, automation plays a larger role in cyber-security than ever before – for both sides, the attackers and the defenders. The escalation in volume and sophistication of attacks, constantly evolving cloud environments and transition to a remote workforce are putting additional pressure on organizations to transform Security Operations and Defense Centers. Since the advent of automation and ML/AI technologies and their promised impact to transform incident response processes and threat hunting capabilities, what lessons have we learnt in ‘fine tuning’ process flows and automations in SecOps? - Moving beyond the marketing hype, how is automation actually serving attackers and defenders today and what trends are happening here? - What are the lessons learned – the good, bad and ugly – in automating security operations processes? - Is there a right path to automation and what are the alternatives?

How to secure and manage modern IT - Ondrej Vysek

ITCamp

IT is changing faster and faster and users requires completely different approach – especially millennials. Microsoft reacts to these IT needs by introducing EMS – most complex security and management suite on the market. We will cover how to manage and secure user identity, devices and documents. Discussion will cover not only Microsoft’s operating systems but iOS and Androids as well. As traditional IT assets needs to be maintained as well, SCCM and cloud management can be combined very easily. Join us on this presentation to see today’s possibilities of IT.

A 2020 Security strategy for Health Care Providers

Feisal Nanji

How BlueHat Cyber Uses SanerNow to Automate Patch Management and Beyond

SecPod Technologies

It’s widely known that patch management is a major pain point for most businesses. IT teams struggle to keep systems patched and secure. Cyber-attacks are continuous and anti-virus protection alone isn’t effective. Cyber hygiene best practices need to be followed to keep organizations secure and to prevent security breaches. In this webinar, Chandrashekhar - SecPod’s Founder & CEO, Douglas Smith - BlueHat Cyber’s Senior Sales Director, and Greg Pottebaum - SecPod’s VP OEM & Strategic Alliances, demonstrate: - How to efficiently reduce the cyber-attack surface of your business - Simple strategies to improve your security management - How Blue Hat Cyber uses SanerNow to automate patch management and secure their customer’s endpoints Request a FREE Demo of SanerNow platform at: www.secpod.com About SecPod SecPod is an endpoint security and management technology company. SecPod (Security Podium, incarnated as SecPod) was founded in the year 2008. SecPod’s SanerNow platform and tools are used by MSPs and enterprises worldwide. SecPod also licenses security technology to top security vendors through its SCAP Content Professional Feed. Facebook: https://www.facebook.com/secpod/ LinkedIn: https://www.linkedin.com/company/secp... Twitter: https://twitter.com/SecPod Email us at info@secpod.com to get more details on how to secure your organisation from cyber attacks.

Io t security defense in depth charles li v1 20180425c

Charles Li

CIS 2015 How to secure the Internet of Things? Hannes Tschofenig

CloudIDSummit

Companies and researchers are exploring ways to make software and hardware development easier for the masses. Soon you will be able to build your own autonomous drone, create a sensor that assess the watering needs of your plants, and develop a cat tracking device with minimal coding and hardware skills. What is the place of security and privacy in this exciting development? Are we building the next generation of Internet security vulnerabilities right now? In his talk Hannes Tschofenig will highlight challenges with Internet of Things, what role standardization plays, and what contributions ARM, a provider of microprocessor IP, is making to improve IoT security.

OpenText Managed Extended Detection and Response (MxDR)

Marc St-Pierre

Uncover hidden risks and unknown threats in minutes, not days. A Managed Service that empowers your Security Operations with behavioral analytics that improves your Cyber Resilience. Features ability to ingest telemetry from endpoints, networks, clouds and other sources. Service that is 97% noise free, and simply not another altering service, by providing you with access to Threat Hunters, Incident Responders and Digital Forensic Investigators.

Cisco Security Presentation

Simplex

As the industry’s first Secure Internet Gateway in the cloud, Cisco Umbrella provides the first line of defense against threats on the internet, protecting all your users within minutes. Cisco Advanced Malware Protection offers global threat intelligence, advanced sandboxing and real-time malware blocking to prevent breaches while it continuously analyzes file activity across your network, so that you can quickly detect, contain and remove advanced malware. Presentation of Cisco Security Architecture and Solutions such as Cisco Advanced Malware Protection (AMP) and Cisco Umbrella during Simplex-Cisco Technology Session that took place at the Londa Hotel in Limassol on 14 March 2018.

TIG / Infocyte: Proactive Cybersecurity for State and Local Government

Infocyte

This webinar and presentation outlines the Infocyte HUNT threat detection and incident response platform, and how it enables state and local government organizations: - Reduce risk across local, off-network, and cloud IT assets - Expose and eliminate hidden cyber threats and vulnerabilities - Streamline your overall security operations - Achieve and maintain compliance Using Infocyte, TIG can provide their customers with cost-effective, easy-to-manage, and on-demand cybersecurity consulting services (e.g. compromise assessments, incident response) and managed security services (e.g. managed detection and response). Visit https://www.infocyte.com/ to learn more and request a demo, or request a cybersecurity risk assessment (Compromise Assessment) using the link below: https://www.infocyte.com/free-compromise-assessment/

Proactive Approach to OT incident response - HOUSECCON 2023

Chris Sistrunk

Cyber Crime Conference 2017 - DFLabs Supervised Active Intelligence - Andrea ...

DFLABS SRL

Ibm security overview 2012 jan-18 sellers deckArrow ECS UK

DDS Secure Intro

John Breitenbach

Elastic Security Brochure

Joseph DeFever

Similar to Upgrade Your SOC with Cortex XSOAR & Elastic SIEM (20)

NXP'S-PORTFOLIO-FOR-ADDRESSING-IOT-SECURITY.pdf

Removing Security Roadblocks to IoT Deployment Success

Modern cybersecurity threats, and shiny new tools to help deal with them

Modern cybersecurity threats, and shiny new tools to help deal with them - T...

Lessons Learned Fighting Modern Cyberthreats in Critical ICS Networks

CE Cybersecurity Trends and Strategies for Hosting in the Cloud

Cyber Defense Automation

How to secure and manage modern IT - Ondrej Vysek

A 2020 Security strategy for Health Care Providers

How BlueHat Cyber Uses SanerNow to Automate Patch Management and Beyond

Io t security defense in depth charles li v1 20180425c

CIS 2015 How to secure the Internet of Things? Hannes Tschofenig

OpenText Managed Extended Detection and Response (MxDR)

Cisco Security Presentation

TIG / Infocyte: Proactive Cybersecurity for State and Local Government

Proactive Approach to OT incident response - HOUSECCON 2023

Cyber Crime Conference 2017 - DFLabs Supervised Active Intelligence - Andrea ...

Ibm security overview 2012 jan-18 sellers deck

DDS Secure Intro

Elastic Security Brochure

More from Elasticsearch

An introduction to Elasticsearch's advanced relevance ranking toolbox

Upgrade Your SOC with Cortex XSOAR & Elastic SIEM

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Upgrade Your SOC with Cortex XSOAR & Elastic SIEM

Similar to Upgrade Your SOC with Cortex XSOAR & Elastic SIEM (20)

More from Elasticsearch

More from Elasticsearch (20)

Recently uploaded

Recently uploaded (20)

Upgrade Your SOC with Cortex XSOAR & Elastic SIEM