Expanding The Response and The Advanced Automated Threat Hunting with Open DXL
Today every person is talking about the automation of security. However, what are the right actions and processes to automate safely? What are the right actions and processes to automate that will actually achieve some outcome of the security, such as improving the efficiency of sec ops or reducing attacker dwell time? Just look in the newest industry report and you will definitely find a statistic about how much long attackers actually linger in a particular network without detection. It is getting much better, but the average is still majorly in favor of the attacker. One of the reasons why all the attackers are so successful at maintaining the entire persistence is that most companies struggle to make much effective use of threat intelligence. Making much effective use means taking the volumes of threat intelligence data, Indicators of Compromise (IOCs) that are primarily technical, hunting for affected computer systems with those IOCs, and then adapting various countermeasures ...