Insights for CISOs—Modernizing Security Operations Centers with Security Orchestration and Automated Response

Data breaches have risen in scale and complexity, and enterprises are investing in many solutions to address each new threat exposure. Often, such solutions operate in silos, generating alerts on multiple threat types. The security operations center (SOC) must handle and respond to each alert; when done manually, speed and accuracy suffer. SOCs confront huge workloads because of growing volumes of data and increasing numbers of devices, systems, and processes. The dearth of of qualified information security analysts only adds to the woes of a CISO.

Enterprise security orchestration and automation response (SOAR) solutions help to address these challenges. The process of bringing together disparate technologies, tools, processes, and people connected to security to achieve end-to-end coordination and improve incident response. Security orchestration tools help analysts collect data generated by various security tools, analyze that data, act on the analysis, and log results.

This publication provides insights for CISOs on the provider ecosystem, selection criteria, and benefits of implementing SOAR solutions. Going beyond security, solutions today provide business value. With case studies to illustrate how vendors are solving various problems for their clients, enterprise CISOs can decide what works best for them.

Vendors:
Rapid7
Phantom Splunk
Demisto Palo Alto
Swimlane
Sumo Logic
IBM Resilient
D3 Security
Trellix
Cisco
FortiSOAR
Tufin
Carbon Black VMWare
Ayehu (Resolve)
LogRhythm
ThreatConnect
Devo
Cyware
OpenText
Microsoft
Logsign

Author: Deepali Sathe