When your organization is on the verge of a breach, let’s remember what this actually means so you have the best chance possible to stop it. Regardless of how it’s done, after criminals gain access to your environment, they need time to make themselves at home and work towards a goal. This could mean setting up a ransomware detonation or gearing up for an account takeover, but either way they need time inside. In fact, according to this DarkReading article, the average global dwell time that an attacker is in an environment before detection has fallen to 24 days.
You could gather different perspectives on what’s happening during dwell time, but if you consider that the time attackers spend inside an environment continues to decrease — time is the most important factor in detecting breaches. The shorter the dwell time, the less time you have to detect attackers before something bad happens. To get a better idea about how organizations can increase SOC efficiency, so they’re prepared to quickly spot and stop attacks, we caught up with the AI research team at Vectra for a few tips. Let’s take a closer look at how AI can add some extra horsepower to your SOC.
Improve Alert Accuracy and Reduce False Positives
SOCs only have so much time in the day and really can’t afford to be bogged down with benign alerts, however, collecting the right data and having meaningful AI can pinpoint attacks and security events that require immediate attention. The recent Spotlight Report, Vision and Visibility: Top 10 Threat Detections for Microsoft Azure AD and Office 365 provides a detailed look at how collecting the right data along with AI-driven threat detections will identify activity by an adversary during events like a supply chain attack. AI is the most effective way to detect the difference between authorized user behavior and actions by an attacker — something that’s becoming much more difficult to identify as attackers continue to become more skilled.
Optimize Analysis-Based Investigations
Investigations can be a heavy lift for SOCs and generally consist of time-consuming manual processes that don’t provide a realistic approach to identifying attackers that have already bypassed perimeter controls. Again, time is the issue here because investigations require a board and specialized set of skills including the ability to analyze malware, logs, forensic packets along with being able to correlate massive amounts of data from a wide range of sources. In many cases, security event investigations can last hours while a full analysis of advanced threats can even take days, weeks or months. All of these investigation scenarios can be automated with meaningful AI including threat detection, reporting and triage functions typically performed by Tier-1 analysts, giving back valuable hours to perform other activities. Analysts also gain deeper, more meaningful context about malicious communications including details about specific attack behaviors and compromised host devices involved in attacks.
Automate Tedious, Labor-Intensive Threat Hunting
Threat hunting is another challenge that SOCs are tasked with, and one that’s certainly needed in today’s environment to stay ahead of attackers. AI can help you discover hidden attackers early and well before other tools or personnel know about their existence. For example, you could leverage AI to enhance account-based investigations, so analysts have the necessary details to identify the uses and actions of potentially compromised accounts or even track communications to help determine host devices that have specific domains or IPs. As is the case with other investigations, detection, reporting and triage functions typically performed can be fully automated.
Detect, Score and Prioritize High-Risk Threats
One of the quickest ways a SOC team can lose valuable hours is by sifting through all the different security tools and alerts that may or may not display the most pertinent information. When done right and utilizing AI for all the reasons listed above, SOCs receive prioritized information about threats that pose the highest risk such as any key assets that show signs of an attack or any abnormalities that need to be remediated. This greatly helps SOC teams prioritize where to spend their time.
Of course, the SOC is different in each organization, and these are just a few of the ways that AI can lend a hand and free up resources so your team can stay ahead of attackers and stop them before a breach occurs. As we’ve said, it all comes back to gaining back the most valuable asset you have when defending your environment — time.
To see how AI can lend a hand in your SOC, request a demo today!
___
This post was originally published on the Vectra blog.
