For Security Operations (SECOPS)
Automate Detection and Response Actions
- Hook to observability tools such as Elastic, Prometheus, AppDynamics, Datadog, to execute a workflow in a 0-trust environment.
- Design playbooks with connectors and integrations or service calls
- Execute playbooks to detect and respond to threats alerted by SIEMs or other log sources
- Automatically create an incident ticket in an ITSM system
- Automate data enrichment and map them to case fields
- Hook to any system's or application's events to initiate a workflow
- Automate repetitive and tedious security tasks, scheduled or event-driven
- Routinely check for system's updates that are critical to be installed
- Initiate a workflow that hooks to HR systems and manages IAM lifecycle
For Managed Service Providers (MSSP)
The Cyberorxestra platform is ideal for MSSPs because it provides an end-to-end security automation solution that can be managed centrally but executed locally on each client network where there is a zero-trust protocol.
- Same benefits and advantages as for SECOPs;
- Manage playbooks centrally in a public ecosystem such as Azure or Amazon cloud while executing playbooks in the clients' private local systems;
- Integrate the with a client's local SIEM system that can request the cloud centralized SOAR platform for a playbook based on a threat, and have it executed on the local network;
- Schedule and execute any form security workflow that goes beyond SIEM/SOAR responsibility to meet a clients' needs on local networks;
- Hook to any system's or application's events to initiate a workflow.
Integration with a SIEM
Integrate with a SIEM and accelerate investigation and response by automating data enrichment and response actions. Visually create rules and conditions to query the SIEM and automate playbooks execution when conditions are met; Create incident tickets automatically when triggered.
Powered by Cyberorxestra's Workflow Platform
The out-of-the-box incident response tool offers all the functionality you need to create, track and resolve security incidents.
- Add rules, assignments, conditions, switches, states, transitions, loops and actions;
- Create clients, users, groups and business units;
- Create incident categories and types;
- Harmonize tagging for post-incident reporting;
- Prioritize incidents for quick action;
- Enable reconstructed timelines of actions taken, and support post-incident reviews;
- Create metrics and dashboards for reporting;
- Integrate to existing monitoring systems (AV, SIEM, ElasticSearch).