product
- Line up
- Network Security: Trellix (formerly FireEye) Network Security
- Network Security: Trellix (formerly McAfee) Advanced Threat Defense
- Network Security: Trellix (formerly McAfee) Network Security Platform
- Endpoint: Trellix (formerly FireEye) HX
- Endpoint: Trellix (formerly McAfee) Mvision
- Endpoint: Trellix (formerly McAfee) Complete Data Protection
- Email Security: Trellix (formerly FireEye) Server Edition
- Email Security: Trellix (formerly FireEye) Cloud Edition
- Security Operations: Trellix (formerly FireEye) Helix
- Security Operations: Trellix (formerly McAfee) SIEM (Security Information and Event Management)
- Enhanced cloud governance: Trellix (formerly FireEye) Cloudvisory
- File Threat Protection in the Cloud: Trellix (Formerly FireEye) Detection On Demand
- File Security: Trellix (formerly FireEye) Malware File Storage Scanning
- Integrated Management Solution: Trellix (formerly FireEye) Central Management
- NDR Solution: Network Investigator (NI) / Packet Capture (PX)
Specifications/Technical Information
- Trellix (formerly FireEye) Technical Information
- Trellix (formerly FireEye) Specifications
- Network Security: Trellix (formerly FireEye) Network Security Technical Information
- Network Security: Trellix (formerly McAfee) Network Security Platform Technical Information
- Network Security: Trellix (formerly McAfee) Network Security Platform Specifications
- Network Security: Trellix (formerly McAfee) Advanced Threat Defense Technical Information
- Network Security: Trellix (formerly McAfee) Advanced Threat Defense Specification
- Email Security: Trellix (formerly FireEye) Server Edition EX Series Technical Information
- Email Security: Trellix (formerly FireEye) Server Edition EX Series Specifications
- Integrated Management Solution: Trellix (formerly FireEye) Central Management (CM) Series Specifications
- Security Operations: Trellix (formerly McAfee) SIEM (Security Information and Event Management) Technical Information
Security Operation ③ - What is SOAR (Security Orchestration and Automated Response)? ~ Realize a system where operators can concentrate on the work that should be done by "people" ~
What is SOAR?
In recent years, cyber threats such as targeted attacks have become more sophisticated, increasing the burden on security operations. The current situation is that the lack of human resources and skills for security engineers and IT personnel is becoming more serious, and they are approaching their limits both physically and mentally. As one of the solutions, the automation of security operations by SOAR (Security Orchestration and Automated Response) is attracting attention. SOAR is a security operation platform that works with various security products. With the introduction of SOAR, companies can obtain many benefits such as "automation of operations", "speeding up incident response", and "resolving lack of skills".
Basic functions of SOAR
SOAR products generally have the following features:
SOAR aims to create an environment in which these functions can be used in an integrated manner, and by autonomously executing security operations that were conventionally performed by humans, it is possible to focus on important tasks that can only be judged by humans. .
Effect of introducing SOAR
By introducing SOAR, companies will have the following advantages.
Reduction of operational load
Since it can automatically investigate a large number of alerts, determine the degree of impact and urgency, and respond to the initial response, it is possible to greatly improve the efficiency of operations. Nighttime and holiday correspondence can also be reduced, and the physical and mental burden on the person in charge can be reduced.
Speed up incident response
Works with endpoint threat protection EDR products to automatically enforce network isolation based on threat severity. When an incident occurs, it can be dealt with quickly, preventing the damage from spreading or becoming serious. It can also solve the problem of "initial response delays due to time differences with overseas bases," which is common in global companies.
Optimized use of human resources
By automating operations, it is possible to avoid concentrating work on specific individuals. It is possible to realize work style reform by reducing long working hours and working on holidays. You can redeploy highly skilled security personnel to more creative tasks and make better use of human resources.
Addressing skill shortages
Since knowledge can be shared using SOAR, uniform response is possible for anyone at any time. It can easily complement the skills of inexperienced human resources and lead to training, contributing to resolving the shortage of security human resources. You can solve the dependence of work and achieve standardization.
Summary
The introduction of SOAR brings multifaceted benefits to enterprises. In this era where work style reform is being encouraged, it is becoming very important to encourage the coexistence of machines and people and consider new security operations.
In the future, as cyberattacks become more sophisticated, the number of companies introducing SOAR will increase, and SOAR will become an indispensable part of security measures.
Please feel free to contact us if you are worried about security operations that are burdensome, or if you have an awareness of issues in the exhausted operation site.
Inquiry/Document request
In charge of Macnica Trellix Co., Ltd.
- TEL：045-476-2010
Mon-Fri 8:45-17:30
