{"id":3270,"date":"2021-01-19T14:38:11","date_gmt":"2021-01-19T18:38:11","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=3270"},"modified":"2021-01-19T14:38:11","modified_gmt":"2021-01-19T18:38:11","slug":"running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/","title":{"rendered":"Running in Sand: How to Avoid Getting Stuck at the Onboarding Stage"},"content":{"rendered":"

\"Running<\/p>\n

Often, when we speak of onboarding in a cybersecurity context, we use an identity management lens. However, this isn\u2019t the only lens we can or should use. In fact, onboarding and using response tools to facilitate it proves an essential topic for businesses.\u00a0<\/span><\/p>\n

As such, we present this article by Sivan Omer of <\/span>empow<\/span><\/a>, who describes how onboarding, response, and XDR<\/a> all interconnect.\u00a0<\/span><\/p>\n


Widget not in any sidebars
<\/span><\/p>\n

Running in Sand. How to Avoid Getting stuck at the Onboarding Stage with Response Tools<\/b><\/h2>\n

By Sivan Omer, Director of Product Management, <\/span><\/i>empow<\/span><\/i><\/a><\/p>\n

Response is all that everyone seems to be talking about in the cybersecurity arena these days, specifically automated response. Security Orchestration, Automation, and Response (SOAR) tools are being bought up by Security information and event management (SIEM) vendors, while Extended Detection and Response (XDR) solutions are popping up like mushrooms after the rain<\/span><\/p>\n

So, what about XDR? Is it indeed shaping up to be the best choice for automated response? Vendors today seem to be big on promises but still quite low on performance and innovative technology.<\/span><\/p>\n

The Onboarding Bottleneck in Response Tools\u00a0<\/b><\/h3>\n

We recently asked security professionals (and a shout-out to Kate at <\/span>SecurityBrew<\/span><\/a> for the survey) how long it typically takes them to [conduct an] onboard response. Over 50 percent of respondents said it took them over 4 months, and only 6 percent were able to do so in less than a month. How can that be in this day and age where 30 seconds is a long time?<\/span><\/p>\n

The fault lays in the way vendors approach response playbooks. A predefined playbook needs the SOC team to adapt it according to the needs and requirements of the organization. It is a cookbook with explicit directions and static instructions that attempts to define best practices. This task can only be successfully undertaken by skilled cybersecurity specialists who specialize in cyber threats and incident response and are also familiar with their organization\u2019s network topology and policies. The shortage of skilled security analysts in the market, and the complexity of this task, means that even if you buy the best response tool out there, it will be months before you will see real value from it.<\/span><\/p>\n

Not only that, but every time you need to integrate a new tool (Email Protection, EDR, TI, etc.), or update the playbook policy to support additional use cases, things start all over again \u2013 configuration, manual playbook writing\u2026 the lot. It\u2019s like running in the sand \u2013 very tiring and not a lot of fun.<\/span><\/p>\n

The cybersecurity world is extremely dynamic. Anyone \u2013 and any system \u2013 relying on static playbooks will likely be left behind, trying to clean up the damage after a cyber-attack has already occurred. In all the stages of the cyber chain \u2013 from detection to prioritization, investigation to mitigation, remediation, and documentation of the whole process – proactivity should be used wherever possible. The only way to win this never-ending battle is through a dynamic and flexible cybersecurity platform.<\/span><\/p>\n

What to Ask XDR Vendors<\/b><\/p>\n

When selecting an XDR solution, the main thing to check is that the automation that is promised is not just a reposition of existing technology, but rather capabilities with substance, that will be able to run quickly, effectively, and autonomously. Here are some questions that can help you better assess XDR tools and vendors:<\/span><\/p>\n

    \n
  1. How long does it typically take organizations to onboard your response tool?<\/span><\/li>\n
  2. How much manual configuration is required on the part of the analyst to onboard the response tools?<\/span><\/li>\n
  3. How much time and effort is required to integrate it with new applications?<\/span><\/li>\n
  4. What specific tasks are automated, and which still require manual configuration?<\/span><\/li>\n
  5. What automation algorithms form the backbone of the solution (look for technologies such as Artificial Intelligence (AI), Natural Language Processing (NLP), Belief and Bayesian Networks (BBN) algorithms, User Entity Behavior (UEBA), Network Traffic Analysis (NTA), and Threat Intelligence (TI) engines).<\/span><\/li>\n
  6. Can the playbook run on an \u201centity\u201d (which includes multiple threat types), or on an \u201cattack campaign\u201d (which can include multiple entities and risk as part of the same campaign) at once, rather than per alert?<\/span><\/li>\n
  7. Does the playbook adapt to the context of attack that triggers it, beyond the statically defined rules in the playbook?<\/span><\/li>\n
  8. Does the playbook include preventive response actions?<\/span><\/li>\n<\/ol>\n

    Getting concrete answers to these questions will take you past empty promises and weed out the response tools that can bring you real value, from the rest of the field.<\/span><\/p>\n

    <\/div>\n

    Sivan Omer of <\/span>empow<\/a> for this article. To learn more, check out the Solutions Review Buyer’s Guide for SIEM<\/a> or for SOAR<\/a>. You can also register for an upcoming Jan.26th webinar<\/a> hosted by empow.\u00a0<\/span><\/p>\n


    Widget not in any sidebars
    <\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

    Often, when we speak of onboarding in a cybersecurity context, we use an identity management lens. However, this isn\u2019t the only lens we can or should use. In fact, onboarding and using response tools to facilitate it proves an essential topic for businesses.\u00a0 As such, we present this article by Sivan Omer of empow, who […]<\/p>\n","protected":false},"author":41,"featured_media":2774,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[551,1],"tags":[353,95,1313,86,1481,21,57,22,1376],"acf":[],"yoast_head":"\nRunning in Sand: How to Avoid Getting Stuck at the Onboarding Stage<\/title>\n<meta name=\"description\" content=\"We present this article by Sivan Omer of empow, who describes how onboarding, response, and XDR all interconnect in cybersecurity.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Running in Sand: How to Avoid Getting Stuck at the Onboarding Stage\" \/>\n<meta property=\"og:description\" content=\"We present this article by Sivan Omer of empow, who describes how onboarding, response, and XDR all interconnect in cybersecurity.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/\" \/>\n<meta property=\"og:site_name\" content=\"Best Information Security SIEM Tools, Software, Solutions & Vendors\" \/>\n<meta property=\"article:published_time\" content=\"2021-01-19T18:38:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/09\/Certification-Mod.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"401\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ben Canner\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ben Canner\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/\",\"name\":\"Running in Sand: How to Avoid Getting Stuck at the Onboarding Stage\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/09\/Certification-Mod.jpg\",\"datePublished\":\"2021-01-19T18:38:11+00:00\",\"dateModified\":\"2021-01-19T18:38:11+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\"},\"description\":\"We present this article by Sivan Omer of empow, who describes how onboarding, response, and XDR all interconnect in cybersecurity.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/09\/Certification-Mod.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/09\/Certification-Mod.jpg\",\"width\":800,\"height\":401,\"caption\":\"Palo Alto Networks Announces Plan to Acquire Bridgecrew\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Running in Sand: How to Avoid Getting Stuck at the Onboarding Stage\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\",\"name\":\"Best Information Security SIEM Tools, Software, Solutions & Vendors\",\"description\":\"Buyer's Guide and Best Practices\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\",\"name\":\"Ben Canner\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"caption\":\"Ben Canner\"},\"description\":\"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/author\/bcanner\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Running in Sand: How to Avoid Getting Stuck at the Onboarding Stage","description":"We present this article by Sivan Omer of empow, who describes how onboarding, response, and XDR all interconnect in cybersecurity.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/","og_locale":"en_US","og_type":"article","og_title":"Running in Sand: How to Avoid Getting Stuck at the Onboarding Stage","og_description":"We present this article by Sivan Omer of empow, who describes how onboarding, response, and XDR all interconnect in cybersecurity.","og_url":"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/","og_site_name":"Best Information Security SIEM Tools, Software, Solutions & Vendors","article_published_time":"2021-01-19T18:38:11+00:00","og_image":[{"width":800,"height":401,"url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/09\/Certification-Mod.jpg","type":"image\/jpeg"}],"author":"Ben Canner","twitter_misc":{"Written by":"Ben Canner","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/","url":"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/","name":"Running in Sand: How to Avoid Getting Stuck at the Onboarding Stage","isPartOf":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/09\/Certification-Mod.jpg","datePublished":"2021-01-19T18:38:11+00:00","dateModified":"2021-01-19T18:38:11+00:00","author":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541"},"description":"We present this article by Sivan Omer of empow, who describes how onboarding, response, and XDR all interconnect in cybersecurity.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/#primaryimage","url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/09\/Certification-Mod.jpg","contentUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/09\/Certification-Mod.jpg","width":800,"height":401,"caption":"Palo Alto Networks Announces Plan to Acquire Bridgecrew"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/running-in-sand-how-to-avoid-getting-stuck-at-the-onboarding-stage\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/security-information-event-management\/"},{"@type":"ListItem","position":2,"name":"Running in Sand: How to Avoid Getting Stuck at the Onboarding Stage"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website","url":"https:\/\/solutionsreview.com\/security-information-event-management\/","name":"Best Information Security SIEM Tools, Software, Solutions & Vendors","description":"Buyer's Guide and Best Practices","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541","name":"Ben Canner","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","caption":"Ben Canner"},"description":"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.","url":"https:\/\/solutionsreview.com\/security-information-event-management\/author\/bcanner\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/3270"}],"collection":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/users\/41"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/comments?post=3270"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/3270\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media\/2774"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media?parent=3270"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/categories?post=3270"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/tags?post=3270"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}