In order to get a grasp on how to ease security incident management and response processes, there are terms to be clarified first. First of all, a security incident is the common name of an attack towards an organization’s cybersecurity system, network, or data in general. In addition, TechSlang also includes successful attacks within the term “incident”. Therefore, whether impactful or not, all types of attacks, violations, or exploitations can be described as security incidents.

The great Ricky Bobby from Talladega Nights once said, “If you ain’t first, you’re last.” Whether we’re talking about a NASCAR race or responding to a security alert, being able to quickly discover attacks and adversaries and respond rapidly is critically important to reducing risks and managing threats to your organization. How do we suggest you do that? With a SOAR (Security Orchestration Automation & Response) tool.

Organizations may use security orchestration, automation and response (SOAR) to streamline security operations in three main areas: threat and vulnerability detection, incident response, and security-operations automation. Teams may use automation to increase efficiencies and maintain control of IT security functions from a single platform. SOAR solutions also allow for process execution, performance gap analysis, and machine learning to aid analysts in intelligently accelerating operations.

Today I’m happy to share more about our partnership with Swimlane, which further reinforces our commitment to empowering security teams everywhere. Today’s security teams rely on the power of Elastic’s high-speed, cloud-scale analytics to solve their most complex and pressing security issues. Swimlane’s security automation platform provides a way for these same teams to accelerate and optimize their workflows for max efficiency and to solve SOAR use cases.

We all know the security industry mantra: it’s not a matter of if, but when and how we’ll be attacked. Recent reports of intrusion activity increasing fourfold in the last two years and a raft of alerts warning of a rise in attacks on schools, hospitals and healthcare providers, and critical infrastructure companies during the global pandemic have only reinforced this.

Despite the myriad pathways to initial access on our networks, phishing remains the single most popular technique for attackers. The open nature of email and our reliance on it for communication make it difficult for defenders to classify messages, so it is no surprise that suspicious email investigation is a top use case for automation. Today, we are releasing a new community playbook for Splunk SOAR (previously Splunk Phantom) to help enrich suspicious email events.

On the heels of announcing the closing of $22.5 million in new financing as a result of strong performance in 2020, I’m proud of our team’s latest innovation that we’re announcing today, ThreatQ TDR Orchestrator is a new data-driven approach to SOAR and XDR that accelerates threat detection and response across disparate systems for more efficient and effective security operations.

The investment in security operations is at an all-time high. AustCyber’s ‘Australia’s Cyber Security Sector Competitiveness Plan’ shows spend on security operations makes up more than 40% of all cybersecurity spend ($1.58B in 2018), with cyber spending growth outpacing IT spending growth by nearly two to one.