SOC Automation is a Software-as-a-Service (SaaS) solution for SOC implementation and management that is fully integrated with Splunk Enterprise.
The SOC Automation solution includes everything needed to launch a SOC and successfully manage its day-to-day operations.
What is the value of SOC Automation?
The value of SOC Automation is that you don’t have to build or maintain your manual processes, since they are already built into the solution. This includes everything from configuration management, to alerting and event management, to reporting and dashboards.
This also means you can spend more time focusing on your threat intelligence program and doing what you do best, instead of building and maintaining a SOC infrastructure.
Why should a business consider SOC automation?
With SOC Automation, you can quickly launch a SOC and begin managing the entire process from day one. This includes configuration management, alerting, investigation, reporting, and dashboards, as well as integration with your existing security tools. This means you don’t have to build or maintain these manual processes, yet they are already built into the solution.
Let us discuss each of these below:
1. Configuration Management
Configuration management refers to the ability to manage the configuration of the SOC environment via a command-line interface (CLI). This allows users to configure every aspect of the SOC. For example, including user and groups permissions, alerting parameters, data storage, and more.
Configuration management also includes the ability to create new SOC instances in an automated fashion. This is possible by using an API that is built into each instance of the SOC; which controls all aspects of that instance.
2. Alerting
SOC Automation includes a comprehensive alerting solution that incorporates all alerts from your Splunk instances and other security tools and correlates them in a single search-based console. This allows you to quickly identify threats across your entire environment, regardless of what tool or source they came from originally.
3. Investigation
SOC Automation includes a real-time investigation console that allows you to investigate alerts either on your own or with the assistance of an analyst or SOC expert. With this solution, users can execute searches and view results in real-time, and drill down into the data to gather more information about threats.
4. Reporting & Dashboards
SOC Automation also includes a reporting module that provides pre-built reports covering several key metrics. Such as Top Users by Alerts, Top Searches by Alerts, Sessions per User using Splunk Search/Alert/Report Editor, Top Clients by Alerts, and Top Threats by Alerts.
Additionally, it provides real-time dashboards for team members, which can be for customization as necessary. For instance, to include additional metrics that are relevant to your organization’s needs and requirements.
5. Integration with Existing Security Solutions
SOC Automation includes some out-of-the-box integrations with solutions such as Splunk App for Malware Analysis (AMAs), Splunk App for Enterprise Security (ASE), Splunk App for Firewall (AFW), Splunk App for Windows Event Log Analysis (WLE), and Splunk App for SIEM (SIEM).
This means when users install these apps on their machine(s) along with the SOC automation app, they are automatically integrated with their existing Splunk instance; as well as other security tools they have in place.
