Security Automation Using Shuffle
Every day, the average security operations team receives over 11,000 security alerts (https://start.paloaltonetworks.com/forrester-2020-state-of-secops.html), including suspicious activity, intrusion attempts, privileged user and account monitoring, abnormal external communication, and unauthorized access attempts.
The majority of an analyst’s time (almost 70%) is spent investigating, triaging, or responding to alerts, and the majority of these alerts must be processed manually, greatly slowing down a company’s alert triage process. According to the same report, about 33% of these alerts turn out to be false positives. An SOC analyst can get frustrated with this overwhelming number of security alerts and repetitive false positives. This leads to the need for security automation, and this is where SOAR (Security Orchestration and Automation Response) plays a critical role. SOAR is a set of security features that enables businesses...