How security automation tools save the life of the analyst

Big data offers interesting insights in user’s behavior. It helps determine normal behavior of a specific user, but more importantly, abnormal behavior that requires immediate investigation. One could conclude big data is a true godsend for analysts. Unfortunately, the huge amount of data poses a big challenge. The spotit SOC registers up to 7 billion actions per month, or 2.679 per second! It’s impossible for analysts to handle them manually. That would impact the quality in a negative way. So the question is: how to deal with this?

Automation tools to the rescue

Security automation tools do much of the analyst’s work for them. As soon as an alert is registered, these tools will analyze the event. They determine the risk and corresponding priority. This way, the analyst can easily prioritize the most important and/or urgent alerts.

You’re probably wondering how an automation tool is able to determine the risk and priority of an event. Those tools work with scripts, developed by the spotit engineers. They determine points of recognition, like file names, users, certain actions, etc. By capturing these scripts and points of recognition, the automation tool can rank the priority list.

Unfortunately, developing those scripts is not a one-time task. The ever-changing environments lead to newly detected actions. It’s crucial for the spotit engineers to continuously optimize those scripts and add the new actions correctly.

Keep in mind not all customers work with the same tools. Each tool evaluates alerts differently. Those evaluations are sent to a central platform at spotit which transforms those risk assessments into a uniform assessment. Only than is the SOC analyst able to correctly prioritize the alerts.