As soon as malicious traffic is detected entering your local network, or as soon as traffic to a malicious site is generated from your local network, you are automatically alerted. This alert is sent via email along with a diagnosis and recommendations for corrective actions.
Behind this seemingly simple process lies a cybersecurity acronym: SOAR. Here’s an explanation.
SOAR: Definition
The acronym SOAR (Security Orchestration, Automation, and Response) refers to technologies that protect IT systems against threats.
Integrated into our Reveelium tool
Reveelium is a behavioral analysis SIEM-UEBA technology that detects known and unknown cyber threats—including APTs (Advanced Persistent Threats), unknown malware, viruses, data leaks, and data theft—as well as abnormal behavior within information systems, and traces the origins of cyberattacks.
By combining AI, threat hunting, threat intelligence, and SOAR, Reveelium enables organizations to capitalize on events that may threaten their information systems and anticipate threats.
Practical example: generating, customizing, and sending the alerts you receive via email after malicious traffic is detected
-
Detection of Malicious Activity
Malicious traffic is identified using security tools such as a SIEM, an IDS/IPS, or a firewall. The alert generated by the security tool is forwarded to the SOAR platform.
-
Data Analysis and Enrichment
SOAR collects relevant information about the alert: traffic source, IP address, malicious domain, affected user or endpoint, etc.
SOAR queries threat intelligence databases to add details, such as the domain's reputation or information about associated malware.
-
Triggering the automated workflow
A predefined workflow in the SOAR is triggered automatically when an alert is received.
-
Email Generation and Customization
An email template was created in advance in the SOAR. It includes dynamic variables to customize the message (incident details, recommended corrective actions, etc.).
-
Sending the email
SOAR automatically identifies the relevant recipients based on defined rules. In this case, the email will be sent to the Freebox Pro customer.
Benefits of Using SOAR for This Process
- Reduced response times: Alerts are generated and transmitted in real time, enabling a rapid response.
- Consistency: Emails follow a standardized format, ensuring clear and consistent communication.
- Task automation: Reduced human intervention in processing and sending alerts: just a few minutes with SOAR, compared to 90 minutes before!
- Customization: The added contextual data allows for customization of the alert.
