Abstract: Various approaches are discussed for generation of SOAR playbooks using a variety playbook sources.

Abstract: Systems and methods for a machine-learning based approach for dynamically generating incident-specific playbooks for a security orchestration and automated response (SOAR) platform are provided. The SOAR platform captures information regarding execution of a sequence of actions performed by analysts responsive to a first incident of a first type. The captured information is fed into a machine-learning model. When a second incident, observed by the SOAR platform, is similar in nature to the first incident or the first type a recommended sequence of actions is generated based on the machine-learning model for use by an analyst in connection with responding to the second incident. In response to rejection of the recommended sequence by the analyst, revising the recommended sequence based on input provided by the analyst and storing the revised recommendation sequence in a form of a revised playbook for response to subsequent incidents that are similar to the second incident.

Abstract: Systems and methods for determining an efficiency score for an automation platform are provided. According to one embodiment, a first weight for each playbook of multiple playbooks of an automation framework and a second weight for each type of error of multiple types of errors that may cause execution of one of the multiple playbooks to fail are maintained. The first weight represents a relative importance of the playbook and the second weight represents an effort required to address the error. An efficiency score is calculated for execution of one or more playbooks of the multiple playbooks during a particular time period based on the first weight for each of the one or more playbooks and the second weight for each type of error observed during the particular time period. An indication of a health of the automation framework is then displayed based on the efficiency score.

Abstract: Systems and methods for facilitating secure and reliable communications among nodes of different tiers of a multi-tenant SOAR deployment are provided. According to one embodiment, data flow propagation within a hierarchy of nodes of the SOAR deployment is controlled. Responsive to creation of a record by a node: (i) when there exists a parent node in the hierarchy, setting a PID of the record to a TID of the parent node; otherwise, to a TID of the node; (ii) when there exists a child node in the hierarchy, setting a CID of the record to the TID of the child node; otherwise, to the TID of the node; and (iii) maintaining a set of propagation rules for the node relating to permissibility of propagation of the record within the hierarchy. During propagation of the record by the node, the PID and the CID of the record are updated.

Abstract: Systems and methods for a machine-learning based approach for dynamically generating incident-specific playbooks for a security orchestration and automated response (SOAR) platform are provided. The SOAR platform captures information regarding execution of a sequence of actions performed by analysts responsive to a first incident of a first type. The captured information is fed into a machine-learning model. When a second incident, observed by the SOAR platform, is similar in nature to the first incident or the first type a recommended sequence of actions is generated based on the machine-learning model for use by an analyst in connection with responding to the second incident. In response to rejection of the recommended sequence by the analyst, revising the recommended sequence based on input provided by the analyst and storing the revised recommendation sequence in a form of a revised playbook for response to subsequent incidents that are similar to the second incident.

Abstract: Systems and methods for a machine-learning based approach for dynamically generating incident-specific playbooks for a security orchestration and automated response (SOAR) platform are provided. The SOAR platform captures information regarding execution of a sequence of actions performed by analysts responsive to a first incident of a first type. The captured information is fed into a machine-learning model. When a second incident, observed by the SOAR platform, is similar in nature to the first incident or the first type a recommended sequence of actions is generated based on the machine-learning model for use by an analyst in connection with responding to the second incident. In response to rejection of the recommended sequence by the analyst, revising the recommended sequence based on input provided by the analyst and storing the revised recommendation sequence in a form of a revised playbook for response to subsequent incidents that are similar to the second incident.

Abstract: Systems and methods for determining an efficiency score for an automation platform are provided. According to one embodiment, a first weight for each playbook of multiple playbooks of an automation framework and a second weight for each type of error of multiple types of errors that may cause execution of one of the multiple playbooks to fail are maintained. The first weight represents a relative importance of the playbook and the second weight represents an effort required to address the error. An efficiency score is calculated for execution of one or more playbooks of the multiple playbooks during a particular time period based on the first weight for each of the one or more playbooks and the second weight for each type of error observed during the particular time period. An indication of a health of the automation framework is then displayed based on the efficiency score.

Abstract: Systems and methods for determining an efficiency score for an automation platform are provided. According to one embodiment, a first weight for each playbook of multiple playbooks of an automation framework and a second weight for each type of error of multiple types of errors that may cause execution of one of the multiple playbooks to fail are maintained. The first weight represents a relative importance of the playbook and the second weight represents an effort required to address the error. An efficiency score is calculated for execution of one or more playbooks of the multiple playbooks during a particular time period based on the first weight for each of the one or more playbooks and the second weight for each type of error observed during the particular time period. An indication of a health of the automation framework is then displayed based on the efficiency score.

Abstract: Systems and methods for facilitating secure and reliable communications among nodes of different tiers of a multi-tenant SOAR deployment are provided. According to one embodiment, data flow propagation within a hierarchy of nodes of the SOAR deployment is controlled. Responsive to creation of a record by a node: (i) when there exists a parent node in the hierarchy, setting a PID of the record to a TID of the parent node; otherwise, to a TID of the node; (ii) when there exists a child node in the hierarchy, setting a CID of the record to the TID of the child node; otherwise, to the TID of the node; and (iii) maintaining a set of propagation rules for the node relating to permissibility of propagation of the record within the hierarchy. During propagation of the record by the node, the PID and the CID of the record are updated.

Abstract: Systems and methods for determining an efficiency score for an automation platform are provided. According to one embodiment, a first weight for each playbook of multiple playbooks of an automation framework and a second weight for each type of error of multiple types of errors that may cause execution of one of the multiple playbooks to fail are maintained. The first weight represents a relative importance of the playbook and the second weight represents an effort required to address the error. An efficiency score is calculated for execution of one or more playbooks of the multiple playbooks during a particular time period based on the first weight for each of the one or more playbooks and the second weight for each type of error observed during the particular time period. An indication of a health of the automation framework is then displayed based on the efficiency score.

Abstract: Systems and methods for facilitating secure and reliable communications among nodes of different tiers of a multi-tenant SOAR deployment are provided. According to one embodiment, data flow propagation within a hierarchy of nodes of the SOAR deployment is controlled. Responsive to creation of a record by a node: (i) when there exists a parent node in the hierarchy, setting a PID of the record to a TID of the parent node; otherwise, to a TID of the node; (ii) when there exists a child node in the hierarchy, setting a CID of the record to the TID of the child node; otherwise, to the TID of the node; and (iii) maintaining a set of propagation rules for the node relating to permissibility of propagation of the record within the hierarchy. During propagation of the record by the node, the PID and the CID of the record are updated.

Abstract: Systems and methods for a machine-learning based approach for dynamically generating incident-specific playbooks for a security orchestration and automated response (SOAR) platform are provided. The SOAR platform captures information regarding execution of a sequence of actions performed by analysts responsive to a first incident of a first type. The captured information is fed into a machine-learning model. When a second incident, observed by the SOAR platform, is similar in nature to the first incident or the first type a recommended sequence of actions is generated based on the machine-learning model for use by an analyst in connection with responding to the second incident. In response to rejection of the recommended sequence by the analyst, revising the recommended sequence based on input provided by the analyst and storing the revised recommendation sequence in a form of a revised playbook for response to subsequent incidents that are similar to the second incident.

Abstract: Systems and methods for facilitating a mind map approach to a SOAR threat investigation are provided. A SOAR platform operatively coupled with a Security Operation Center (SOC) of a monitored network receives alert data pertaining to an incident. A mind map view is generated within a graphical user interface. The mind map view includes a primary node corresponding to the incident, one or more field nodes associated with the primary node, one or more action nodes based at least on one of the one or more field nodes. Each of the action nodes is associated with one or more dynamic actions selectable by an analyst. Responsive to selection of a dynamic action, at least one field node or a suggested actions associated with a corresponding action node is suggested by a machine-learning engine based on the selection. The mind map view is updated in real time to include the suggestion.

Abstract: Systems and methods for providing selective data-replication among nodes of a distributed multi-tenancy MSSP architecture for performing secure orchestration and automated response (SOAR) are provided. According to one embodiment a master SOAR node of an MSSP receives multiple messages via a secure router coupling a computing environment of the MSSP in communication with respective computing environments of multiple customers of the MSSP. The messages contain information regarding alerts relating to network infrastructure of the customers and the information is controlled by data sharing policies implemented by tenant SOAR nodes within the respective computing environments of the customers. Based on an investigation into an alert relating to a network infrastructure of a particular customer, the master SOAR node causes a workflow to be remotely executed by a tenant SOAR node within the computing environment of the particular customer.

Abstract: A method for creating snapshots and backups in a virtual computing environment is provided. The method includes writing application output of an application spanning one or more virtual machines as an application consistency group to a writeback cache, wherein the one or more virtual machines are implemented using one or more compute nodes and wherein the writeback cache is implemented in direct attached storage in the one or more compute nodes. The method includes pausing I/O (input/output) operations of the application and marking the pausing, in the writeback cache. The method includes resuming the I/O operations of the application, after the marking and dumping data, according to the marking, from the writeback cache to a data node, as a snapshot.

Abstract: A method for creating snapshots and backups in a virtual computing environment is provided. The method includes writing application output of an application spanning one or more virtual machines as an application consistency group to a writeback cache, wherein the one or more virtual machines are implemented using one or more compute nodes and wherein the writeback cache is implemented in direct attached storage in the one or more compute nodes. The method includes pausing I/O (input/output) operations of the application and marking the pausing, in the writeback cache. The method includes resuming the I/O operations of the application, after the marking and dumping data, according to the marking, from the writeback cache to a data node, as a snapshot.