STREAMLINING THREAT RESPONSE AND AUTOMATING CRITICAL USE CASES WITH SECURITY ORCHESTRATION, AUTOMATION AND RESPONSE (SOAR)

Abstract

Incident response (IR) is the process of detecting the existence of a threat and minimizing its impact. The incident response team needs to work proactively to defend the network against cyberthreats. Streamlining and automating the threat response process will achieve this goal and enhance the incident response workflow. Automating important use cases enables the incident response team to focus on the analysis and decision-making processes. The most common critical use cases in today’s cyberspace are brute-forcing, vulnerability management, port scanning, and phishing. Security orchestration and automation (SOAR) technology complements the existing technologies to provide continued security. This study is an implementation of an automated system that aims to facilitate incident response in Security Operations Centers (SOC). The project will streamline several critical uses ceases that would prevent phishing attacks, brute force attacks, port scanning, and detect vulnerabilities on Windows OS. This project is not just to generate an automated response but is focused on improving the response as optimally as possible. The automation responses are done in compliance with cyber security best practices.