Getting Connected to the CrowdStrike API
Today, we’re going to take a brief look at how to get connected (and authenticated) to the CrowdStrike API. This will enable us to avail of many of the below aspects of the CrowdStrike Falcon platform.
Splunk Automation Guide
We will explore and then automate search operations for a simple Threat Hunting example. We will then turn our learnings into a fully-fledged self-service internal tool for use by colleagues (or perhaps other teams in your organization).
Qualys Vulnerability Management Automation Guide
Let’s start by familiarizing ourselves with the Qualys VM/PC REST API. We will combine some simple steps into a more complex (but not complicated) outcome.
Deception Tech and Automated Incident Response
In the digital realm, we, as defenders, are too often on the back foot. We hunt for and react to an attacker’s movements, but what if we could direct them for a change and automate what happens next?
Continuous Security with Snyk
Continuous Improvement should imply 'Continuous Security', but is this really achievable? From a security operations perspective, the question then becomes, how do we automatically track, record, and address risk in near-real or Internet time?
Part 3 : Respond and protect with a multi-pronged automated approach
This is part 3 of a 3 part series on security automation for dealing with account compromise. Part 1 covers detection, part 2 looks at enrichment and case management, while part 3 tackles protection and response including prompting the user to acknowledge the incident via a side-channel.
Part 2 : Enrich alerts, avoid toil, and regain control during incidents
This is part 2 of a 3 part series on security automation for dealing with account compromise. Part 1 covers detection, part 2 looks at enrichment and case management, while part 3 tackles protection and response including prompting the user to acknowledge the incident via a side-channel.
Part 1 : Breaches are inevitable and early detection is crucial
This is part 1 of a 3 part series on security automation for dealing with account compromise. Part 1 covers detection, part 2 looks at enrichment and case management, while part 3 tackles protection and response including prompting the user to acknowledge the incident via a side-channel.
Phish.ly: Democratizing suspicious email analysis with Tines and urlscan
We’re excited to announce Phish.ly, a free service, built in partnership with urlscan, that allows security teams automate the analysis of suspicious emails. Our hope is that by automating this time-consuming, manual task, teams can refocus on more engaging, higher-impact work.
What to Consider when investing in Infosec Case Management
There are many challenges when trying to get teams to collaborate and work well together. Boundaries and barriers block progress. Effective and efficient communication is paramount (if not one of the most important things) and tools should strengthen and lubricate interactions rather than weaken or hinder them.