LogRhythm Customers Adopt Embedded SOAR Capabilities up to 3X Faster than Market Alternatives
October 30, 2018
Opportunity to improve workflow efficiency and security maturity boosts
customer adoption of NextGen SIEM Platform’s embedded playbook features
and SOC performance metrics
BOULDER, Colo.–(BUSINESS WIRE)–LogRhythm,
the Security Intelligence Company, announced today that a recent survey
of its customers found that 33 percent of them have adopted the
company’s embedded security orchestration, automation and response
(SOAR) capabilities. This rapid adoption rate far exceeds Gartner’s 2018
estimate that standalone SOAR products have been adopted by less than
one percent of security organizations with five or more security
professionals, an adoption rate expected to reach only 15 percent by
2020.1
The embedded SOAR features in LogRhythm’s NextGen
SIEM Platform provide security teams with customizable workflows and
controls to streamline and accelerate the investigation and
neutralization of qualified cyberthreats. LogRhythm’s end-to-end
platform provides insights into how to improve security operations
center (SOC) performance. With clear, trackable metrics, security
leaders can quickly identify and address potential areas for improvement
to increase the efficiency and effectiveness of their security
operations teams. These performance metrics also enable security leaders
to prove and quantify the overall business value driven by their teams.
“In cybersecurity, automation and orchestration is becoming more and
more important,” said Rob Haller, information systems security engineer
at US Acute Care, a national leader in physician-owned integrated acute
care. “That’s why we use LogRhythm’s NextGen SIEM Platform. Its
SmartResponse™ feature and back-end API connections allow us to automate
common actions, while LogRhythm’s case management and playbooks allow us
to standardize our investigation methods and responses, adding speed,
reliability and consistency to our security practice.”
Three new features of LogRhythm’s most recent 7.4 software release
empower security teams to implement effective, end-to-end security
operations workflows: Case Playbooks, SmartResponse automation actions
and SOC metrics. Building on the existing case management and automation
framework of LogRhythm’s NextGen
SIEM Platform, these new capabilities enable security teams to
deliver consistent, measurable results for threat investigation and
neutralization:
-
Case Playbooks, native within the platform, give
resource-strapped security teams the ability to deliver consistent
results with greater confidence. Playbooks capture institutional
process methodology, senior analyst knowledge and best practices into
easy-to-follow procedures for all analysts — even those that are new
to the team or less experienced. Deadlines and due dates are
auto-populated to ensure consistent cadences for workflow. Prebuilt
Case Playbooks, available out of the box, can be easily customized.
Security teams can also create new playbooks to meet the unique needs
of their organizations and integrate them with third-party incident
response systems / runbooks. Whether for a team of one or many,
LogRhythm’s embedded playbooks provide greater speed, efficiency and
consistency when responding to different threat types — even those not
seen previously. -
Automated response actions drive best-practices and consistency
in incident response and can be activated to perform repetitive and
mundane tasks, enabling security teams to drive faster and more
efficient threat qualification and neutralization. LogRhythm’s
Community site hosts a growing library of SmartResponse plugins,
providing over 100 automated and semi-automated actions, including
actions developed by LogRhythm Labs, by the LogRhythm user community
and in partnership with LogRhythm’s Technology Alliance Partners.
LogRhythm’s automated contextual lookups enable rapid collection of
third-party threat intelligence and other contextual information,
expediting threat investigation. These lookup actions do not require
outside script development, allowing analysts of varying skill levels
and experience to be immediately effective. Out-of-the-box automations
also include triggering vulnerability scans, conducting URL link
analysis, performing memory dumps, resetting passwords, disabling
users and adding IPs/FQDNs to blacklists, among others. -
SOC metrics accelerate an organization’s overall security
maturity by delivering actionable information about the speed and
efficiency of threat qualification, investigation and response
processes. Security teams can collect and view key metrics from their
LogRhythm deployment to better understand their mean time to detect
(MTTD) and mean time to respond (MTTR) to threats. More granular
measurements, such as time to qualify (TTQ) and time to investigate
(TTI), help analysts understand workflow effectiveness. These
performance metrics help uncover opportunities to improve operational
efficiency, including identifying tasks better suited for automation,
and enable security leaders to measure and report on the effectiveness
of their security programs.
“LogRhythm’s 7.4 software release demonstrates its continued momentum
forward as an innovator in the SIEM arena,” said Michael Suby,
Stratecast VP of Research at Frost & Sullivan. “By developing repeatable
SOC practices embedded within a NextGen SIEM Platform, organizations are
enabled to consistently mature their overall security posture and
leverage their workflow metrics to add assurance that the maturation
process is performed efficiently and effectively.”
“Speed is the name of the game when it comes to SOAR. Our 7.4 release
adds functionality to our existing capabilities that further accelerates
and optimizes time spent by security operations teams. Our Case
Playbooks help teams quickly and consistently execute standard tasks and
actions to support threat investigation and incident response,” said
Chris Petersen, co-founder and chief product and technology officer at
LogRhythm. “More than 45 new automation actions return valuable
cognitive cycles to security analysts and reduce the need to perform a
myriad of manual tasks. And, SOC managers can more easily monitor the
active workloads of their teams to quickly report results and risk to
the business.”
About LogRhythm
LogRhythm is a world leader in NextGen SIEM, empowering organizations on
six continents to successfully reduce risk by rapidly detecting,
responding to and neutralizing damaging cyberthreats. The LogRhythm
platform combines user and entity behavior analytics (UEBA), network
traffic and behavior analytics (NTBA) and security orchestration,
automation, and response (SOAR) in a single end-to-end solution.
LogRhythm’s Threat Lifecycle Management (TLM) framework serves as the
foundation for the AI-enabled security operations center (SOC), helping
customers measurably secure their cloud, physical and virtual
infrastructures for both IT and OT environments. Built for security
professionals by security professionals, the LogRhythm platform has won
many accolades.
For more information, visit logrhythm.com.
1 Gartner “Innovation Insight for Security Orchestration,
Automation and Response,” published Nov. 30, 2017
Contacts
For LogRhythm
Jenny Overell, 415-249-6778
Jenny.Overell@finnpartners.com