X

D3 NEXTGEN SOAR — INTEGRATION WITH STELLAR CYBER

BRING TOGETHER THE POWER OF OPENXDR AND NEXTGEN SOAR

D3 Security is the leading independent provider ofsecurity orchestration, automation, and response(SOAR) software. D3 NextGen SOAR integrates
with 500+ tools to ingest alerts, assess their risk,
and automate response across the entireenvironment.
Stellar Cyber’s Open XDR platform delivers
eXtended Detection and Response by ingestingdata from all tools, automatically correlating alerts
into incidents across the entire attack surface,delivering fewer and higher-fidelity incidents, andresponding to threats automatically through AIand machine learning.
D3 NextGen SOAR’s integration with Stellar Cyber
Open XDR multiplies the investigation andresponse power of each platform, breaking down
tool silos and integrating across the stack. MSSPs
and internal security teams use D3 and Stellar
Cyber to create automated workflows for alert
detection, analysis, and response.

BETTER TOGETHER
The combined power of AI-driven
Open XDR and next-generation SOAR
Higher-fidelity security incidents that
reduce wasted time, eliminate repetitive
tasks, and slash MTTR
More efficient security workflows achieved
through deep integrations with a wide
range of tools
Clearer visibility across the entire attack
surface, through Stellar Cyber’s threat
detection and D3’s TTP dashboard
Increased value from existing tools
investments

INTEGRATION FEATURES
Escalate incidents from Stellar Cyber to
D3 for further analysis and response

Playbook

Search Stellar Cyber’s wealth of security
data from D3
Correlate threat intelligence against IOCsin both platforms
Update Stellar Cyber incidents with theresults of D3 investigations

SAMPLE USE CASE #1:

Incident Escalation and Response
Challenge
Stellar Cyber Open XDR collects data from disparate
security tools and data sources, using AI-powered
analysis and correlation to create high-fidelity
incidents for genuine threats. Many incidents can beresolved directly via Stellar Cyber’s automatedresponse capabilities. However, major incidents will
benefit from the further investigation and response
orchestration capabilities of SOAR.

Solution
When a high-fidelity incident in Stellar Cyber
requires escalation, it can be pulled into D3 NextGen SOAR. Like Stellar Cyber, D3 also distinguishes between the alert and incident level, so theingested incident stays as an incident in D3, with allof the high-fidelity data retained, including MITRE
ATT&CK TTPs and AI-based risk scoring. D3 parses
the IOCs from the incident and correlates themagainst past incident data, integrated threat
intelligence sources, and data from integrated
security tools.
Based on the incident data from Stellar Cyber andthe added context from D3, the user can thentrigger an incident-specific automation-powered
playbook to remediate the threat. The D3 playbook will orchestrate response actions such asquarantining endpoints, updating firewall rules,
deleting malicious emails from inboxes, and more.
The TTPs involved will also be mapped against
D3’s integrated MITRE ATT&CK dashboard. Whenthe response is complete, the D3 playbook will
update the incident in the Stellar Cyber platform,
where the user can close the incident or carry out
additional actions.

OutcomeIntegrating Open XDR and NextGen SOAR is anevolution beyond the traditional SIEM-to-SOARmodel of threat detection and response. By
connecting Stellar Cyber’s rich incident data to
D3’s powerful playbooks, users can confidently
respond to every level of threat with minimal
screen-switching, manual tasks, or time spent on
false positives. The bidirectional integration
ensures that users of either system have up-to-date
information on investigations, which eliminates
redundant work.

SAMPLE USE CASE #2:

Actionable Intelligence
Challenge
Most SOCs have access to threat intelligence,
often from myriad sources. The challenge they faceis consistently turning that intelligence into action.
Without automation and integrations, security
teams struggle to find the time to investigate every
piece of threat intelligence to determine their risk
and take the appropriate action.

Solution
D3 integrates with myriad threat intelligencesources. When threat intelligence is ingested into
D3, D3 can parse the IOCs from the report or feed
and correlate them against Stellar Cyber’s event
space to find out if the threat is present in theenvironment. The D3 playbook runs a search query
via Stellar Cyber’s API to find any instances of IP
addresses, processes, and other artifacts that areimplicated in the threat intelligence. If anything isfound, the information is returned back to D3. The
user can then review the evidence and choose to
run a playbook to further investigate the extent of
the threat and remediate it.

OutcomeBy building an automated, repeatable workflow forchecking threat intelligence against Stellar Cyber’srich database of events, joint users can act on all
incoming intel without bogging down their team inadditional tasks. D3 and Stellar Cyber users canidentify, analyze, and respond to threats across theentire stack.

D3 Security’s NextGen SOAR platform is the only SOAR platform that combines automation and orchestration
across 500+ integrated tools with an automated event pipeline that reduces event volume by 90% or more. D3’scodeless playbooks automate enrichment and remediation tasks, while making it easy for enterprises and MSSPs
to build, modify, and scale workflows for security operations, incident response, and threat hunting.

1-800-608-0081

www.d3security.com

sales@d3security.com

The Stellar Cyber Open XDR platform delivers comprehensive, unified security without complexity, empoweringlean security teams of any skill to successfully secure their environments. With Stellar Cyber, organizations reducerisk with early and precise identification and remediation of threats while slashing costs, retaining investments inexisting tools, and improving analyst productivity, delivering a 20X improvement in MTTD and an 8X
improvement in MTTR. The company is based in Silicon Valley.

stellarcyber.ai