Solution Brief

Incident Response withSwimlane and Zscaler

Automated Threat Hunting
Most organizations today are not able to proactively identify and hunt for threats. They
are stymied by lack of resources and manual processes that limit hunting frequency.
Manually collecting artifacts from various point systems, sifting through logs or
performing network packet captures isn’t scalable in today’s threat environment,
where it is no longer enough to be passively vigilant.

Integration Features• Execute Zscaler actions –such as reputation checks,
look ups and addition anddeletion of indicators fromcustom blacklists for realtime enforcement acrossall users and devices within
Swimlane’s workflow tasks.
• Leverage Zscaler’s malware
analysis and sandbox
reputation results within
Swimlane, either as anautomated playbook task or
as a stand-alone task.
• Leverage Swimlane’s
platform integrations tofurther enrich Zscaler dataand coordinate response
across various security
endpoints.

1-844-SWIMLANE

Swimlane’s integration with Zscaler gives analysts a centralized view into anorganization’s inbound and outbound traffic and allows the analyst to look at Zscalerartifacts, capture suspicious indicators and perform reputation checks or lookups allwith a single click. This reduces the number of manual steps and time that an analyst
would require to identify and hunt for threats. Once Zscaler deems an IOC as malicious,
Swimlane can automatically have Zscaler enforce a block policy from within its UI,
without requiring the analyst to log into multiple systems or switch screens.

Incident Triage, Enrichment and Response
Analysts are finding it difficult to act on the increasing volume of alerts and incidents.
Incident response tasks involving identification, triage, and response actions involve
switching between multiple screens, mundane and repeatable tasks, and lost timedealing with false positives.
Analysts can streamline security operations workflows by using Zscaler actions within
Swimlane’s playbooks. Swimlane can retrieve malware analysis results and indicator
reputation, extracting wider context without the need for screen switching and manual
repetition. For example, a Swimlane playbook can ingest an alert from a SIEM, extract ahash file and perform a reputation check for the hashes. If malicious hashes are found,
Swimlane can call Zscaler to get a sandbox report which can then be used for further
analyst investigation or playbook actions.

Swimlane © 2019 | swimlane.com

1Integration
The integration with Zscaler allows the analyst to keep on top of threats by performing
security actions that go across Zscaler’s access control, SSL inspection, advanced
threat protection and data protection capabilities all from within Swimlane’s UI.
Playbooks automate a host of actions across products so that analysts have a wealthof information at their fingertips when starting an incident investigation. Conditionaltasks within playbooks can help reduce false positives and ensure that analysts
investigate incidents that have been confirmed as malicious.
3RD PARTY ACTIONSEVENTS SENT TO SWIMLANE

Benefits

DISABLE ACCOUNT,QUARANTINE DEVICE

NEXT-GEN
FIREWALLREST API!"#$%&'()EMAIL

BUSINESS PROCESSSYSLOG!"#$%&'()• Use Swimlane playbooks toorchestrate actions against
web-proxy, next-generation
firewall, and sandbox
malware analysis• Collect and centralize
relevant forensic data foreffective investigations andfast resolution

ASSIGNDATA PULLED TO SWIMLANE

CAPTUREEVIDENCE

SCORE/PRIORITIZENOTIFICATIONSEMAILCHAT OPSTHREAT INTELUSERS

Automation & Orchestration!"#$%&'()EMAIL

SMS!"#$%&'()

Responses

Triggers

Security Automation and Orchestration for the Enterprise• Shorten security operations
workflows by automating
manual tasks and provide
deep visibility into
operational KPIs

Better Together
About Zscaler Security
Zscaler Internet Access (ZIA) delivers your security stack as a service from the cloud,eliminating the cost and complexity of traditional appliances. Zscaler operates over
100 datacenters worldwide to connect users to the closest gateway for faster access.
Organizations can scale protection to all users regardless of location, without theneed to add new appliances. ZIA sits between your users and the Internet giving
unprecedented visibility to every byte, including SSL encrypted traffic which isinspected inline. Zscaler is a security cloud platform offering Cloud Sandboxing,
Next-Generation Cloud Firewall, Data Loss Prevention (DLP), and Cloud Application
Visibility and Control.
About Swimlane
Swimlane is a leader in security orchestration, automation and response (SOAR).
Automating your response to security threats enables your security operations teamto triage alarms more effectively, respond to critical events faster, and seamlessly
integrate your existing security solutions into a more efficient and comprehensive
incident response program.

1-844-SWIMLANESwimlane © 2019 | swimlane.com

2