Get to SOAR Faster Guide
SOAR has incredible upside. Why has it belly flopped (so far)?
Data sources that are hard to use
If your data comes from a hodgepodge of sources, you're going to have a bad time. It needs to beavailable (not disabled for performance/political reasons) and ready for ingest (normalized and mappedproperly) Otherwise it's garbage in, garbage out.
Data that wasn’t built for security
Most network data SOCs use comes from sources — like performance monitoring — that were created
for a totally different purpose. This data isn’tcomprehensive or consistent enough to give you detailed
evidence.
Playbooks that don’t do enough
Playbooks should automate entire core workflows, not just discrete tasks like threat intelligence lookups
or firewall updates. Corelight's comprehensive data makes complex, end-to-end playbooks accessible
for any SOC.

Formula for SOAR success1Get to SOAR Faster Guide​

How to make SOAR work, fast

To get automation’s full benefits quickly, you need to pair the right data with expert playbooks on aversatile platform. This makes it easier to get SOAR up and running, and enables amazing abilities — like
automatically gathering the evidence needed to make the right call.

Here’s a step-by-step example on tackling alert fatigue:
1. Gather the right data to feed your SOAR playbook
Clear away legacy logging sources and start collecting normalized, security-centric data that contains
critical information, and nothing else.
2. Automate away time-consuming, ultimately pointless alerts
Start by screening out the obvious. For example, consolidate repetitive alerts that all point to the sameevent, or alerts that can’t lead to an issue, like DNS queries without a response.
3. Package expertise to help your analysts overachieve
Analyst skill sets and familiarity with tools varies wildly. Give them expert playbooks to take theguesswork out of investigations. You’ll get better quality and precision, while also training your team.
4. Customize playbooks and fine tune alerts
With the time your team saves, they can hone detections to make them more accurate, or they can build
on playbooks and create new ones.

2Get to SOAR Faster Guide​The right tools make it all possible
A scalable, open, extensible SOAR platform•

Platforms like Splunk Phantom take action in seconds, not hours•

Harness the full power of your existing security investments•

Work smarter, respond faster, and strengthen your defenses

What makes Corelight data different•

Structured, security-centric data that’s precorrelated for SOAR•

Built on Zeek, the global standard for network monitoring for 25 years•

Rich, yet lightweight and storable to deliver great detail, indefinitely•

Easily replace legacy sources, overcoming political and technical hurdles•Integrates seamlessly with all your existing technology and process

Playbooks created by experts, from Corelight•

Created by elite cybersecurity practitioners with deep experience•Make every analyst perform better, and more consistently•

Leverages years of tradecraft to get the most out of your data and platform3

Get to SOAR Faster Guide​

Investigate faster with alerts integrated into evidence.​ Every Suricata alert contains its associatedprecorrelated Zeek data to bring foundational, standardized evidence all in one place, speeding investigations.

https://www.sans.org/reading-room/whitepapers/analyst/common-practices-security-operations-centers-results-2019-soc-survey-39060*​Defenders have always sought the high ground in order
to see farther and turn back attacks. Corelight delivers
a commanding view of your network so you can outsmart
and outlast adversaries. We capture, interpret, andconnect the data that means everything to defenders.

info@corelight.com |​ ​ 888-547-9497

All rights reserved. © Copyright 2020 Corelight, Inc.

4