SOAR tools work as consolidation platforms for security alerts and incident response.
Endpoint security tools, network security tools, email systems, and other tools collect logs, run detection rules and generate alerts.
SOAR then ingests those alerts so teams can work out of a single platform for their incident response.
The second method is having the original data source push the alerts to the SOAR tool via a webhook.
The most common method for data ingestion in SOAR is to periodically send pull requests to the original data source.
At each scheduled interval, the SOAR tool queries the data sources for new or updated alerts.
This is achieved by sending a GET or POST request to the API endpoints of these data sources.
Scheduled data ingestion from D3 Smart SOAR to LogRhythm Axon, set to run every minute.
Once the data source responds, the SOAR tool ingests the alerts.
This step involves parsing the received data, extracting relevant information, and transforming it into a standardized format for consistent processing across different data types and sources.
With this method, the original data sources push alerts directly to the SOAR platform using webhooks.
This is usually preferred as data is only moving in one direction, making it a more reliable ingestion method.
When a new alert is generated in the data source, it triggers the webhook and pushes it to the SOAR tool.
Upon receiving the alert, the SOAR tool ingests, normalizes it, and stores it as an event.
In Smart SOAR, each command can be turned into a public-facing API. When enabling this, the command can be triggered remotely from the original data source.
When a new alert is generated, it can be automatically sent to Smart SOAR via this API. The webhook method offers the advantage of faster response times, as alerts are pushed to the SOAR platform in real time.
This is particularly beneficial for high-priority alerts that require immediate attention.
In summary, both the scheduled pull requests and push methods are effective in transferring alerts from various data sources into the SOAR platform.
The choice between these methods depends on specific organizational needs and the capabilities of the original data source.
Both methods can be used and when activated enhance the ability of SOAR tools to consolidate security alerts and provide a unified platform for incident response.
This Cyber News was published on securityboulevard.com. Publication date: Thu, 07 Dec 2023 23:13:04 +0000