GURUCUL

SOAR
Trusted Automation and Orchestration of
Response Through Risk-Driven Prioritization

Business Challenge Critical Capabilities

The average length of time an attacker remains within Gurucul’s Risk-Driven SOAR provides security teams
an organization has extended to well over 6 months. with security workflows for responding rapidly to
This is often described as Attacker “Dwell Time”. active attack campaigns. Gurucul SOAR, powered
However, as an attack is discovered by either security by the REVEAL Security Analytics Platform and
teams or through a third party, the gap between the trained on machine learning, is able to provide a full
attack being discovered and the eradication of the understanding of the entire attack campaign with
attack on average is over two months. During this time context and analytics. Gurucul SOAR then creates a
attackers often accelerate their activity, such as data precise set of workflows and case management actions,
theft or extortion, but also detonation of ransomware. or playbooks dynamically structured based on what
Security Orchestration, Automation and Response we’ve learned about the specific customer environment.
(SOAR) solutions have been built to accelerate response The response capabilities are then prioritized through
to shrink the time between detection and remediation. our enterprise-class risk engine, that leverages multiple
However, these solutions are only as good as the threat intelligence sources, and scored to guide analysts
detection and investigation that leads to the playbooks in achieving maximum efficiency and minimal disruption
and response actions. False positives and poor when doing remediation.
accuracy have forced SOAR vendors to build response
playbooks that are too broad to be effective and require Automate and Orchestrate Responses Based on Risk
more investigation and customization. This renders The enterprise-risk engine as part of our REVEAL
them nothing more than guidebooks versus enabling Security Analytics Platform, and works with Gurucul
automated response thereby lengthening the time to SOAR to generate risk scores that are updated in real-
remediate. time time as data is processed and analytics are run.
Behavior patterns are represented mathematically, transactions into a single case. Risk remediation
and as threats are detected and risk levels change the responses can be automated based on risk scores,
score is updated dynamically. These are applied to both resource type, anomaly type, categorization, etc. Cases
individual response actions as well as with the overall can be reassigned, closed as risk accepted, or sent for
playbook generated. model review feedback. Case management has RBAC
However, Gurucul SOAR generated playbooks are and privacy capabilities allowing cross-functional teams
adapted to the customer’s environment based on our to collaborate easily. Incident data can be segregated
analytics and trained machine learning. Along with our and masked per job function, business unit, location,
unique approach that provides open and transparent etc.
visibility into our machine learning models, we provide Leverage Extensive 3rd Party Integrations
context and associated risk to give customers the REVEAL provides seamless integration with hundreds
ability to seamlessly automate remediation actions of downstream security solutions out-of-the-box. This
based on a risk score or a change in risk score. lets the SOAR trigger appropriate risk remediation
No other vendor offers a risk-driven approach to SOAR. actions on-premises or in the cloud using your existing
REVEAL leverages its enterprise risk scoring engine to security solutions. REVEAL also supports integration
codify and risk-rank threats from 1 to 100. It generates with a huge number of third-party tools to facilitate
this unified risk score for every user and entity for end-to-end incident management.
which anomalies are triggered. The risk scores along
with anomaly metadata like resource and event are then Key Benefits
used to trigger appropriate remediation action per the
•  rioritize response actions automatically
P
response playbook. In addition, REVEAL supports API-
tailored to your specific environment or through
based integration with preventative security solutions fully customizable playbooks.
to block, disable or isolate risky users and entities to
•  reate high-fidelity targeted response that
C
minimize the risk.
minimizes disruption to IT operations.
Customize Incident Response Playbooks •  utomate gathering relevant context and
A
Out-of-the box, REVEAL includes hundreds of analysis for validation.
playbooks with workflows for automating incident •  everage included contextual case management
L
response actions. It doesn’t stop there. Customers or integrate seamlessly with existing case
can create their own customized machine learning management.
models and associated workflows that lead to targeted •  nhance collaboration across your organization
E
playbooks or create their own custom playbooks to remediate threats through shared context and
to address their specific challenges and concerns. concise recommended responses.
Playbook Task Linking adds micro playbook services to
standard processes, which can then be linked together Why Gurucul
in workflows to allow for different remediation paths.
Adaptability, transparency, and flexibility runs through
This enables customers to reuse SOAR workflow
the entire platform. Orchestration can start with
components once they are built.
generating a ticket in the organization’s existing
Automate Even Faster with Included Case ticketing system. Then responses and remediation can
Management be automated through the organization’s security stack
REVEAL provides built-in comprehensive case authentication systems, network, system, and endpoint
management capabilities that go beyond just playbooks defenses. Automated reactions are tailored to risk and
allowing users to track incidents. The REVEAL platform can range from simply alerting the SOC to an event, to
leverages automated incident timelines that create completely isolating and quarantining the risky entity,
smart links of the entire attack lifecycle for pre- and whether they are a user, a host, a system, or other asset
post-incident analysis, grouping alerts from related in the environment.
 Top Use Cases
Contextual Threat Hunting
Unlike existing solutions like SIEM and XDR, which
require manual threat hunting, Gurucul is able to
automate the collection and correlation of analyzed
events and link together seemingly disparate events
and even individual threats to fully formulate the scope
of the attack campaign.

Precise Containment of Malware Infections

With Gurucul’s included threat models and content, we
can take the vast array of telemetry such as endpoint,
network, IoT, identity, cloud analytics along with user
and entity behavioral analytics, to detect a threat much
more rapidly versus solutions that simply correlate
different and siloed analytics. By understanding assets,
users, identity, and even application usage we can
provide more precise response actions tor quarantining
users, hosts, or applications at a granular level instead
of negatively impacting resource availability through
broad and less customized actions.

Vulnerability Patching
As Gurucul identifies risks through our enterprise risk
engine, we can also pull in vulnerability and threat
intelligence data. This allows us to align patching and
remediation efforts with active threats. Once these
actions are done, the organization is then protected
from potential follow-on attacks and certain variants
that continue to exploit unpatched vulnerabilities.
The contextual information provided and prioritization
is critical for security operations teams to work with
individuals responsible for vulnerability management
and/or patch management.

About Gurucul
Gurucul is the only cost-optimized security analytics company business requirements so you don’t have to compromise. Our
founded in data science that delivers radical clarity about cyber technology has earned us recognition from leading industry
risk. Our REVEAL security analytics platform analyzes enterprise analysts as the most Visionary platform and an Overall leader
data at scale using machine learning and artificial intelligence. in product, market and innovation. Our solutions are used by
Instead of useless alerts, you get real-time, actionable Global 1000 enterprises and government agencies to minimize
information about true threats and their associated risk. The their cybersecurity risk. To learn more, visit [Link] and
platform is open, flexible and cloud native. It conforms to your follow us on LinkedIn and Twitter.

Gurucul | 222 North Pacific Coast Highway, Suite 1310 | El Segundo, CA 90245 | 213-259-8472 | sales@[Link] | ©2024 Gurucul. All rights reserved.