Exabeam Adds to Flagship Behavioral Analytics Product with Updated Case Management Module
September 12, 2018
Exabeam has added to their flagship behavioral analytics product, introducing an updated case management module. The addition of case management functionality into Exabeam Advanced Analytics and Exabeam Entity Analytics, its user and entity behavior analytics solutions. The updated feature will help security teams organize and streamline their response efforts to boost security operation center (SOC) productivity.
Exabeam Case Management is an optional module that provides a customizable user interface designed for the workflows of security teams, and that adds intelligence to help analysts resolve incidents more efficiently. Machine learning helps make the interface context aware, presenting users with relevant fields, values, and data for different incident types. The resulting workflows bring pertinent details to analysts when and where they are needed.
New features of the Exabeam Case Management module are:
- Incident Cards – graphical cards on each analyst’s Exabeam home page show both active incidents being worked and pending in their queue, prioritized by severity. The integration with behavioral analytics allows automatic creation of tickets based on incidents with a high risk score.
- Workflow Management – with appropriate permissions, analysts can see incidents being worked by their peers and request a merge or escalation as appropriate. This is in addition to the existing capabilities that include workflow definition, case reassignment, ticket tracking, incident triage and case escalation. The increased visibility improves collaboration and reduces redundant work in the SOC.
- Case Context – analysts will see associated security incidents related to their cases in the Advanced Analytics and Entity Analytics interfaces. Threat indicators and relevant artifacts are automatically added to cases. This gives security analysts broader context and allows for human intuition to add to the analytics within the system.
“Many security analysts are using generic IT service management tools to automate their security operations. Historically, ticketing and workflow capabilities for the SOC have either been ‘borrowed’ from departments outside of security, or poorly implemented over the rudimentary functionalities provided by legacy SIEMs. Not only are these tools not customized for security applications, but they are not integrated into the security detection and investigation tools used by the analyst,” said Sylvain Gil, vice president of products and co-founder at Exabeam. “Exabeam Case Management is the first SOC-native case management solution, designed to save analysts time and make them more efficient by integrating security ticketing and workflows into the product. This enables a seamless workflow from detection to triage to remediation.”
Exabeam Case Management is currently in beta testing and is expected to be released next month.
##
About the Author
David Marshall is an industry recognized virtualization and cloud computing expert, a ten time recipient of the VMware vExpert distinction, and has been heavily involved in the industry for the past 20 years. To help solve industry challenges, he co-founded and helped start several successful virtualization software companies such as ProTier, Surgient, Hyper9 and Vertiscale. He also spent a few years transforming desktop virtualization while at Virtual Bridges.
David is a co-author of two very popular server virtualization books: "Advanced Server Virtualization: VMware and Microsoft Platforms in the Virtual Data Center" and "VMware ESX Essentials in the Virtual Data Center" and the Technical Editor on Wiley’s "Virtualization for Dummies" and "VMware VI3 for Dummies" books. David also authored countless articles for a number of well known technical magazines, including: InfoWorld, Virtual-Strategy and TechTarget. In 2004, he founded the oldest independent virtualization and cloud computing news site, VMblog.com, which he still operates today.
Follow David Marshall
Twitter: @vmblog
LinkedIn: https://www.linkedin.com/in/davidmarshall
Blog: http://vmblog.com