Here, we’ll answer some frequently asked questions that security analysts or SOC managers might have about ChatOps and its relevance to improving their organizations’ security posture.
Q. What is Security ChatOps?
ChatOps for security can be defined as a platform for conversation-driven investigation. When security analysts, security tools, chatbots, and IR workflows exist in the same chat window and reinforce each other in a virtuous cycle: that’s ChatOps in action.
Let’s take an example. While responding to incidents, security analysts today may use one window for running investigation commands, another window (like Skype or WhatsApp) for conversing with fellow analysts, and a third window (email, text documents, or ticket management) for documenting their IR processes and logs. With ChatOps, analysts can perform all three actions – investigation, collaboration, and documentation – using the same solution, without having to change windows, and while leveraging the power of chatbots and other security tools.
Q. What areas of my work can Security ChatOps help with?
Some areas where ChatOps can help are:
It can shorten response times: If you currently coordinate between multiple security products to successfully respond to incidents, ChatOps can shave off lots of screen-switching and redundant work by allowing you to integrate all security products and run product-specific commands in one window.
It can improve transparency: If you handle incident response with other analysts and there tends to be information asymmetry in the team – with one analyst not knowing what commands the other analyst ran – ChatOps can improve overall team visibility by bringing all analysts together in one window so that everyone knows which actions were taken, which commands were run, and what order they were run in.
It can increase organizational knowledge: If you are short-staffed on analysts, have trouble training junior analysts, and sweat whenever a senior analyst leaves the organization with all their accumulated expertise and knowledge, ChatOps can help soften the blow. ChatOps provides robust one-stop archival of all actions, comments, and commands. Since everything is indexed, the security database becomes a vault where all organizational knowledge is stored for posterity.
Q. How do I start implementing ChatOps for my organization?
Here are a few things to keep in mind while implementing Security ChatOps:
Decide if you’re ready for implementation: Evaluate your current resource inventory, needs, and goals to see if they align with the implementation of ChatOps. For example, if you’re facing rising alert numbers, having trouble with product proliferation, and struggling to attach task-level accountability to analysts, there are signs that ChatOps will help solve your problems.
Start small and iterate: Decide which sub-teams or set of tasks to include in a pilot project for ChatOps. Run a quick proof-of-concept, study any benefits that accrue, and iterate the process to include more teams and tasks to validate whether the implementation is scalable for your organization.
To see Cortex XSOAR in action, sign up for our free Community Edition