Enhancing your security automation and response capabilities across multiple platforms while tending to large amounts of threat investigations is anything but easy. But not doing so requires dependency on many manual processes, increasing incident investigation time and overall risk of malware infections. To prepare for the next inevitable attack, SOC teams must continuously look for ways to improve their post-incident activity processes.
You don’t need to do it yourself. Let automation help.
Streamline and automate the malware investigation process with Cortex XSOAR’s Malware Investigation and Response pack. Released in June 2022, the Malware Investigation & Response pack accelerates the investigation process for endpoint malware incidents and alerts by collecting evidence of malicious behaviors, searching telemetry data available through EDRs, and processing malware analysis reports through sandboxes. Incident layouts also include buttons to quickly trigger containment activities.
Customers like you have found immense value in the Malware Investigation and Response Pack, alongside the Deployment Wizard, since its release.
To quote an EMEA Financial Services customer:
“The Malware Investigation and Response pack is by far the easiest use case to deploy.”
Key New Features of the Malware Investigation and Response Content Pack
After working with customers across various sectors and regions on their deployment of the pack, we incorporated their feedback into a new version of the pack to provide more value without compromising investigation speed or scale.
For the new Malware Investigation and Response pack, we focused on the following capabilities:
- Account Enrichment
Incorporating the capability to retrieve information about the active user on the endpoint will give the analyst context about the endpoint and possible risks to the organization.
For example, providing insight into the active user’s department— whether they are in finance or engineering— enables the analyst to disable the user's account in the corresponding IDP as needed.
- Firewall Enrichment & Validation (with Threat Hunting Generic playbook)
SIEM and newly added Network Security tools give more context to the threats in your organization. This provides valuable context regarding the severity of the threat and how wide it has spread within your organization.
- Joe Security Sandbox coverage
The new integration with Joe Security sandbox allows analysts to retrieve submitted file information or automatically detonate files that are detected by the deployed EDR. The retrieved information allows the analyst to gain more insights on the alert by using the Sandbox analysis full report or even a quick view of the extracted IOCs, such as MITRE ATT&CK information, from the layout itself.
- Addition of Service Level Agreements (SLAs)
Security investigations are time-sensitive. The longer before the threat is contained, the greater the risk of exposure to the organization. With this enhancement of the pack, you can easily track and monitor Triage, Remediation, and Containment SLAs.
An SLA Dashboard also allows you to quickly filter your Incident Types based on Severity so you can properly diagnose your SLAs.
- Microsoft Defender for Endpoint Rate limit handling
Some advanced hunting queries have limitations. However, the Cortex XSOAR Malware Investigation and Response v2 content pack includes a baked-in rate-limiting support mechanism, which will re-run your queries in the playbooks if you have reached your Incidents API or Advanced Hunting API quota. This ensures your investigation goes unhindered.
- Microsoft Defender for Endpoint Advanced Hunting Batch Queries
As the XSOAR R&D team keeps evolving and maintaining current playbooks, it is essential to have flexibility when it comes to customization. This feature allows the customer to add a batch of pre-defined queries as a playbook input. This way, there is no need to detach the playbook for adding your custom Microsoft Defender Advanced Hunting queries.
- Assign Analyst to an Incident
Assigning an analyst to an incident based on the less busy user is now available. Moreover, you may define if you would like to assign an on-call analyst using the playbook inputs.
Continuous Innovation in Automation
The Malware Investigation and Response pack accelerates the investigation process for cybersecurity analysts and makes containment activities push-button simple. Although the latest additions add a ton of value for our customers, we are already thinking about what’s next.
For more information on the Malware Investigation and Response Pack and other XSOAR packs and playbooks, visit our Cortex XSOAR Developer Docs reference page.
To learn more about how you can automate security operations with Cortex XSOAR, check out our virtual self-guided XSOAR Product Tour
We also host virtual and in-person events, so check here for upcoming ones.