t cht lk
data from the response for learning and improvement . And remember , all of this happens at speed and scale , so automation is key – allowing you to act efficiently for comprehensive response .
Threat intelligence best practices to enable XDR
For organisations considering XDR , or that have already embraced XDR , the following best practices will help you leverage threat intelligence to derive more value .
Use data from all sources : Integration is a core competency to enable XDR because organisations are not starting with a clean slate but have dozens of technologies , feeds and third-party data sources across departments and teams . Allowing for strong integration and interoperability with all systems and data sources , internal and external , enables you to leverage threat data . Displaying a wealth of contextualised data via a common work surface enables teams to apply it to understand the threats they are facing to reach the goal of extended detection and response across the infrastructure and across all attack vectors .
Use data to focus efforts : Prioritisation should be automated but under the control of the security team . Filtering out noise ( false positives and information that is irrelevant ) using parameters you set ensures prioritisation is based on risk to your organisation Analysts can focus on threats that matter most instead of spending time chasing ghosts . Feedback and results should be continuously captured , stored , and used to improve security operations .
Use data to drive response : The most effective way to empower teams is to apply automation to repetitive , low-risk , time-consuming tasks , and recognise that the need for human analysis remains . Irregular , highimpact , times-sensitive investigations are best led by a human analyst with automation simply augmenting the work . A balance between human and machine ensures that teams always have the best tool for the job , and a data-driven approach to both improves the speed and thoroughness of the work .
XDR is gaining a lot of traction . But for it to deliver as promised , we need to heed Sun Tzu and start with a data-driven approach . Threat intelligence was critical to success on the battlefield then , and it is critical to success on the cyber battlefield today . p
A balance between human and machine ensures that teams always have the best tool for the job , and a data-driven approach to both improves the speed and thoroughness of the work .
www . intelligentcio . com INTELLIGENTCIO AFRICA 69