{"id":2041,"date":"2017-06-08T16:49:07","date_gmt":"2017-06-08T16:49:07","guid":{"rendered":"https:\/\/live-infoblox-blog.pantheonsite.io\/?p=2041"},"modified":"2020-05-06T10:27:59","modified_gmt":"2020-05-06T17:27:59","slug":"how-to-contain-threats-faster-with-security-orchestration","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/company\/how-to-contain-threats-faster-with-security-orchestration\/","title":{"rendered":"How to Contain Threats Faster With Security Orchestration"},"content":{"rendered":"

Infoblox and Rapid 7\u00a0announced<\/a><\/u><\/span>\u00a0today new integrations that help alleviate operational hurdles when it comes to threat containment.<\/p>\n

SOC teams are faced with daily challenges when dealing with potential threats:<\/p>\n

Silos between teams and tools<\/strong><\/p>\n

Network and security teams tend to be separate organizations, each with their own systems and priorities. The network team must ensure network availability whereas the security team is focused on risk mitigation. Both teams have independent logging systems that don\u2019t share information with one another. This makes security and incident response efforts unnecessarily burdensome, due to manual, inefficient, and untimely data sharing.<\/p>\n

No knowledge of threat context<\/strong><\/p>\n

Context can be defined as the environmental information required to take the right action \u2013 the Who, What, Where, When. Today\u2019s security teams face a lack of context around incidents. If a malicious event is detected, just dumping that information into a SIEM without any context could make it hard to correlate events appropriately and take any timely action. SOC teams are faced with so may alerts and have no way to prioritize which ones to address first. They also lack visibility into network data.<\/p>\n

Lack of automation<\/strong><\/p>\n

Security tools can\u2019t take action automatically based on network activities like when new hosts join the network or when DNS security tools detect malicious activities. It is a manual process to assemble data from multiple sources and take action.<\/p>\n

The Infoblox and Rapid 7 integration enables security operations teams to overcome these hurdles with better context, automation and consolidated threat intelligence. Infoblox technology together with Rapid 7\u2019s vulnerability management solution enables organizations to automate scanning when new devices\/hosts join the network or when malicious activity is detected, even if it is in-between scheduled scans. This reduces the chances of potential suspicious activity going undetected during scan gaps. The outbound notifications from Infoblox to Rapid 7 happen through RESTful APIs.<\/p>\n

Benefits include:<\/p>\n