Operationalize an ATT&CK driven SOC with zero analyst experience

[#1]

Session Code: BRE1396

Presenter(s): Ian

Company(s): Endgame

Abstract:

Organizations of all sizes have the same security aspirations: to continue to transact in the face of adversary risk.

While "MITRE ATT&CK" is the buzzphrase du jour, putting it to use in mainstream organizations is an operational challenge. Experts are difficult to hire and keep, and these positions are often staffed with junior analysts who have limited knowledge on how to stop targeted attacks.

In this session, you'll discover how the Endgame platform was purpose-built to automate attack triage and contextual data gathering. By enriching incidents in ServiceNow IT Service Management with useful context and associated events, analysts of all skill levels can take fast, accurate, and expert level actions with only minimal experience and training.