on - edited on by
Sarah Wood
In today's rapidly evolving cybersecurity landscape, security teams face unprecedented challenges in efficiently managing and responding to security incidents.
Security analysts, particularly those new to the field, often struggle with the sheer scale of data, inconsistent response practices, and the need for rapid, accurate decision-making. This November, we’re thrilled to introduce two highly-requested Gen AI features designed to tackle these critical pain points: 1) Recommended Actions and 2) Post-Incident Analysis. These two capabilities are live on the Store here and are built on top of existing Gen AI capabilities in SIR (for security incident summarization and resolution notes generation) that launched in August.
1. Recommended Actions
Challenges:
Security analysts are frequently overwhelmed by the effort required to identify and execute the correct response steps. Junior analysts, in particular, face several key pain points:
- Time-consuming research across multiple sources: Analysts must often consult multiple sources, like internal playbooks and knowledge base articles, to determine the next steps.
- Inconsistent Incident Response: Without standardized guidelines, handling approaches can vary widely across the team, leading to potential oversights and inefficiencies.
- Knowledge Gaps: Complex incident types, such as multi-stage attacks, can be challenging for junior analysts who lack extensive experience.
Our Solution:
Our new Gen AI-powered Recommended Actions feature utilizes Retrieval-Augmented Generation (RAG) to streamline and standardize the incident response process. Here’s how it works:
- Automated Knowledge Retrieval: The system scans knowledge base articles and similar closed incidents to surface the most relevant information for the incident at hand.
- Context-Aware Recommendations: Using security incident context, the AI suggests specific response actions, reducing ambiguity and helping analysts prioritize tasks.
- Direct Task Creation: With just a click, analysts can turn recommendations into actionable response tasks or save them in work notes, depending on system configurations.
Key Benefits:
- Reduced Investigation Time: Analysts can cut down research time by leveraging recommended actions, allowing them to resolve incidents faster.
- Accelerated Onboarding for New Analysts: By providing context-sensitive guidance, Recommended Actions shorten the learning curve for new analysts, enabling them to contribute more effectively.
2. Post Incident Analysis
Challenges:
Traditional post-incident analysis often presents the following challenges:
- Time-Consuming Process: Generating a detailed post-incident report can take hours, pulling analysts away from active threats.
- Inconsistent Documentation: Different analysts may approach incident reviews with varied levels of detail, leading to inconsistent reports and gaps in analysis.
- Lack of Root Cause Insight: Root cause analysis (RCA) is often incomplete, especially if analysts are pressured by time constraints
Our Solution:
Our Gen AI-powered Post-Incident Analysis automates and enhances the incident review process, generating a structured, comprehensive analysis whenever an incident moves to a "closed" state. The generated report includes:
- Root Cause Analysis (RCA): A systematic review of the incident’s origin and contributing factors.
- Impact Assessment: Evaluation of affected systems, users, and potential downstream impacts on the organization.
- Actionable Learnings and Recommendations: Steps for improving defenses and preventing similar incidents in the future.
Once the post incident analysis is generated, the analysts can find it in both the field of the security incident called “post incident analysis” and under the overview tab, the resolution section.
Key Benefits:
- Consistent, High-Quality Analysis: By automating the generation of post-incident analyses, we ensure that every report meets a high standard, regardless of who closes the incident.
- Time Savings: Analysts spend less time on documentation, enabling them to focus on active investigations and proactive threat hunting.
Looking Ahead
This November release represents our commitment to pushing the boundaries of AI-powered cybersecurity. Stay tuned as we continue to expand what AI can do for cybersecurity and thank you for partnering with us on this journey to redefine incident response.
For more information about Now Assist for Security Operations, please reference the Links and Docs on the ServiceNow Store.
