Is there a gap between your EDR and forensics tools?
Learn how this security team accelerated their investigations and completing their tech stack with Cyber Triage.
Let’s jump in…
Challenge
Investigations at a major industrial manufacturer were taking too long. The culprit? A gap in their tech stack. They had world-class detection (CrowdStrike) and deep dive forensics (EnCase), but nothing in between. This prevented the SOC team from quickly collecting evidence to pass on to IR with alerts. It also kept the IR team from quickly validating incidents and completing the investigation.
To address their challenges, they looked for an automated security platform that could bridge the technical gap.
Solution
They found Cyber Triage, an automated investigation platform built to integrate into existing environments and accelerate every stage of the investigation process.
The SOC team utilizes Cyber Triage with their EDR, CrowdStrike, while the IR team employs Cyber Triage with their forensics tool, EnCase.
It was a natural fit.
As the forensics lead at the company said, “I can’t sing the praises enough of this software. It is very cost-effective yet very robust. If you have not added this to your cybersecurity/forensics teams, you definitely should be looking at this software!”
“They are constantly adding features and making the tool more robust.”
The new process:
| Step 1 | SOC team gets an alert and collects data from the suspicious endpoint(s) using The Cyber Triage Collector. |
| Step 2 | SOC team sends the alert with the collected evidence to the IR team. |
| Step 3 | IR team uses Cyber Triage’s Automated Analysis to review bad and suspicious items from the collection. If it’s a real incident, they kick off the next phase. |
| Step 4 | IR team uses Cyber Triage and, if needed, DF tools (Encase), to rapidly complete the investigation. |
Results
| SOC Team Could Quickly Preserve + Deliver Evidence |
|---|
| The SOC team could quickly and easily perform collections on an endpoint or set of endpoints that an alert indicates suspicious. Cyber Triage integrates into most EDRs make it easy to fit into existing workflows. The team can start collections directly from the EDR. |
| IR Could Rapidly Validate + Investigate Incidents |
|---|
| The IR team could speed up every stage of an investigation with Cyber Triage. The platform immediately identified bad and suspicious activity and correlated that to other related events. This ensured conclusions are both fast and comprehensive. |
| SOC and IR Teams Could Collaborate Effectively |
|---|
| The SOC and IR teams both found Cyber Triage easy to use for their respective tasks, and the fact they both could use the same tool made their investigations that much more streamlined. Overall, Cyber Triage increased efficiency, lowered cost of investigations, and increased ROI on their current stack. |
As the company’s forensics lead remarked:
“For my friends in the SOC/IR/Forensic world, this is a very cost-effective way to quickly enhance your triage capabilities. The speed of this and what it does is a great compliment to your current EDR solutions.”
Empower Your Team
Cyber Triage is the missing piece your team needs to unlock its potential. It isn’t just a better tool.
It’s how you create a better team.
Try it for yourself free for 7 days.