Chronicle SOC Integrations

Google Cloud is an online service that lets you create everything from simple websites to complex apps for businesses of any size. Customers who are new to the system will receive $300 in credits for testing, deploying, and running workloads. Customers can use up to 25+ products free of charge. Use Google's core data analytics and machine learning. All enterprises can use it. It is secure and fully featured. Use big data to build better products and find answers faster. You can grow from prototypes to production and even to planet-scale without worrying about reliability, capacity or performance. Virtual machines with proven performance/price advantages, to a fully-managed app development platform. High performance, scalable, resilient object storage and databases. Google's private fibre network offers the latest software-defined networking solutions. Fully managed data warehousing and data exploration, Hadoop/Spark and messaging.

Runtime threat assessment, runtime attack analysis, and targeted protection of your infrastructure and applications. Zero-day attacks can be stopped by staying ahead of attackers. Observe attack behavior. ThreatStryker monitors, correlates, learns, and acts to protect your applications. Deepfence ThreatStryker displays a live, interactive, color-coded view on the topology and all processes and containers running. It inspects hosts and containers to find vulnerable components. It also interrogates configuration to identify file system, processes, and network-related misconfigurations. ThreatStryker uses industry and community standards to assess compliance. ThreatStryker conducts a deep inspection of network traffic, system behavior, and application behavior and accumulates suspicious events over time. The events are classified and correlated with known vulnerabilities and suspicious patterns.

Open source, multi-cloud platform to scan, map, and rank vulnerabilities in containers, images hosts, repositories, and running containers. ThreatMapper detects threats to your applications in production across clouds, Kubernetes and serverless. You cannot secure what you can't see. ThreatMapper automatically discovers your production infrastructure. It can identify and interrogate cloud instances, Kubernetes nodes and serverless resources. This allows you to discover the applications and containers, and map their topology in real time. ThreatMapper allows you to visualize and discover the external and internal attack surfaces for your applications and infrastructure. Bad actors can gain access to your infrastructure by exploiting vulnerabilities in common dependencies. ThreatMapper scans hosts and containers for known vulnerable dependencies. It also takes threat feeds from more than 50 sources.

Google researchers continuously update the advanced detection engine with new rules and threat indicators to help you correlate petabytes worth of your telemetry. The detection engine of Chronicle includes predefined rules that are mapped to specific threats, suspicious activities, and security frameworks such as MITRE ATT&CK. Chronicle's alerting and detection only escalates the most serious threats. Risk scoring is based on context vulnerability and business risk. YARA-L makes it easy to create custom content and simplifies detection authoring. Automate detections and instantly correlate indicators of compromise (IoC), against one year security telemetry. Contextualize with third-party intelligence subscriptions and out-of-the box intelligence feeds

Playbooks can be used to speed up time-to-value, and allow for easy scaling as you grow. You can address common problems like ransomware and phishing with ready-to-use use cases that include playbooks, simulated alarms, and tutorials. Drag and drop is all it takes to create playbooks that organize hundreds of the tools that you rely upon. Automate repetitive tasks to help you respond faster and make more time for high-value work. Optimize, troubleshoot and iterate playbooks using lifecycle management capabilities such as run analytics, reusable blocks, version control, rollback, and run analytics. Integrate threat intelligence at each step and visualize the most relevant contextual data for each threat, including who did what and when, and the relationships between all entities attached to an event or product. The patent-pending technology automatically groups related alerts into one threat-centric case. This allows a single analyst the ability to efficiently investigate and respond.

Google Cloud Threat Intelligence researchers have created and maintained high-quality, actionable, out of-the-box threat detection content that will help you get better detections. Native detection sets cover a range of threats, including Windows-based attacks such as ransomware, remote access tools (RAT), infostealers and data exfiltration. New analytics from Google Cloud Threat Intelligence researchers reveal new and latent threats, unlocking new detection coverage. You can use GCTI detections for response actions and rules that are specific to your environment. The VirusTotal Augment widget can be used to increase efficiency in SOC processes and allow faster search for artifacts such as domains, URLs, IPs, URLs, or hashes. You can gain context beyond your network perimeter and expand your telemetry to explore related VirusTotal IIoCs in a graphical way.

Learn what a digital protection solution is, how it can help prepare you by identifying who is targeting you and what they are after. Mandiant offers a comprehensive digital risk protection solution, either as a standalone self-managed SaaS product or as a comprehensive service. Both options provide security professionals with visibility outside their organization and the ability to identify high risk attack vectors, malicious orchestration on the dark and deep web, and attack campaign on the open web. Mandiant’s digital risk solution provides contextual information about threat actors, their tactics, techniques and procedures, to create a more secure cyber-threat profile. Map your attack surface, and monitor deep and dark web activities to gain visibility into the risk factors that impact the extended enterprise and supply chains. Identify unknown or unmanaged internet-facing assets that are vulnerable before threat actors do.

No-code flows and AI-generated flows allow you to automate at scale. You can access all the tools you need with the most comprehensive integration library available. Select the service that you want and automate it. In minutes, you can create your first workflow. Use pre-built template if needed, use the AI assistant to help you, or take advantage of the Mindflow excellence centre. Let Mindflow handle the rest. Type your input as plain-language text. Create workflows that are adapted to your technology stack from any input. Create AI-generated work flows to address any use case, and reduce the time spent building them. Mindflow redefines enterprise integration with an extensive catalog. Add any tool to our platform in minutes, breaking down the barriers of traditional integration. Connect and orchestrate all your tech tools.