automation, orchestration, and beyond cloud security overview/demisto cloud security...automation,...
TRANSCRIPT
Automation, Orchestration, and Beyond
Headquarters
Demisto Enterprise is a comprehensive Security Orchestration, Automation, and Response (SOAR) platform that combines full case management, intelligent automation, and real-time collaboration to serve security teams across
the incident lifecycle.
Fortune 50 healthcare organization
~200 customers worldwide, spanning 10+ industry verticals
25% of customers from the Fortune 500
Top worldwide online payment system
Fortune 100 athletic-wear retailer
Online streaming and entertainment giant
Santa Clara, CA | USA
Founded2015
Platform
• 230+ integrations
• Open & extensible platform
• 100% channel friendly
• MSSP and cloud ready
7000+ members(largest IR community
in the industry)
Partners Community
Select Customers
The Operating System for Enterprise Security
Industry Recognition
Accelerate Response
Respond to incidents withspeed and scale
Improve investigation quality by working together
100s ofintegrations
1000s ofsecurity actions
Cross-correlations
Task-basedworkflows
Visual playbook editor
SLA and metric tracking
Virtualwar room
Investigationcanvas
Machinelearning
Dashboardsand reports
Autodocumentation
ImprovedROI
Respond to incidents the same way every time
Reduce business and security risk
Collaborate and Learn
Standardize Process
Reduce Risk
© 2019 Demisto, a Palo Alto Networks company | www.demisto.com
CloudSecurityAlerts
Cloud-Hosted
On-Premise
...and more!
Ingest
Feedback
Enrich and Respond
ThreatIntelligence
MalwareAnalysis
DevSecOpsCloudSecurity
CloudServices
TicketingUEBA
EDR Firewall
Demisto for Cloud Security
SIEM
Unify Security Functions
Cloud security demands agility and flexibility in the face of an expanded threat surface and disparate teams. Demisto primes users for fast and standardized cloud security through multi-source ingestion of cloud data and playbooks that
coordinate and automate incident response actions across cloud and on-premise environments.
Automate Repeatable StepsAutomate actions to standardize
and scale incident response
Orchestrate Cloud SecuriyIngest alerts from your cloud environment
and trigger automated workflows that span across products
Coordinate enrichment and response for both on-premise and cloud environments
from one console
Keep pace with rapidly scaling cloud environment
Automate everything that humans don’t need to do
Provide value to other technology departments
Goals
IOCs
Demisto
Case Study: The Pokemon Company International
Use Case Deep Dive
EC2 and account compromise
Phishing enrichment and response
Employee offboarding
Use Cases
UpdateSQS Queue
UpdateLambda
BlacklistBucket
Blacklist
Block on Palo AltoNetworks Firewall
UpdateLambda
As part of the phishing response playbook that Pokémon deployed, Demisto automated extraction of IOCs before pushing those IOCs to blacklists across both cloud and on-premise environments.
© 2019 Demisto, a Palo Alto Networks company | www.demisto.com
© 2019 Demisto, a Palo Alto Networks company | www.demisto.com
Demisto can be deployed both on-premise and as a cloud-hosted offering, adapting to customer requirements as the need arises. The platform is also primed with native multi-tenancy for MSSPs that scales horizontally,
provides three layers of isolation, and maintains data integrity while simplifying communication across tenants.
How Demisto Deploys
Customer On-Premise Server Customer Virtual or Cloud Hosted SaaS
Microsoft Graph Security
Security Center Compute
Azure Active
Directory
GuardDuty
SecurityHub
S3EC2
SQS CloudTrail Route 53
CloudWatchLogs
Google Cloud Resource Manager
Google Cloud Compute
GoogleVault
IAM
1000s of actions100s of integrations Open and Extensible platform
Microsoft Graph Mail
Illustrative Integrations - Cloud Security
Other