Name: Integrating Intezer with SentinelOne to Automate Incident Response
Uploaded: 2022-10-20T15:01:12.000Z
Duration: 37 min 46 s
Description: Integrating Intezer with SentinelOne to Automate Incident Response

Customer Training

Help Desk

Kiosk

Web and Video Conferencing

Customer Support

Agile Development

Automation Testing

Cross-Browser Testing

Interactive Application Security Testing (IAST)

Product Analytics

Service Mesh

Development

Business Intelligence (BI)

Collaboration

Emissions Management

IP PBX

Knowledge Management

Enterprise

Accounting

Travel Management

Finance and Accounting

Applicant Tracking

Corporate Learning Management

Employee Scheduling

HR Management

HR Service Delivery

Payroll

Talent Intelligence

Talent Management

Workforce Analytics

Workforce Management

Human Resources

Cloud Cost Management

Cloud Storage

Data Integration

Embedded Database

Ethernet Switches

Fraud Detection

Governance, Risk & Compliance

IP Address Management (IPAM)

Integration Platform as a Service (iPaaS)

Low-Code Development

Managed DNS

Mobile Identity

Network Performance Monitoring

Platform-as-a-Service (PaaS)

Privileged Access Management

Value Stream Management

Information Technology

A/B Testing

Account-Based Marketing (ABM)

Ad Serving & Retargeting

All-in-One Marketing

Audience Intelligence

Audio Editing

Click Fraud

Content Management

Data Cleansing

Digital Rewards

Email Marketing

Marketing Automation

Mobile Analytics

Social Media Management

Survey & Forms Building

Web Analytics

Marketing

Project Management

Video Conferencing

Writing and Proofreading Tools

Professional Services

Construction CRM

Customer Relationship Management (CRM)

Lead Management

Predictive Sales Analytics

Sales Engagement

Sales Incentive Compensation Management

Sales

Database Security

Security

Animation

Debt Collection

Laboratory Information Management

Legal Case Management

Spreadsheet

Vertical-Specific

Find top rated software and services based on in-depth reviews from verified users. 400+ software categories including PaaS, NoSQL, BI, HR, and more.

Autopsy Digital Forensics

Basis Technology

AccessData Forensic Toolkit (FTK), from Exterro

Exterro

Cellebrite

Cyber Triage

Magnet Digital Investigation Suite

Magnet Forensics

OpenText EnCase Forensic

OpenText

CAINE (Computer Aided Investigate Environment)

Open Source

Clari5 Graph Intelligence

Clari5

FAW (Forensic Acquisition of Websites)

CrowdStrike Falcon

SentinelOne Vigilance

Palo Alto Networks Cortex XSOAR

Intezer is an Autonomous SOC (Security Operations Center) platform designed to streamline security operations and improve incident response capabilities. According to the vendor, Intezer is suitable for companies of all sizes, from small businesses to large enterprises, and is utilized by Security Operations Center (SOC) teams, Incident Response (IR) teams, Managed Security Service Providers (MSSPs), Security Analysts, and IT Professionals across various industries.

## Key Features

**Autonomous SOC**: According to the vendor, Intezer automates smart alert triage, deep investigations, and escalation for serious threats, aiming to reduce false positives and provide clear recommended actions for every alert.

**Intezer for MSSP**: Intezer offers specific features tailored for Managed Security Service Providers (MSSPs). According to the vendor, MSSPs can leverage Intezer's capabilities to provide in-depth reporting, a private instance for sensitive data analysis, and efficient handling of high alert volumes.

**Intezer for Malware Sandboxing**: Intezer provides the ability to deeply analyze files, live endpoints, and more for malware analysis. According to the vendor, this helps security teams gain insights into the behavior and characteristics of malware samples.

**Intezer for SentinelOne**: Intezer integrates with SentinelOne to automate alert triage, incident response, and hunting. According to the vendor, this integration enhances the efficiency and effectiveness of security operations.

**Intezer for Microsoft Defender**: Intezer seamlessly integrates with Microsoft Defender to automate the analysis of alerts, streamline workflows, and provide actionable insights for each detected alert. According to the vendor, this integration helps security teams streamline their workflow by automating the analysis of Microsoft Defender alerts.

**Intezer for CrowdStrike**: Intezer offers integration with CrowdStrike to provide clear recommendations for response and automate deep analysis on every alert. According to the vendor, this integration enhances the capabilities of CrowdStrike Falcon by automating alert triage, incident response, and hunting.

**Intezer for SOAR**: Intezer integrates with Security Orchestration, Automation, and Response (SOAR) platforms to automate alert triage and incident response. According to the vendor, this integration enhances the capabilities of SOAR platforms by providing deep investigations and actionable recommendations.

**Intezer for Reported Phishing**: Intezer assists in the analysis and investigation of reported phishing incidents. According to the vendor, this helps security teams identify the characteristics and behavior of phishing campaigns.

Intezer offers 24/7 monitoring and investigation of endpoints and security alerts, to identify and automatically resolve false positives, or provide contextual guidance and risk profiles. Within a minute after each new alert, Intezer provides assessments and recommended actions which are pushed to an endpoint security console or SOAR.

Malware Analysis

AutonomousDR

Wireshark is a free and open source network troubleshooting tool.

Wireshark

Intezer

Digital Forensics

Intezer Labs Inc.

Reducing SOC & IR Analyst Fatigue with Automation

Reduce SOC & IR Analyst Fatigue with Automation

Security operations today are plagued with too many alerts and not enough analysts. Analysts are burnt out and spend much of their days doing repetitive, manual tasks. This is an ongoing challenge that many security companies attempt to solve with a variety of technological solutions. Legacy tools haven’t been able to effectively reduce the alert load on analysts, the time to respond, and practically collect threat intelligence on the threats targeting them. 

Intezer and Tines are building new ways to introduce automation into security operations workflows, cutting out the tedious, manual work that frustrates analysts. By integrating with alerting tools through the Tines no-code automation platform, Intezer's analysis provides information which can support the analysts decision making process, such as malware classification, false positive reduction, and automated triage. In addition, you can determine the relevant artifacts in each threat, which can then be used for detection content and hunting.

Automating Incident Response with CrowdStrike and Intezer

Many SOC analysts spend much of their time manually triaging and prioritizing new incidents. Ideally, every alert gets attention and a deep investigation in order to determine its risk level and the suitable response. But this time-consuming, manual analysis means teams seldom have the time or resources for proactive hunting.

In this recorded webinar, see how Intezer works with CrowdStrike to automate more of your processes for alert analysis, incident response, and threat hunting.

0:00 Intro with Shaul Holtzman (director of sales engineering @and Intezer) and Matan Matalon (information security manager @ Intezer)
4:22 How security operations are changing and resource shortages 
6:28 Real-life examples of the challenges and alert fatigue for SOC teams
15:07 Issues with expensive outsourced SOC services/MDRs, surface-level investigations, and inconsistent service
19:00 Mapping out the process for autonomous detection and response
23:01 Using Intezer as your virtual, autonomous SOC
24:35 Reused code, techniques, or infrastructure: What makes Intezer's SOC automation different 
28:33 Using automation to power analysis, correlation, and decision making
29:52 Demo: Digging into the details about how Intezer's integration works with CrowdStrike 
and the set up

Advanced Incident Response and Threat Hunting with SentinelOne and Intezer

Hear about our experience running an autonomous security operations center using Intezer's integration with SentinelOne Singularity XDR, present best practices, and dive into real-life scenarios, utilizing advanced forensic tools from Intezer's suite, including memory forensics, reverse engineering, and threat hunting.

00:00 Intro 
3:30 Understanding changes in security operations and resource challenges
17:08 Examples of Intezer in action with SentinelOne
43:41 Q&A

Integrating Intezer with SentinelOne to Automate Incident Response

Here we share how you can use even more automation for triage, incident response, and hunting, during this recorded webinar with SentinelOne and Intezer experts.

0:00 Intro and audience poll about triage for IR
3:00 Shaul Holtzman and Jeremy Goldstein give an overview of the topics they'll cover
4:26 The Setting: Resourcing issues in cybersecurity
8:13 Leveraging automation with SentinelOne XDR
12:50 Autonomous triage, response, and hunting with Intezer & SentinelOne
19:11 Examples: Automated triage of true positive and false positive alerts
22:06 Example: Curated threat hunting
22:48 Example: Advanced endpoint forensics 
23:42 Demo: Digging into how Intezer works and the set up with a SentinelOne API key
27:50 Q & A

- Resources - 
Try for free: https://analyze.intezer.com/
Blog post about using Intezer with SentinelOne: https://www.intezer.com/blog/alert-triage/automating-edr-alert-triage-threat-hunting-sentinelone-integration/
Overview doc about the SentinelOne integration capabilities: https://support.intezer.com/hc/en-us/articles/5750775125532
Documentation about setting up Intezer with SentinelOne: https://support.intezer.com/hc/en-us/articles/4428086109980-Intezer-EDR-Connect
SentinelOne & Intezer solution brief from the Singularity Marketplace: https://assets.sentinelone.com/intezer-jointsb/intezer-malware-analysis

TrustRadius is a technology and business research firm based in Austin, Texas. The company is known as a review platform for verified B2B technology and software reviews through a proprietary algorithm and human verification.

TrustRadius

Home

Digital Forensics Tools