January 15, 2021 By BlueAlly
By Fortinet | January 15, 2021
This is a summary of a Fortinet article written for MSSP Alert. The entire article can be accessed here.
As more companies leverage technology to enhance their offerings, the market for security service providers has grown considerably. This has led to increased competition between MSSPs and third-party service providers, as they both use similar services and target the same market. To remain competitive in the field, MSSPs must provide differentiated service offerings that address their customers’ specific needs. Here is where Fortinet’s FortiSOAR platform can be of use.
FortiSOAR is designed to help SOC teams simplify threat identification and response. By enabling holistic security orchestration, automation, and response (SOAR). With integrated security capabilities, MSSPs are able to unify customer operations with a centralized security framework. This enables MSSPs to customize the SOAR solution and ensure that customer SOC teams can proactively manage the evolving threat landscape.
Essential Features of the FortiSOAR Platform
Organizations across industries are increasingly adopting point solutions to bolster their network defenses and improve threat detection. However, this can create several issues as these solutions decentralize network operations, limiting a SOC team’s ability to identify and respond to threats. This, in turn, increases the number of false positives that SOC teams encounter, leading to alert fatigue and slower response times. With an integrated FortiSOAR solution, customer SOC teams are able to centralize their security operations and streamline threat response. Outlined below are some key features of the FortiSOAR platform that work to improve SOC operations:
Role-Based Incident Management
FortiSOAR’s Enterprise Role-Based Incident Management solution provides SOC teams with comprehensive role-based access control capabilities. This allows them to better manage sensitive data by segmenting their networks and enacting zero-trust protocols. In addition, analysts can prioritize threats in real-time, as they have a centralized view of network assets and usage. Further, FortiSOAR’s Recommendations Engine helps predict the severity of incidents based on past reports, aiding SOC analysts in false-positive identification.
Dashboards & Reporting
Using FortiSOAR’s role-based dashboards and reporting allows customers to analyze and track threat investigations and SOC performance in real-time. FortiSOAR provides a library of out-of-band (OOB) industry-standard dashboards and customizable templates to ensure that customer SOC teams have access to the tools they need to maximize their available time and resources.
FortiSOAR also provides detailed reports covering different aspects of SOC operations, including incident closure, incident summary, and incident progress. The insights gained from these reports help SOC teams easily track performance and identify areas where optimizations can be implemented within their daily operations.
Multi-Tenancy
With FortiSOAR’s scalable, secure, and distributed multi-tenant product offerings, MSSPs are able to offer MDR-like services. Automating tenant workflows remotely allows service providers to streamline customer ecosystem management, thereby improving their overall security efficacy. FortiSOAR also provides customers with personalized alerts, incident views, and dashboards so that they have complete visibility into approval requirements.
Visual Playbook Builder
FortiSOAR’s Visual Playbook Designer gives customer SOC teams the ability to design and develop threat playbooks to maximize threat response without the need for advanced programming skills. By providing an easy to use drag and drop interface, the designer simplifies playbook creation. It comes with over 160 out-of-the-box playbooks that can also be used for additional threat hunting and investigation efforts. The platform also allows SOC teams to automate workflows, beyond just investigations, improving their compliance and vulnerability management capabilities.
Case Management
FortiSOAR enhances case management by providing over 10 OOB modules for vulnerability management, incident response, and fraud. MSSPs are also able to easily build custom modules to meet the individual security requirements of their customers and support their business objectives as they grow.
FortiSOAR Use Cases for MSSPs
FortiSOAR functions as an agnostic solution and part of Fortinet’s integrated Security Fabric, providing unified security tools in a centralized platform. This frees up time for SOC teams as they are able to reduce context switching, while automating alert and investigation processes, allowing them to focus on more critical tasks.
Unified SOC Capabilities
By integrating customers’ point security solutions into a centralized system, FortiSOAR helps eliminate ecosystem fragmentation and create greater visibility into potential network vulnerabilities. This also helps extend the life span of customers’ existing solutions, maximizing their return on investment for security tools.
Automated Alert Triage
To help accelerate threat resolution, FortiSOAR aggregates security alerts and provides context into threats. This enables threat prioritization based on severity levels, subroutines, and assigned tasks to reduce the volume of false positives SOC teams encounter. Through automation, FortiSOAR streamlines resource and time-intensive tasks such as triage, enrichment, and remediation by centralizing alerts from across a network. This helps to reduce SOC team workloads, eliminating alert fatigue and burn out.
Enhanced Incident Response by Augmenting the SOC
SOC operations often include a high number of manual workflows that can hinder alert investigations and increase the risk of human oversight. FortiSOAR addresses this challenge by augmenting the SOC using its ability to automate beyond investigations, while also building off of FortiAnalyzer and FortiSIEM automation features. This helps improve overall security by enabling robust orchestration and automation of all SOC processes.
Automating the SOC also increases operational efficiency. FortiSOAR allows SOC teams to set threshold conditions at which different security controls will be automatically leveraged to achieve a real-time threat response. This reduces incident response times by as much as 98% as FortiSOAR’s automated processes can complete various manual tasks in an average of 20 minutes.
Limiting SOC Team Workloads
Leveraging automation and case management, FortiSOAR reduces the time burdens associated with incident response. With threats growing in complexity, SOC team efficiency has become a vital component of reducing the total cost of ownership (TCO) for security operations. FortiSOAR reduces staff workloads by cutting out the need for manual input during threat response. This also decreases time to detection, which is key to effective threat management.
Final Thoughts on FortiSOAR
With FortiSOAR, MSSPs are able to expand their service portfolios and offer customized solutions that support customer SOC teams as they look to enhance their threat response capabilities. As the SOAR market grows, MSSPs equipped with FortiSOAR can provide differentiated service offerings that allow them to take advantage of new sales opportunities.
