Name: Friday Flow Episode 2: Threat Intelligence Enrichment
Start: 2023-09-11T09:46:00Z
End: 2023-09-11T09:46:08.000Z
Location: BrightTALK
Rating: 0

Smart, secure workflows for your whole team. The world's best companies
— from startups to the Fortune 10 – trust Tines to powerfully manage their
mission critical workflows, automatically responding to and remediating
alerts in real time.

On this Friday Flows Jesse Strivelli shares a side-by-side comparison of an automation written in Python & built in Tines.

The workflow is around triaging alerts for an eCommerce business. The goal is to ingest the alert, enrich & get further analysis, and take action if there's a high-risk score.

Jesse has been a software developer at Fortune 100 organizations for most of his career. And while coding remains near & dear to his heart, he shares how building in Tines now saves him time & headaches.

Friday Flows Episode 12: Building in Python vs Tines with No Code

The question of the week from a customer was: “How do we use Tines with our Infrastructure-as-Code methodology?”

Today we’re looking at how to automate processes around Terraform Cloud, like documentation, opening tickets, and getting approval for changes in the cost of the infrastructure.

Use this workflow to save time, maintain consistent records for audits, and manage incremental infrastructure costs.

Friday Flows Episode 11: Respond to & configure Terraform Cloud run task

Join Tines co-founder and CEO Eoin Hinchy for a deep dive into the Voice of the SOC 2023 report(https://www.tines.com/reports/voice-of-the-soc-2023)
As well as highlighting key findings from the report, Eoin will share data-driven strategies for tackling key security leader challenges like increasing workloads, employee burnout and employee turnover.

The report follows 2022's Voice of the SOC Analyst. In 2023, we expanded the scope beyond the United States to include Europe, and sought perspectives from 900 security professionals up to and including the C-suite, rather than just analysts.

This is a great opportunity to learn more about the biggest challenges facing security teams today, and how to solve them, so please do join us. Don’t worry if you can’t make it on the day - registrants will receive a recording after the webinar.

Voice of the SOC Report– Key findings

What happens when a team member reports a lost laptop on a Friday evening? In most cases, it doesn't get locked down by IT until Monday morning 

Enter automation. This Tines story created by Conor Dunne allows users to mark the device as lost and prevent further access through Jamf.

Conor & the Labs team will be recording more walkthroughs like this & adding them directly to the Story Library to help you bring them to life in your tenant.

Friday Flows Episode 10: Lock Down Devices with JAMF & Duo Security

A common challenge we hear from IT teams is the constant barrage of requests for applications.

These can come from new hires, people transitioning roles, consultants & third-parties, etc.

Whitney Young runs through a great story using Tines pages where folks can initiate a self-serve application request that triggers an automation workflow to:

1. Open a new Jira ticket
2. Slack the IT team for approval
3. Grant or deny access for a specific amount of time
4. Remove access when time expires

Friday Flows Episode 9: Grant Temporary Application Access with Pages

This week’s Friday Flows features our first Community-built story. Big thank you to Christopher Cutajar for sharing his “Manage Elasticsearch and GKE clusters via Slack” workflow and for highlighting the great work of his team at Elastic overall.

"As a team, we've built quite a lot of stuff. Both Tines and Elastic are easy to work with & provide value not just with security, but provide a platform for anyone technical or non-technical to enable the business."

Friday Flows Episode 8: Manage Elasticsearch and GKE clusters via Slack

The majority of SOC teams are overworked & under-appreciated. Generally, they get flooded with alerts. There aren't enough human beings or resources to deal with the volume of alerts.

So teams will 'turn down' their SIEM solutions so that they can deal with a realistic volume.

The downside is that you're going to miss alerts you should deal with & you're going to get a lot of false positives."

Stephen Creedon shares a highly popular Tines workflow to do the opposite: turn your SIEM (Elastic) up to 100 and let smart, secure workflows built by you & powered by Tines take care of the analysis for you.

Friday Flows Episode 7: Elastic Alert Response with Cases & Slack

Cloud security is a fast-changing and dynamic environment which results in many teams struggling to know what is serious and what is noise.

Tines helps teams quickly remediate known threats while effectively triaging the new. Providing a user-friendly interface to build automation Stories, teams are able to quickly create new workflows, utilizing native AWS APIs to create solutions based on their team’s needs.

In this session, learn how teams are able to quickly create new workflows with Tines, utilizing native AWS APIs to create solutions based on each use case. This presentation is brought to you by Tines, an AWS Partner.

To learn more head over to our AWS Marketplace listing.

AWS Re:Inforce - Empowering Cloud Security Teams to do More with Less

In the first instalment of "Tines, securing your cloud infrastructure" we look at two stories designed to save money and resources and close potential security gaps in your AWS environment. Our first story monitors AWS IAM access keys and automatically deactivates any that are older than 30 days. Our second story looks at automatically stopping and starting EC2 instances that may have been spun up for testing purposes.

Securing your Cloud Infrastructure with AWS

The strides in GenAI have been remarkable this year, but we're all still trying to figure out how to impact our day-to-day work. 

In this demo, we use AI in the best way we know how to at Tines: by speeding up a security analyst's work and making their life a little easier! 

Use ChatGPT to normalize alert formats, in this case from CRWD. Alerts from multiple sources are converted into a standard format for easier processing by a SOC, and a ticket is then created.

Friday Flows Episode 6: Normalize Alerts with ChatGPT

Spending too much time enriching, analyzing, and administering CrowdStrike alerts?

Our #1 CrowdStrike Story can help you automate your EDR playbook by digesting the alert, automatically enriching the alert, opening a case, creating metrics, and notifying the right analysts when needed.

Then need to take a response action?

Tines can help facilitate that process too with Cases. From one place, multiple tools can be connected painlessly.

Friday Flows Episode 5: Analyze CrowdStrike Detections

This Story will run a given CrowdStrike RTR command against a provided Host ID. All default RTR scripts can be used.

Friday Flows is highlighting a few CrowdStrike-related stories ahead of Fal.Con later this month.

Friday Flows Episode 4: Run a Crowdstrike Realtime Response Command

Employee onboarding & offboarding. Often owned by both IT & security, and ripe for automation to help reduce repetitive manual work & human error.

Topics covered:
1. How Tines uses Tines.
2. A demo of New Hire Onboarding with systems like BambooHR, Atlassian, Okta, and Slack.
3. How PathAI is saving 45 minutes per onboarding request compared to manual processes.

Friday Flows Episode 3: Employee Onboarding & Offboarding

First in a series of short videos showing a simple use case in each episode. In this episode we run through an overview of what Tines is and how it works.

Friday Flows Episode 1: Tines Overview

Lead technical resources for Tines and KnowBe4 walk through the integrations that allow security teams to automatically identify and respond to phishing emails through PhishER. We’ll discuss how you can create efficiencies within your security program by combining Tines automation with KnowBe4.

Identify and respond to emails fast through PhishER

Professionals working in cyber threat intelligence (CTI) - They enjoy playing detective, investigator, researcher, analyzer, and communicator.  With Tines, now there's a better way to quickly get answers for some of the most common questions that can tip off 
more strategic (read: exciting, fulfilling, meaningful) threat intelligence research. Hybrid automation helps to replace the tedious, repetitive technical collection and contextualization steps to get to the "good stuff" where the security professional shines.  Tines now has the ability to follow you via a browser extension and provide enrichment for IoC's any time you'd like.  Below we will walk-through how you can quickly create a browser extension with Tines and start enriching IP's.

Building a Chrome Extension in Tines

Watch the full Tines demo to learn why the world's best companies — from startups to the Fortune 10 – trust Tines to powerfully manage their mission-critical workflows, automatically responding to and remediating alerts in real-time.
Book a custom demo of Tines at https://www.tines.com/

Tines Product Demo

Friday Flows

Join Blake and Chris as they talk through Threat Intelligence Enrichment

Friday Flow Episode 2: Threat Intelligence Enrichment

Security as a Service

Automation

No-Code

Threat Intelligence

SaaS

Security

Cyber Defence

Automation Workload

soar

Security Awareness

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

Enterprise applications have become a crucial piece of infrastructure for many businesses. The enterprise applications community on BrightTALK features the latest insights in enterprise application integration, enterprise application architecture and EAS software. Join the community to gain access to thousands of videos and webinars presented by recognized enterprise information systems experts and arm yourself with the knowledge you need to succeed.

Enterprise Applications

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Friday Flow Episode 2: Threat Intelligence Enrichment

Presented by

About this talk

More from this channel