Logicalis racks up comprehensive and speedy incident response with Cortex XSOAR

Sai and his team set out to streamline their existing services where Logicalis aids in the detection of cyberthreats and provides appropriate recommendations. While the SOC team conducts a thorough analysis of attacks and provides recommendations, the implementation of remediation actions was typically done at the customers’ discretion. Given that a significant number of Logicalis customers are from small-to-mid-sized businesses (SMBs)—often with lean security teams that do not necessarily work on a 24/7 model—they had neither the bandwidth nor resources at their disposal to perform recommendations given in a timely manner. From a cybersecurity perspective, fast detection, implementation, and response are key and something that Sai wanted to change. “Logicalis wanted to provide end-to-end services for our customers, from detection of a cyberattack and to implement changes in (near) real time, through customer-agreed procedures and processes,” he says. This strategy would minimize the attack surface for the customer and also help differentiate Logicalis from best-of-breed service providers in the market.

On another level, Sai wanted to increase the efficiency within his own SOC. It was not practical to scale the number of people within the SOC alongside the business expansion. A keen advocate of automation, Sai wanted to automate mundane and repetitive tasks that were time-consuming. He knew that harnessing the power of automation would free up the time of his analysts, enabling them to direct their focus on more complex and skilled tasks that required their expertise.

To achieve the dual goals of helping customers detect cyberattacks and implement recommendations as well as increasing the efficiencies of the SOC, Logicalis began delving into SOAR technologies. The solution that they were looking at needed to meet the following criteria:

• Provide differentiated services to compete with best-of-breed service providers in the market.
• Offer threat detection and response capabilities to customers by reducing attack surface.
• Ensure expansion of service portfolio as a SOC through automation.
• Increase efficiency within own SOC through faster resolution, end-to-end services and fewer incidents.
• Vendor-agnostic solution that can integrate with and complement other cybersecurity solutions for ease of management.

Logicalis began to scout for SOAR technologies in the second half of 2020. It was imperative that the solution they opted for would integrate seamlessly with existing technologies within the organization. The onset of the pandemic also boosted the need to work remotely and collaboratively; the chosen SOAR solution had to be one that analysts could adapt to easily. The company called for a demo session and conducted a comprehensive proof of concept (PoC).

Besides being vendor-agnostic, Palo Alto Networks Cortex^® XSOAR was the most comprehensive SOAR platform as the solution could be integrated with the existing security information and event management (SIEM) tools Logicalis had in place. In addition, Cortex XSOAR did not require any additional skill training for the analysts’ team at Logicalis. With 700+ out-of-the-box integrations and the rich library of playbooks that cater to organization-wide use cases, Logicalis was able to easily select and customize the playbooks for suitable business use cases with built-in threat intelligence capabilities.

Sai explains, “Logicalis has established a strong partnership with Palo Alto Networks regionally, and we felt supported throughout our enablement process, especially when we required additional help in creating customized playbooks.” Since then, all known issues have been automated, and the team at Logicalis can focus on working on new incidents now.

Since having Cortex XSOAR deployed for approximately six months, it has completely taken over the entire security operations tasks that used to be done by L1 analysts. This means that repetitive incidents and the incident triage (e.g., basic sanity check, creating tickets, updating, closing tickets, data enrichment) are all automated. Alerts related to authentication, firewall denials, audit failures, login failures, and such are all automated. Logicalis has even offloaded the task of calling standby engineers for critical incidents to the Cortex XSOAR playbook, reducing the need for overtime by standby engineers. Today, minimal involvement is required from the analysts.

Going forward, Logicalis is considering extending the SOAR capability to its other GSOCs and is looking at replicating similar automation in other regions worldwide. To sum things up, Sai says, “We have been pleasantly surprised by the extensive support that we have received from the customer success team at Palo Alto Networks.” The team at Logicalis was unfamiliar with SOAR, but when they embarked on the XSOAR journey with Palo Alto Networks, they were brought up to speed in no time at all. He goes on to say, “The level of support provided by the Customer Success team is unrivaled and the playbooks created have brought us immediate and tangible benefits, which we did not think was possible.” Logicalis Singapore has exemplified a high-functioning and effective SOC for the rest of the company’s GSOCs and aims to extend the collaboration between the two companies in the years to follow.