Surprisingly Useful AI Article Enhancements
Network telemetry from ExtraHop RevealX is now helping security operations centre (SOC) analysts detect and stop threats faster, thanks to its integration with CrowdStrike Falcon.
The announcement came during an event in Las Vegas where ExtraHop shared how it is enabling customers to automate detection, investigation, and mitigation workflows by leveraging network telemetry. The ExtraHop RevealX platform can now be used within CrowdStrike’s cybersecurity platform, Falcon Next-Gen SIEM.
SOC teams face growing challenges, including talent shortages, siloed tools, and an overload of alerts. Many are seeking to improve their operational efficiency, speed up response times, and build resilience by automating manual tasks.
With the integration, joint customers can now ingest network telemetry from ExtraHop RevealX into CrowdStrike’s platform, allowing them to orchestrate that data using Falcon Foundry, a low-code application development tool. The goal is to help teams build custom workflows for detecting and responding to security issues.
Automation in Action
When ExtraHop RevealX identifies unusual network behaviours, the Falcon Next-Gen SIEM system collects the alert, correlating it with endpoint detection and response (EDR) data. This enables organisations to take advantage of CrowdStrike’s intelligence and custom-built workflows to respond to threats faster.
Through this partnership, customers can benefit from:
- Rapid detection and investigation: Automated workflows allow for instant investigations when network anomalies are detected.
- Less manual intervention: Automation handles low-priority alerts, freeing analysts to focus on critical issues.
- Scalability: Workflows are tailored to grow with an organisation, keeping security processes effective as the business expands.
ExtraHop’s Chief Product Officer, Kanaiya Vasani, explained the advantage this integration brings. “The ExtraHop RevealX platform gives enterprises unique visibility into security threats as they move through the network. The depth of telemetry collected from the network, combined with other data sources like EDR, helps customers respond to security issues faster.”
Daniel Bernard, Chief Business Officer at CrowdStrike, added, “With access to CrowdStrike’s robust data and threat intelligence, Falcon Foundry allows organisations to create workflows that meet their specific security needs. Network data from ExtraHop RevealX is crucial in identifying and addressing security gaps, helping our joint customers respond to endpoint and network threats quickly.”
Building Custom Workflows
ExtraHop’s RevealX platform focuses on giving organisations a clearer picture of what is happening on their network. By combining this with CrowdStrike’s data and tools, customers can create detection and response workflows that are tailored to their business.
This integration allows SOC teams to act on insights from network telemetry, making decisions more quickly and efficiently. As attacks become more sophisticated, having this level of customisation in security workflows is seen as essential for maintaining a strong defence.
The combination of ExtraHop and CrowdStrike offers organisations a solution that not only improves detection and response times but also makes their security processes more efficient by automating routine tasks.
Last Updated on September 18, 2024 by Nick Ross
