In early 2020, the Contender Solutions SecOps team developed a REST integration that takes advantage of the considerable benefits of Secureworks while allowing the transfer of alerts to ServiceNow’s Security Incident Response application providing access to the vast automation and processing features.
The Secureworks integration provides coordinated alert management features such as
The integration with Secureworks is managed from the ServiceNow platform. Every few minutes (configurable) a REST API call is sent to SecureWorks to obtain new and updated alerts. Security incidents are created or updated at which time SIR automation kicks in. This includes assigning to a triage team, pulling in threat intelligence, scoring risk based on multiple factors including the business criticality level of the at-risk asset, and execution of the workflow.
As analysts work on incidents, they can proactively demand updated data from Secureworks on the fly. Additionally, other integrations can bring in critical information such as running processes and services. The result of this automation is a single pane of glass providing vast information for combatting malicious activity. In the event the analyst needs to access the alert within Secureworks, a link is available directly on the security incident.
The result provides customers with the data and automation required to effectively respond to security threats in a rapid, efficient, and consistent manner ensuring the quickest time to containment.