Invinsense MDR: Managed Detection and Response Excellence

Invinsense MDR Includes:

Automated detection and response, automated and human-led detection and response, and human-led threat hunting.

The main objective of Invinsense MDR is to identify potential malicious activities across your technology landscape and neutralize on behalf of your team or in coordination with your team.

Three methods of MDR:

Automated Detection and Response: The integration of SIEM, SOAR, CaseManagement, Threat Intelligence and Threat Exchange and EDR provides automated detection of indicators of potential threats and the system also has an option to neutralize the threats automatically.
Automated and Human Led Detection and Response: In this approach, the integrated security solutions generated indicators are further analyzed by our blue team. It is then neutralized by acting on it combinedly by system as well as humans.
Human Led Threat Hunting: This is completely blue team-initiated investigations of malicious indicators that cannot be detected or prevented by existing security tools and systems.

Invinsense XDR

Infopercept's Extended Detection and Response tool.

Under MDR, the blue team follows the below XDR approach :

Events and alerts are transmitted from source devices to the SIEM.
Threat management feeds and subscriptions send Indicators of Compromise (IOC) and Indicators of Attack (IOA) to the SIEM.
The SIEM aggregates and correlates events, alerts, IOCs, and IOAs based on predefined rules and use cases.
Alerts and incidents generated by the SIEM are sent to the SOAR ticketing system, where they undergo enrichment and triage through predefined and automated playbooks.
The blue team accesses the SOAR platform to triage incidents and follow incident response playbooks that automation cannot yet resolve.
The blue team engages in threat hunting by querying and analyzing events of interest in the big data platform to identify incidents that are categorized as"low and slow" and, as a result, go unnoticed by rule-based correlations.
The blue performs any necessary incident response actions on confidential devices remotely, as agreed upon. If the blue team is unable to take action, confidential will be notified, and a ticket will be created in the "ticketing system" with remediation instructions.