Exabeam on Tuesday announced two pioneering cybersecurity features, Threat Center and Exabeam Copilot, to its market leading AI-driven Exabeam Security Operations Platform. A first-to-market combination, Threat Center is a unified workbench for threat detection, investigation, and response (TDIR) that simplifies and centralizes security analyst workflows, while Exabeam Copilot uses generative AI to help analysts quickly understand active threats and offers best practices for rapid response. These leading-edge innovations greatly reduce learning curves for security analysts and accelerate their productivity in the SOC.
According to Exabeam's recent The State of Threat Detection, Investigation, and Response (TDIR) Report 2023, organizations globally reported that they can "see" or monitor only 66% of their IT environments, leaving ample room for blindspots. Exabeam customers are already using the Outcomes Navigator feature as a driver to know what parts of their environments they are able to monitor for TDIR and where coverage improvement may still be needed. Threat Center streamlines these processes further to remediate threats against covered areas faster.
The report also reveals that only slightly more than half (53%) of global organizations have automated 50% or less of their TDIR workflow. With Threat Center and Exabeam Copilot, the Exabeam Security Operations Platform applies AI and automation to security operations workflows for a holistic approach to cyberthreats, helping companies solve for a lack of automation and ultimately accelerating response. Powered by AI-driven detection, the Exabeam platform easily pinpoints high-risk threats by learning the normal behavior of users and entities and prioritizing threats with context-aware risk scoring — all now presented through the Threat Center interface — for faster, more accurate, and consistent TDIR. Revealed as the second most identified need in the Exabeam TDIR report –– 35% of respondents reported a desire for improved understanding of normal user and entity and peer group behavior within their organization.
Threat Center unifies threat management, investigation tools, and automation to accelerate and efficiently investigate and respond to threats. Powered by an advanced security-trained, generative AI model, Exabeam Copilot supercharges security analyst investigations.
Threat Center with Exabeam Copilot helps analysts:
- Understand an entire threat that spans multiple detections to tell a complete story of what happened.
- Conduct complex powerful search queries in plain natural language.
- Understand a threat, and know how to respond, using generative AI threat explanations for clear cross-organization communication.
- Automate routine tasks, expose hidden threats, and greatly accelerate response times.
- Prioritize alerts and cases, with context-aware risk scoring.
- Reduce the number of alerts that analysts need to investigate – detection grouping associates related entities and events.
- Optimize SOC team collaboration with case sharing, case escalation, and shared notes.
- Visualize evidence with interactive threat timelines and instant access to relative data including behavioral models, users, and endpoints.
- Author automation rules critical to SOC workflows, such as escalating specific alerts to cases or queues via APIs or webhooks.
- Utilize pre-built playbooks with the ability to view, disable or clone for easy customization.
In addition to identifying high-risk threats, providing faster, more accurate investigation and response, and improving threat coverage, the AI-driven Exabeam Security Operations Platform helps security teams realize the full potential of their security investments. Also announced today, customers can now add Exabeam TDIR capabilities on top of existing Microsoft Sentinel deployments. Extending industry-leading Exabeam analytics and automation to Microsoft Sentinel helps organizations realize new potential from their SIEM.
With Exabeam, Microsoft Sentinel users can see new detections with broader insights and automate workflows, ingest data from a wide range of Microsoft and best-of-breed security products, and accelerate the TDIR capabilities of their SIEM deployment. The Collector for Microsoft Sentinel adds to a growing list of supported SIEM products - Splunk and IBM QRadar, to name a few.
General availability of the new features begins in March 2024.
Steve Wilson, Chief Product Officer, Exabeam
We built Threat Center with Exabeam Copilot to give security analysts a simple, central interface to execute their most critical TDIR functions, automate routine tasks, and supercharge investigations for analysts at any skill level. These new features amp up the value of our AI-driven security operations platform and take analyst productivity, efficiency, and effectiveness to new heights. Threat Center helps security analysts overcome one of the biggest challenges we've heard from them — having to deal with too many fragmented interfaces in their environments. By combining Threat Center with Exabeam Copilot we not only improve security analyst workflows, we also lighten their workload.
Colin Anderson, Chief Information Security Officer, Dayforce
The potential of generative AI to drive accuracy and speed within the SOC delivering increased productivity is becoming a reality through features like Threat Center and Exabeam Copilot. Threat Center will save analysts countless hours by enabling SOC analysts to work from one single interface performing investigations and taking actions against identified threats. The Exabeam Copilot AI virtual assistant will be a force multiplier for SOC teams helping to improve cybersecurity across organizations.
