1const e=`Imagine you ran a newspaper and had a team that brought you various pieces of news to publish. Of course, you couldn't just post everything, that would quickly become overwhelming for your readers, and soon they would stop paying attention. You have to pick only the most exciting stories that people would find interesting and valuable. 2 3Humans are tempted to pay less attention to information that contains more noise than exciting parts. We are prone to becoming tired and lose interest. This also happens even to security team members who are overwhelmed with alerts. 4 5In a nutshell, this is what your SOC team needs from smart tools: just the most interesting and helpful information. You need a high-quality filter to select only those alerts which are likely to have an impact. 6 7## The Hive - Incident Response platform 8 9Think about The Hive as the guardian dog of your digital system. As soon as a threat is detected, a ticket is created containing all the necessary intelligence to assess the situation. 10 11The incident gets a code, and it is linked to the IP source and destination. Once these are established, the platform checks these IPs against an existing known list of suspicious IPs. If a match is found, the system evaluates the damage and comes up with possible solutions. 12 13As in a real hive, the analysts can collaborate on a case and bring ideas and pieces of evidence to speed up the patching process. 14 15## Arcanna - the trustworthy filter 16 17The role of [Arcanna.ai](https://www.arcanna.ai/) is to help analysts focus only on the most critical alerts by filtering out the false positives and low-priority warnings. The AI-powered platform learns from thousands of previous incidents recorded as logs that make a situation noteworthy and automatically classifies each alert. 18 19The primary roles of Arcanna are noise reduction and alert fatigue reduction. It achieves this by automating the alert triage process, an otherwise overwhelming task due to the volume of alerts and data in an organization. 20 21## Machine learning to manage incident response 22 23The combination between Hive and Arcanna creates a robust incident management system. 24 25The alert triage system powered by Arcanna filters the alert data lake automatically. It classifies the alerts and only alerts SOC team members about those issues which could escalate into real threats. 26 27The number of potential cases is an issue on its own since continuously monitoring hundreds of alerts in chronological order instead of risk priority could result in handling minor threats and missing out on critical incidents. 28 29This is where the machine learning algorithm proves very useful: the neural network looks at each alert, classifies it as either positive or false positive. 30 31The ones that make it through the AI filter are turned into tickets which are then served to the NOC or SOC teams. 32 33## Document threats and automatize further 34 35Using tools like Arcanna and The Hive follows the same steps as manual investigation, only much faster and more accurate. Sometimes a solution doesn't even require human intervention as long as the alert is low priority and there is already a decision pattern for that type of situation. 36 37The tools can open the ticket, perform the necessary actions, validate that there is no longer a threat, and close the ticket. The escalation is reserved for complex cases which don't have a well-defined procedure from previous similar situations. 38 39The great news, in this case, is that after the SOC team found a solution, it can create a template with it in Hive and automate similar issues once they arise, thus simplifying their work and speeding up the system. 40`;export{e as default};
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.