We use cookies to improve your experience. Do you accept?

Cyware Enables Granular Access Control of SOAR Automation Playbooks

Cyware Enables Granular Access Control of SOAR Automation Playbooks - Featured Image

Cyware Fusion and Threat Response (CFTR) • Aug 6, 2021

The Cyware Fusion and Threat Response (CFTR) platform, in harmony with the Cyware Security Orchestration Layer (CSOL), equips security teams with the ability to form an end-to-end automated threat management workflow. CSOL Playbooks are the key to unlocking this capability within CFTR. Now, Cyware has set yet another industry-first milestone by introducing Role-Based Access Control (RBAC) of CSOL Playbooks within CFTR to provide admins with greater control over how their automated processes are executed.

How does RBAC help?

The new RBAC feature for CSOL Playbooks in CFTR allows admins to restrict the usage of their Playbooks to specific User Groups depending on the User Group configuration. This means organizations using CFTR can now gain several benefits including:

  • Improved operational efficiency : With RBAC, organizations can decrease the need for manual processes for adding or changing the roles of different users. It also makes it quicker to onboard new users into a pre-defined role with the appropriate access to CSOL Playbooks within CFTR.

  • Increased visibility : RBAC gives SOC admins and managers more visibility and oversight into their security operations, while also providing the right level of access to authorized users for all the Playbooks they need to do their jobs.

  • Enhanced compliance : This new feature helps cut down on potential errors or lapses in assigning user permissions. It reduces the risk of leakage of sensitive security data to any unauthorized users. This means no undue access will be given to users for any sensitive information and, therefore, much less risk of violating any security policies or regulatory compliance.

How to use RBAC in CFTR?

The RBAC feature for CSOL Playbooks in CFTR ensures that SOC Managers/Incident Managers can provide a restrictive set of permissions like editing or running specific Playbooks, or preventing access to view Playbooks depending on the Playbook category.CFTR Admins need to enable RBAC access under the CSOL Integrations in the Configurations section.

  • Once enabled, CFTR admins will be able to set RBAC Validations when creating a new User Group. One of the ways to do this is to allow access to specific sets of Playbooks through Playbook Tags. This will then allow the corresponding User Group to view only the Playbooks associated with those Tags under Playbook Run Logs, Machine Learning Suggested Playbooks and All Playbooks.

  • When View Access is given to a User Group, the users can view the Apps and Sub-Playbooks associated with those Playbooks. With Edit Access, they can further update, edit, or run the Playbook as well.

CFTR also now allows Admins to set access to the Terminal module along with RBAC Tags configuration under User Management. With View Access, users can view the Terminal Module in a read-only mode. With Edit Access, they can view, update, edit, or run an Action in the Terminal Module.

**One more thing **

To make incident response processes seamless, CFTR now enables users to execute dynamic CSOL Playbooks from within CFTR. This means users get the ability to configure and implement custom scripts, devise workflows, check conditions and actions on their incident response plan. Users can access the Playbooks from CSOL under the Incidents and Actions module in CFTR.

Conclusion

With the addition of the RBAC for CSOL Playbooks and the Terminal Module, CFTR makes the lives of security decision-makers much easier in overseeing their security processes with business function and responsibility in mind. This marks yet another step for Cyware toward enabling streamlined orchestration and automation of security operations for organizations worldwide.

Related Blogs

Creating Incident Workflows at Scale is Now Easy with Cyware - Featured Image

Creating Incident Workflows at Scale is Now Easy with Cyware

[MSSPs](https://cyware.com/blog/cywares-new-multi-tenancy-dashboard-enables-mssps-to-gain-threat-visibility-across-customer-environments-aef0) spend a lot of ti

Cyware Fusion and Threat Response (CFTR)Import workflowsExport workflowsCFTR tenants
Visualize and Map Global Security Incidents in Real Time - Featured Image

Visualize and Map Global Security Incidents in Real Time

Geographical awareness plays an important role in the planning and execution of an effective incident response, helping incident responders understand the locat

Cyware Fusion and Threat Response (CFTR)Geo-mapping
Don’t Miss Any Critical Task in Incident Response! Auto-Create Actions Now. - Featured Image

Don’t Miss Any Critical Task in Incident Response! Auto-Create Actions Now.

When an incident occurs, security teams create and define actions manually, which increases their [mean time to respond (MTTR)](https://cyware.com/educational-g

Cyware Fusion and Threat Response (CFTR)CFTRUse CaseAction library
Information Sharing for Incident Response Teams is Now Easy with Cyware’s Slack Integration - Featured Image

Information Sharing for Incident Response Teams is Now Easy with Cyware’s Slack Integration

With more security teams working remotely than ever before, team collaboration and communication often become patchy. In our latest release, we have integ

Slack IntegrationCyware Fusion and Threat Response (CFTR)CFTRUse Case
Connect the Dots with Cyware For a Faster Threat Investigation Process - Featured Image

Connect the Dots with Cyware For a Faster Threat Investigation Process

Threat investigation requires unearthing of complex hidden patterns, more so importantly in present times when threat actors have become highly advanced and are

Cyware Fusion and Threat Response (CFTR)Threat InvestigationUse Caseconnect the dots
Manage Dynamic Workflows with Cyware’s Enhanced Incident Module - Featured Image

Manage Dynamic Workflows with Cyware’s Enhanced Incident Module

For different incidents, organizations often follow the same workflows. The different processes involved in an incident response lifecycle require different fra

Cyware Fusion and Threat Response (CFTR)
Draw Advanced Contextual Intelligence With Cyware’s New Incident Visualizer - Featured Image

Draw Advanced Contextual Intelligence With Cyware’s New Incident Visualizer

With the threat landscape becoming complex, it is imperative for security teams to be able to establish hidden patterns between seemingly disconnected threats a

Cyware Fusion and Threat Response (CFTR)
Cyware’s Approach to Handling Apache Log4j2 Vulnerability - Featured Image

Cyware’s Approach to Handling Apache Log4j2 Vulnerability

Recently, a critical vulnerability has been found in the popular Java-based logging package [Apache Log4j2](https://logging.apache.org/log4j/2.x/). This vulnera

Cyware Fusion and Threat Response (CFTR)Cyware Threat Intelligence eXchangeCyware Situational Awareness Platform (CSAP)log4j2
Cyware Orchestrate Appstore: One-Stop Shop for Third-Party Integrations - Featured Image

Cyware Orchestrate Appstore: One-Stop Shop for Third-Party Integrations

A good orchestration solution must integrate with a wide variety of security, DevOps, and IT products and tools. What differentiates an advanced orchestration s

Cyware Security Orchestration Layer (CSOL)
Level Up Your Incident Response Process with Cyware's Enhanced Automation Playbooks - Featured Image

Level Up Your Incident Response Process with Cyware's Enhanced Automation Playbooks

Every security team wants to diligently respond to an incident or a threat. We give them a magic wand in the form of Playbooks to help them quickly detect, resp

Cyware Security Orchestration Layer (CSOL)
Discover Hidden Threat Patterns With Cyware’s "Related Incidents" Feature - Featured Image

Discover Hidden Threat Patterns With Cyware’s "Related Incidents" Feature

[Cyware Fusion and Threat Response (CFTR)](https://cyware.com/cyware-fusion-and-threat-response-cftr) continues to set new benchmarks in facilitating a collabor

Cyware Fusion and Threat Response (CFTR)
Shape the Visual Identity of Your SecOps with Cyware's New Threat Response Dashboard - Featured Image

Shape the Visual Identity of Your SecOps with Cyware's New Threat Response Dashboard

The [Cyware Fusion and Threat Response](https://cyware.com/cyware-fusion-and-threat-response-cftr) (CFTR) serves as the home of an organization’s integrated sec

Cyware Fusion and Threat Response (CFTR)