We use cookies to improve your experience. Do you accept?

Discover Hidden Threat Patterns With Cyware’s "Related Incidents" Feature

Discover Hidden Threat Patterns With Cyware’s "Related Incidents" Feature - Featured Image

Cyware Fusion and Threat Response (CFTR) • Oct 5, 2021

Cyware Fusion and Threat Response (CFTR) continues to set new benchmarks in facilitating a collaboration-driven threat response against cyber threats. Our latest version of the product, CFTR v2.11, will put you at ease by enabling you to add Related Incidents to Connect the Dots section.

What’s New

The Related Incidents tab is now available as a component of the Connect the Dots section. This enables CFTR users to manually access the Related Incidents tab under Connect the Dots section. Moreover, the users can now view the Connect to Incident slider when they click on the Connect Now or Connect More tab.

We have used an industry-first funnel-based architecture that combines both supervised and unsupervised learning approaches to design a system, which is scalable and makes accurate predictions. For the system to make predictions, we employ an automated data generation process and use the existing incidents in the platform to generate the training data. This does not make the users wait to generate the data to train the models, instead, it provides feedback to tune the models to their preferences.

The new functionalities include:

  • Suggested related incidents: This ML-driven functionality will show users the data of the relevant incidents that were previously logged in CFTR. It will help users determine if the suggested incident is analogous to the current incident.

  • All incidents: It will list all the incidents recorded in the CFTR database and enable users to manually select an incident. A user can manually verify if any of the displayed incidents are relevant to the current incident.

  • Show similarities: This capability will display an analogy between related incidents based on different aspects like Title, Description, Incident Type, Severity, Business Unit, Location, Sources, Attack Tactics, and Attack Techniques. It will assist users in making a conclusion based on the comparison.

  • Mark as irrelevant: Users can now mark an incident as irrelevant which will be picked as an input for the ML pattern to suggest incidents. The irrelevant incidents will be considered as feedback for further improvements. This will allow the ML model to learn and tune itself as per the feedback provided by the analyst and make intelligent recommendations.

**How do the Features benefit You? **

The new version of CFTR comes with several refinements and assists users in various ways such as:

  • Better visibility: CFTR users can now uncover correlations between isolated malware, vulnerabilities, assets, threat actors, and other relevant data. This will help them comprehend threat trends, patterns, and abnormalities through an advanced graphical visualization of threats.

  • Improved threat response capabilities: The updated CFTR will force-multiply your threat response capabilities by enabling you to find the latent patterns between isolated threats. This will equip your response team with predictive intelligence, allowing them to effectively respond to threats and break the cyber kill chain.

  • Decision-Making: Based on the suggested related incidents and similarities between them, users can make strategic and informed decisions about a threat. Improved decision-making can help in taking necessary mitigation steps.

Wrapping Up

The addition of the Related Incidents feature puts CFTR a step ahead in terms of providing better visibility and encouraging effective threat response. In a nutshell, CFTR users can now obtain contextual intelligence on sophisticated threat campaigns, determine potential attacker trajectories, and discover hidden threat patterns by connecting the dots between isolated incidents and threats.

Related Blogs

Creating Incident Workflows at Scale is Now Easy with Cyware - Featured Image

Creating Incident Workflows at Scale is Now Easy with Cyware

[MSSPs](https://cyware.com/blog/cywares-new-multi-tenancy-dashboard-enables-mssps-to-gain-threat-visibility-across-customer-environments-aef0) spend a lot of ti

Cyware Fusion and Threat Response (CFTR)Import workflowsExport workflowsCFTR tenants
Visualize and Map Global Security Incidents in Real Time - Featured Image

Visualize and Map Global Security Incidents in Real Time

Geographical awareness plays an important role in the planning and execution of an effective incident response, helping incident responders understand the locat

Cyware Fusion and Threat Response (CFTR)Geo-mapping
Don’t Miss Any Critical Task in Incident Response! Auto-Create Actions Now. - Featured Image

Don’t Miss Any Critical Task in Incident Response! Auto-Create Actions Now.

When an incident occurs, security teams create and define actions manually, which increases their [mean time to respond (MTTR)](https://cyware.com/educational-g

Cyware Fusion and Threat Response (CFTR)CFTRUse CaseAction library
Information Sharing for Incident Response Teams is Now Easy with Cyware’s Slack Integration - Featured Image

Information Sharing for Incident Response Teams is Now Easy with Cyware’s Slack Integration

With more security teams working remotely than ever before, team collaboration and communication often become patchy. In our latest release, we have integ

Slack IntegrationCyware Fusion and Threat Response (CFTR)CFTRUse Case
Connect the Dots with Cyware For a Faster Threat Investigation Process - Featured Image

Connect the Dots with Cyware For a Faster Threat Investigation Process

Threat investigation requires unearthing of complex hidden patterns, more so importantly in present times when threat actors have become highly advanced and are

Cyware Fusion and Threat Response (CFTR)Threat InvestigationUse Caseconnect the dots
Manage Dynamic Workflows with Cyware’s Enhanced Incident Module - Featured Image

Manage Dynamic Workflows with Cyware’s Enhanced Incident Module

For different incidents, organizations often follow the same workflows. The different processes involved in an incident response lifecycle require different fra

Cyware Fusion and Threat Response (CFTR)
Draw Advanced Contextual Intelligence With Cyware’s New Incident Visualizer - Featured Image

Draw Advanced Contextual Intelligence With Cyware’s New Incident Visualizer

With the threat landscape becoming complex, it is imperative for security teams to be able to establish hidden patterns between seemingly disconnected threats a

Cyware Fusion and Threat Response (CFTR)
Cyware’s Approach to Handling Apache Log4j2 Vulnerability - Featured Image

Cyware’s Approach to Handling Apache Log4j2 Vulnerability

Recently, a critical vulnerability has been found in the popular Java-based logging package [Apache Log4j2](https://logging.apache.org/log4j/2.x/). This vulnera

Cyware Fusion and Threat Response (CFTR)Cyware Threat Intelligence eXchangeCyware Situational Awareness Platform (CSAP)log4j2
Cyware Enables Granular Access Control of SOAR Automation Playbooks - Featured Image

Cyware Enables Granular Access Control of SOAR Automation Playbooks

The [Cyware Fusion and Threat Response](https://cyware.com/cyware-fusion-and-threat-response-cftr) (CFTR) platform, in harmony with the [Cyware Security Orchest

Cyware Fusion and Threat Response (CFTR)Cyware Security Orchestration Layer (CSOL)
Shape the Visual Identity of Your SecOps with Cyware's New Threat Response Dashboard - Featured Image

Shape the Visual Identity of Your SecOps with Cyware's New Threat Response Dashboard

The [Cyware Fusion and Threat Response](https://cyware.com/cyware-fusion-and-threat-response-cftr) (CFTR) serves as the home of an organization’s integrated sec

Cyware Fusion and Threat Response (CFTR)
Cyware's SOAR Response Workflow for SUNBURST Attack - Featured Image

Cyware's SOAR Response Workflow for SUNBURST Attack

Over the last several days, the malware tracked by several names including Solorigate and SUNBURST is being used in a widespread campaign termed UNC2452. The ca

Cyware Fusion and Threat Response (CFTR)Cyware Situational Awareness Platform (CSAP)Cyware Threat Intelligence Exchange (CTIX)Cyware Security Orchestration Layer (CSOL)