We use cookies to improve your experience. Do you accept?

High Pace, Large Scale: CFTR Enables Efficient Incident Management with Service Level Agreements

High Pace, Large Scale: CFTR Enables Efficient Incident Management with Service Level Agreements - Featured Image

CFTR • Aug 27, 2020

The Cyware Fusion and Threat Response (CFTR) version 2.4 empowers security decision-makers with an advanced Service Level Agreement (SLA) feature.

How does this feature work?

The Service Level Agreement (SLA) feature allows incident managers to define conditions and time limits for the incident response teams to respond to specific incidents within the stipulated SLAs. Using this feature, incident response managers can define SLAs based on various parameters such as incident type, incident severity, business units affected, and geographic location. This customization also allows incident managers to define SLAs based on their order of priority for incident resolution and enables automated assignment of SLAs to appropriate incidents.

Admins can create two types of SLAs:

  • Assignment SLA: It covers the triaging phase of an incident and tracks the time from the opening of an incident to the time when it is assigned to a user.

  • Response SLA: It covers the post-triaging phase of an incident and tracks the time from the assignment of an incident to the closing of the incident.

Setting up the breach limits

To ensure a high SLA compliance, incident managers can also set breach limits along with automated notifications for incident assignees or SOC managers in case an SLA is about to be breached. This feature provides an option to escalate SLA violations by configuring an automated escalation roster, as applicable to the incident. Additionally, users can set a custom order of priority for the applicable SLAs using the “Re-order” function as per the organization’s needs.

Incident management at scale

The SLA feature in CFTR provides several benefits for incident managers and their teams such as:

  • A bird’s eye view for tracking the performance of the incident response teams through dedicated real-time SLA status tracking widgets on the Dashboard. This enables incident response managers to identify the gaps or shortcomings in crucial metrics, such as Mean-time-to Response (MTTR) and Mean-time-to-Detection (MTTD).

  • The incident management process, when coupled with the relevant automation, allows service desk teams and analysts to keep an eye on SLA compliance, and improve performance over time. Organizations can further improve SOC maturity by establishing customizable yet consistent incident management processes for teams spread across different business units or geographic locations.

Conclusion

The key to improving incident response operations is through harmony between people, processes, and technology. The CFTR version 2.4 takes a major step in this direction by enabling security teams to bring their own SLAs to meet complex operational requirements and improve the overall cybersecurity posture.

Related Blogs

Flex Your Threat Response Queries with Cyware Query Language (CQL) - Featured Image

Flex Your Threat Response Queries with Cyware Query Language (CQL)

When it comes to managing a large number of threat data, security analysts have a lot on their plate. It is a cumbersome task to find relevant data just by usin

CFTRUse CaseCyware Query Language (CQL)
Don’t Miss Any Critical Task in Incident Response! Auto-Create Actions Now. - Featured Image

Don’t Miss Any Critical Task in Incident Response! Auto-Create Actions Now.

When an incident occurs, security teams create and define actions manually, which increases their [mean time to respond (MTTR)](https://cyware.com/educational-g

Cyware Fusion and Threat Response (CFTR)CFTRUse CaseAction library
Cyware’s New Multi-Tenancy Dashboard Enables MSSPs to Gain Threat Visibility Across Customer Environments - Featured Image

Cyware’s New Multi-Tenancy Dashboard Enables MSSPs to Gain Threat Visibility Across Customer Environments

[Managed security service providers (MSSPs)](https://cyware.com/cyware-managed-security-service-providers-mssps) must have capabilities to support multiple tena

Use CaseIncident ManagementMSSP dashboardMSSP
Information Sharing for Incident Response Teams is Now Easy with Cyware’s Slack Integration - Featured Image

Information Sharing for Incident Response Teams is Now Easy with Cyware’s Slack Integration

With more security teams working remotely than ever before, team collaboration and communication often become patchy. In our latest release, we have integ

Slack IntegrationCyware Fusion and Threat Response (CFTR)CFTRUse Case
Fact or Fiction: SOAR Can Reduce SOC Alerts by 95% - Featured Image

Fact or Fiction: SOAR Can Reduce SOC Alerts by 95%

The cyber security threat landscape is often exposed to emerging technology being touted as a silver bullet that can stop new and evolving threats dead in their

CFTRCSOLCywareSOAR
Roster Management in CFTR Enables Easier Than Ever 24x7 Incident Management - Featured Image

Roster Management in CFTR Enables Easier Than Ever 24x7 Incident Management

A Security Operations Center (SOC) helps in unifying various security functions to monitor, detect, and respond to complex cyber incidents continuously. For a S

CFTRcyware fusion and threat response
Export Incident Details From CFTR to Expedite Security Collaboration - Featured Image

Export Incident Details From CFTR to Expedite Security Collaboration

Incident response (IR) is a collaborative effort across different security functions within an organization. The [Cyware Fusion and Threat Response](https://cyw

CFTRcyware fusion and threat response
Manage Custom Threat Indicators (IOCs) with CFTR version 2.1 - Featured Image

Manage Custom Threat Indicators (IOCs) with CFTR version 2.1

**What are Custom Threat Indicators?** - **Custom threat indicators** are specialized patterns of relevant observable malicious activities that Incident

Indicators of Compromise (IoCs)cyware fusion and threat responseCyware Security Orchestration LayerCyber Fusion
Unlocking the True Potential of Security Automation in Threat Response - Featured Image

Unlocking the True Potential of Security Automation in Threat Response

We live in an era of accelerated and unprecedented transformation. This global transformation is powered by several technological forces such as automation and

Security OrchestrationSecurity Automationcyware fusion and threat response
Integrating the Human Element to Build Future-Ready Cyber Fusion Solutions - Featured Image

Integrating the Human Element to Build Future-Ready Cyber Fusion Solutions

The partnership between humans and machines is at the very core of modern technology. It can provide us valuable insights into how we can shape products, machin

Cyware Threat Intelligence eXchangeCyware Situational Awareness Platformcyware fusion and threat responseCyber Fusion
Cyware Labs Augments Suite of Cyber Fusion Solutions with “The Human Element” - Featured Image

Cyware Labs Augments Suite of Cyber Fusion Solutions with “The Human Element”

We are excited to announce the release of the enhanced version of our cyber fusion product suite. Version 2.0 includes enhanced threat visualization, indicator

Cyware Threat Intelligence eXchangeCyware Situational Awareness Platform (CSAP)Cyber Fusion and Threat Responsecyware fusion and threat response
Manage Threats, Not Just Incidents! - Featured Image

Manage Threats, Not Just Incidents!

Traditionally, most organizations focused on defensive or reactionary measures against cyber threats. Security products such as those designed to block maliciou

Cyber Threat Intelligence AnalysisInformation Sharing and Collaborationcyware fusion and threat responseCyber Fusion