Symantec

Smart SOAR integrates with Symantec tools to orchestrate actions across the security infrastructure, minimizing some repetitive tasks and automating others. Smart SOAR can ingest a malware alert from Symantec Endpoint Protection, parse out the IOCs, and trigger a malware-specific playbook, which automatically enriches the alert with threat intelligence and historical data to highlight correlations and quantify risk. The playbook can then trigger automated remediation actions—like quarantining an affected endpoint—or notify the responsible analysts and guide them through the necessary steps.

When a phishing attempt is detected by a tool or reported to the SOC, Smart SOAR can trigger an automated phishing playbook that parses out the elements of the email and checks them against third-party threat intelligence, the MITRE ATT&CK Matrix, and historical incident data. If the email is confirmed as malicious, Smart SOAR can then orchestrate the appropriate response actions, including adding the sender’s IP to blacklists in Symantec Messaging Gateway and quarantining affected endpoints via Symantec Endpoint Protection.