TruSTAR

Analysts are expected to rapidly investigate incidents, without compromising the process. For many, this means manually cross-referencing and copying hashes and other data from TruSTAR. Over a year in a SOC, this means hundreds of hours per analyst plus some degree of human error. D3 can automatically query TruSTAR for indicators and other relevant data related to new alerts. An analyst can search via the D3 console, and instantly bring over additional field-data. Plus, it’s agile. You can change the integration parameters via our easy-to-use admin tool.

When a potential phishing email is escalated to D3, either through an email protection system or manually by the recipient, D3 extracts the sender’s domain and the URL of any links in the message. D3 can then use TruSTAR to look up those extracted indicators and reveal any associated malicious activity. Based on the result, the D3 user can then trigger a response playbook to block the IP, blacklist the sender, notify the email recipient, and orchestrate any other appropriate actions.