Security Orchestration

D3 has built the entire MITRE ATT&CK matrix into its platform to create ATTACKBOT, a powerful tool that works in tandem with D3’s orchestration capabilities to detect and disrupt advanced attacks. When D3 detects one of the hundreds of attack techniques catalogued by MITRE, it treats it as a link in a possible “kill chain”—the steps an adversary might take to reach their goal. Then ATTACKBOT orchestrates queries across all integrated systems, such as firewalls, SIEM, and endpoints, to uncover traces of other links in the kill chain. As more elements of the attack are found, ATTACKBOT can orchestrate response playbooks to address the attack, or place targeted IOCs under persistent Kill Chain Surveillance to gather more information.

D3 can orchestrate processes across your entire security infrastructure, via more than 400 integrated apps and actions. D3’s feature-rich integrations with SIEM, firewall, endpoint, and other systems make it the heart of the SOC. Analysts can do virtually all of their tasks without switching screens. D3 doesn’t rely on users’ scripting abilities or community-built integrations either. All integrations are pre-built, so you can simply drop them into your playbooks.

D3’s deep library of out-of-the-box playbooks makes orchestrating both human and machine processes an efficient and repeatable process. D3’s playbooks are fully customizable to an organization’s unique needs, via the Visual Playbook Editor. Automated steps can be added simply by dragging and dropping the action into the playbook, and D3’s prebuilt integrations handle the rest. Orchestration isn’t just about software, so the Visual Playbook Editor makes it easy to guide the actions across a team of analysts as well, ensuring consistent workflows and minimizing the risk of human error.

When an alert is ingested, D3 parses all the important elements—such as URLs, IP addresses, file hashes, and user IDs—and checks them against threat intelligence databases, past incidents, and other data sources. By the time an analyst views the alert, it is fully contextualized and given a risk score, based on any known malicious elements in the event. Because D3 integrates across the entire security stack, its contextual data doesn’t just include third-party threat intelligence, it also correlates across all of your security tools and databases.