Solution Review: AI Tools Deliver Faster, Better Decisions for Defense and Offense

Description

As cyber missions evolve and intensify, the right Artificial Intelligence (AI) tool is a necessary precondition for success, enabling army networks and network defenders to correlate established metrics with real-time activity data. Whether the immediate priority is defense or offense, an effective response to the modern landscape demands not only faster operational decisions, but the right decisions to counter an emerging threat or take advantage of a strategic opportunity—without requiring high-level data science skills to undertake a mission.

To defend against external threats, an AI system must offer increased speed and more effective response by enabling autonomous active cyber operations. That ability, in turn, depends on a sophisticated system of incident response, threat hunting, forensics, pen testing, and event analytics that gives operators the ability to reduce event clutter, discard false positives, and adhere to a complex set of operational rules. Smart, successful offensive operations depend on a mix of analysis and DevOps to support every step in the cyber kill chain—exploit, control, execute, and maintain.

To deliver on those expectations, the Army requires a technology that optimizes people and process, creating an AI nerve center that gives security teams access to the statistical, visual, behavioral, and exploratory analytics they require to drive deep insights, rapid decisions, and successful action. Participants in this session will learn about a technology stack with the ability to detect and understand a threat, allowing the entire organization to respond in a manual, semi-automated, or fully automated fashion.

The session will introduce two essential resources that should be on every cyber warrior’s desktop: A Security Orchestration and Automation Response (SOAR) tool that reduces the time gap between human reaction and threat response, and resources that helps operators leverage machine learning to address evolving threats as they emerge. With the ability to identify anomalies that may be markers for malicious activity, the Enterprise Security Content Update (ESCU) is a particularly powerful resource for anticipating and repelling cyber threats. Splunk’s computational capabilities give operator the ability to quickly spot and respond to values that significantly exceed the standard deviation for data points like:

• Baseline of DNS query length
• Baseline of SMB traffic
• Baseline of command line length
• DNS query length outliers
• SMB traffic spike
• Unusually long command line

Tracks:

• 
  Solution Reviews

Handouts

• AI Tools Deliver Faster, Better Decisions for Defense and Offense