Elevating Security Alert Management Using Automation | by Josh Liburdi | Brex Tech Blog | Medium

This is an in-depth post that describes the Brex Detection and Response Team’s approach to managing and automating security alerts at scale, and we hope that it inspires other teams in the industry to take their security alert management to the next level using automation! This post covers the following topics; feel free to jump around and reference them as needed: Detection and Response teams manage and build systems that generate alerts and are responsible for triaging those alerts for malice — alert management is what happens between the generation and triage of an alert. Most alert management systems are simple — they present alerts to analysts as quickly as possible — and very few give teams what they actually need: reducing toil through automation. Although these types of systems used to be common many years ago (Sguil is a great example), they are now tightly integrated with SIEMs and have limited use cases outside of the SIEM. Alternate methods of alert management have been pro

This is an in-depth post that describes the Brex Detection and Response Team’s approach to managing and automating security alerts at scale, and we hope that it inspires other teams in the industry to take their security alert management to the next level using automation! This post covers the following topics; feel free to jump around and reference them as needed: Detection and Response teams manage and build systems that generate alerts and are responsible for triaging those alerts for malice — alert management is what happens between the generation and triage of an alert. Most alert managem