As cited
Copy frozen at (site build).
threat intel
Speeding APT Attack Confirmation with Attack Discovery, Workflows, and Agent Builder
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Speeding APT Attack Confirmation with Attack Discovery, Workflows, and Agent Builder
Elastic Security demonstrates an automated threat response pipeline combining Attack Discovery, Workflows, and Agent Builder to rapidly confirm advanced persistent threat (APT) attacks. The example uses the Chrysalis backdoor deployed by Lotus Blossom through a Notepad++ supply chain compromise to show how agents can autonomously verify malware, search logs, check on-call schedules, create cases, and notify teams within minutes instead of hours.
Why it matters: SOC teams responding to nation-state APT campaigns can reduce confirmation time from 2 to 6 hours to under 4 minutes, allowing faster isolation of compromised systems and limiting attacker dwell time; analysts using natural language queries no longer need expertise in query languages or index patterns to hunt threats effectively.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Speeding APT Attack Confirmation with Attack Discovery, Workflows, and Agent Builder
Elastic Security demonstrates an automated threat response pipeline combining Attack Discovery, Workflows, and Agent Builder to rapidly confirm advanced persistent threat (APT) attacks. The example uses the Chrysalis backdoor deployed by Lotus Blossom through a Notepad++ supply chain compromise to show how agents can autonomously verify malware, search logs, check on-call schedules, create cases, and notify teams within minutes instead of hours.
Why it matters: SOC teams responding to nation-state APT campaigns can reduce confirmation time from 2 to 6 hours to under 4 minutes, allowing faster isolation of compromised systems and limiting attacker dwell time; analysts using natural language queries no longer need expertise in query languages or index patterns to hunt threats effectively.
- Source published
- First seen by Cybersecurity Tracker