There’s a term to describe what happens to something that gets sucked into a black hole: “spaghettification.” The gravitational pull of a black hole is so forceful, that it is believed to stretch and compress objects into long thin shapes resembling spaghetti.
SOC analysts spend their days trying to avoid being sucked into the black hole of overwhelming security events and alerts. They’re fighting to not be spaghettified.
Day in, day out, SecOps analysts face a staggering deluge of alerts. A recent Vectra AI study found that on average, SOC teams receive 4,448 alerts per day, and spend nearly three hours a day manually triaging them. Startlingly, that same study found that security analysts are unable to deal with 67% of the daily alerts they receive, with 83% reporting that alert alerts are usually false positives and not worth their time.
This overabundance of low-fidelity alerts and false positives clouds the judgment of security teams, and leads to alert fatigue. It’s also dangerous, in that it can distract from more impactful and important security operations, such as proactive threat hunting, strategy optimization, and addressing major vulnerabilities. According to IDC, 30% of alerts are ignored or not investigated due to alert fatigue.
Meanwhile, according to IDC, 83 percent of cybersecurity employees say they’re struggling to cope with the volume of alerts, while 30% of alerts are ignored or not investigated due to alert fatigue.
But all hope is not lost. Torq Hyperautomation provides the rocket fuel to help SOC analysts achieve escape velocity and evade the security events black hole. Through a hyperautomated SOC, a security operations center powered by hyperautomation through which the vast majority – 90% to 95% – of tickets, alerts, events, and incidents are handled and closed by hyperautomation, SOC analysts can eliminate alert fatigue and escape the black hole.
A hyperautomated SOC helps eliminate alert fatigue through a five-tiered approach.
1. Collect the Noise: Millions of Events; One Hyperautomation Platform
First, Torq’s Hyperautomation platform effortlessly ingests event data with limitless horizontal scalability through a variety of mechanisms, such as message queues (AWS SQS, GCP Pubsub, Azure EventGrid,Kafka), direct webhooks, TCP transmission, email, and API polling, just to name a few. This is where we start collecting events. It’s where we embrace the chaos to bring order.
2. Start Filtering: Reduce the Noise 10x
Here, triggered workflow automations apply a 10x reduction filter. This slashes the volume of events from a million to hundreds of thousands. Torq’s technology sifts through the events to identify the data that matters most, zapping out false positives and low-fidelity alerts. Our horizontally scalable events pipeline performs numerous checks, ranging from string and numeric comparisons to more advanced regular expressions. Only the most relevant pieces pass through this stage. No more irrelevant and superfluous logs, events, or alerts get through.
3. Gain Context: Enrich Events With AI
This is where things get really exciting. We use stateful event filtering to reduce noise by 100x. Through intelligent event handling with large language learning models (LLMs), we enrich the
context for each security event.
Your events volume is down to mere thousands now – as opposed to the millions you battled with before – and these are the events you should genuinely care about.
From there, Torq Hyperautomation adds another layer of AI-driven stateful filtering, further enriched with context like threat intelligence, business context, or even historical events. Every event is vetted from multiple angles using LLMs and third-party security tools. Torq hyperautomates 95% of Tier-1 analysis with generative AI, which ultimately empowers you to make faster, better informed decisions.
4. Intelligent Security Case Orchestration: Automatically Triage, Classify, and Remediate 100s of Tier-1 and Tier-2 Cases
At this point, the funnel narrows to just 100s of security cases requiring further action, but they still don’t necessarily require human involvement. Torq Hyperautomation does the heavy lifting by intelligently delegating issues to R&D, DevOps, or related business owners.
If an event makes it this far, it requires serious attention. We’ve already performed significant
noise reduction and filtered out irrelevant events and alerts. It’s time to prioritize what’s critical.
Through Torq’s sophisticated orchestration capabilities, some of these cases may still be handled entirely without analyst involvement.
Third-party integrations like SecOps, DevOps, or application owners have handled vulnerabilities and other findings, and non-compliant assets have been flagged and are now considered exceptions. That, coupled with case management through external communication and ticketing, means you can automatically close about 90% of Tier-1 tickets.
5. Security Analyst Expertise: High-Priority Cases Require Human Intervention
A hyperautomated SOC does not eliminate the need for human intervention. It does, however, ensure that humans are the last, and most critical, line of defense for the most severe and high-priority cases. At this part in the process, you’re left with only critical security cases that have undergone rigorous scrutiny and automated handling. Now humans must intervene. By now, the remaining cases are enriched with valuable data, minimizing the time and effort needed to take appropriate action. Analysts can tap into a library of pre-configured sub-processes, making their operations significantly more efficient.
By the time an event has passed through Torq’s Hyperautomation platform, it has undergone an intense, multi-tiered evaluation and action process, each phase of which is designed to optimize accuracy and efficiency, and, of course, improve your security posture to defend against threats.
Following this five-tier approach can help SOC analysts prevent being sucked into the security event black hole (and avoid spaghettification).
To read more about achieving escape velocity, read our guide “Escape the SecOps Black Hole.” And if you’re ready to hyperautomate your SOC with Torq, request a demo.
