Why Torq’s Momentum Mirrors the Exponential Adoption of No-Code Security Automation

In just three quarters since Torq was officially launched, our visionary team has delivered a 385% increase in customers, resulting in 360% quarter-over-quarter growth. We’ve also boosted our headcount by 150% and now have more than 100 technology integration partners, including Armis, Orca, SentinelOne, and Wiz. In addition, we recently opened new offices in the UK, Spain, and Taiwan

Our no-code security automation innovations are paying dramatic dividends for our ever-increasing customer base. We serve organizations of all sizes as they face incredibly challenging, complex, and dramatically-escalating cyberthreats. We’re mitigating those threats at every conceivable incursion point, and emancipating overworked security teams from manual, reactive processes, so they can focus on remediation and response.

I take Torq’s dedication to providing our customers the highest level of protection very personally. I began my career as a technologist and software engineer, then shifted into the world of cybersecurity, and then became an entrepreneur when I co-founded Luminate in 2017 and Torq in 2021. I was inspired by seeing how many earlier industries were revolutionized by automation

Back when I began my career as a software engineer, all my software testing was done manually. We had QA engineers repeating the same testing procedures over and over on each and every build of my product to verify it worked correctly. That era is long gone. Today’s modern software development processes benefit from automated QA on multiple levels. Manual testing is exclusively the domain of the most complex and creative tasks, if it’s done at all.

The Security Operations world is now increasingly harnessing the value of automation. Previously, the industry was based on simply delivering “alerts” about potential malicious activity and “reports” on vulnerabilities or misconfigurations, all of which had to be reviewed and dealt with manually. Virtually everyone understands this model is archaic and creates more problems than it solves. 

Both of Torq’s production environments, which include running in the cloud, and our often SaaS-based business line applications, are rapidly evolving. It’s simply not scalable to conduct manual security operations across these complex scenarios. It’s why organizations of all types and sizes are harnessing the potential of automation to ensure continuous compliance and the strongest security posture possible. 

This change is akin to an industrial revolution for cybersecurity and it’s why Torq is experiencing such significant adoption. We’re working with organizations from Fortune 10 goliaths to high-velocity startups and solving major cybersecurity challenges for all of them. They’re all dealing with similar issues as they strive to protect myriad assets from the tens or hundreds of thousands of security events they face daily. Without automation, there simply isn’t a way to effectively mitigate the situation.

I couldn’t be more pleased to see the positive benefits our customers are experiencing. And I couldn’t be more proud of the Torq team that’s so dedicated to pushing the technological envelope. They’re constantly delivering new innovations to make the customer experience as simple, yet powerful and comprehensive as it can be.

We’ve only just begun the Torq journey. I can’t wait to show you everything that’s coming up in the near- and long-term. Our customers and employees represent a true community. It’s our pleasure and privilege to play such an important role in protecting today’s digital-first organizations.

Torq Announces 385% Customer Growth and 360% Revenue Increase

Torq Also Announces Visionary Additions to Executive Team, 150% Headcount Growth, New EMEA and APAC Offices, and Expanded Partner Ecosystem.

PORTLAND, Ore.—Torq, the leader in no-code security automation, today announced 385% customer growth, a 360% revenue increase, and 150% headcount expansion across the last three quarters. The company has also appointed visionary new executive leaders with the addition of CFO Yaron Bartov, and Head of Security Aner Izraeli, as well as opened new offices in the UK, Spain, and Taiwan. In addition, Torq now has more than 100 technology integration partners, including Armis, Orca, SentinelOne, and Wiz.

Torq’s expansion underlines the rapidly-growing adoption of its platform that enables security teams from Fortune 100 companies to startups to create automated security workflows and streamline processes to respond to threats faster, and deliver best-in-breed cybersecurity defenses across their organizations.

“Torq’s dramatic growth trajectory is evidence of the significant market fit for our no-code security automation platform that empowers security teams of all sizes to implement and deploy the most robust cyberdefense postures at scale,” said Ofer Smadari, co-founder and CEO of Torq. “Torq’s easy no-code automation is enabling digital-first enterprises to overcome the cybersecurity challenges they face when shifting to the cloud by blocking the exponentially-increasing volume of threat incidents. Torq also relieves overworked security teams from dealing with time-consuming, manual, reactive processes, and false positives, so they can focus on high-value remediation and response.”

Torq’s latest additions to its executive team possess comprehensive cybersecurity experience from prestigious companies, further strengthening its ability to deliver the most positive customer and employee outcomes possible. New Torq CFO Yaron Bartov was previously the CFO for GuardiCore, and Vice-President of Finance and Operations at Wix.com. Aner Izraeli, Torq’s new Head of Security, previously served as Information Security Manager for Intezer, and helmed SIEM/SOC incident response at Outbrain.

Rapidly-Growing Customer Success and Traction

Customers that have deployed Torq have quickly ramped up their active workflows by 3.5X, which showcases the increasing usage and traction for its platform. Every customer is now ingesting and processing hundreds of thousands of daily cybersecurity events, using Torq to both shield them from impact, and ensure strict compliance with standards such as NIST and MITRE.

“Torq’s unique no-code security automation approach has fundamentally transformed and accelerated our security team’s ability to rapidly identify and remediate cybersecurity threats,” said Yaron Slutzky, Chief Security Officer of Agoda. “With Torq, Agoda has significantly advanced its cloud security posture, and brought a new level of rigor to security operations. Torq’s pre-built workflows enable us to easily deploy cybersecurity defenses at scale throughout our organization, mapping to countless different use cases, and protecting us across multiple conceivable incursion points.”

Expanding Partner Ecosystem

Torq’s no-code security automation platform is also driving extraordinary partner traction, with more than 100 technology partners now a part of its ever-expanding community. Torq technology partners play a critical role in driving adoption, integration, and visibility for Torq’s evolving offerings.

“Together, Torq and its partners help customers make the most of their cybersecurity investments by automating processes throughout the entire security stack and delivering best practice workflows for security operations across dozens of partner platforms,” said Eldad Livni, co-founder and Chief Innovation Officer of Torq. “We’re constantly developing and unveiling new security automation innovations at a rapid pace with complete partner integration to deliver unparalleled protection.”

“Through our partnership with Torq, we recently announced Armis Enterprise Workflow Automation (EWA), a new module for security automation and threat response workflows,” said Peter Doggart, Chief Strategy Officer of Armis. “Security teams now have a seamless and rapid experience to build event-triggered workflows, no matter how simple or complex the process, and no matter how many tools are involved.”

Last June, Torq also established the Torq Automation Alliance, a first-of-its-kind channel partner program. The alliance is designed to maximize the benefits partners deliver to customers by providing streamlined access to Torq’s platform, enablement, and marketing materials. Torq Automation Alliance members can also leverage Torq’s knowledge base and template library to address virtually any security process.

To learn more and get started with Torq, visit Torq.io.

About Torq
Torq is a no-code automation platform for security teams. Torq allows any security professional to connect to any system, anywhere, and easily create automated workflows that streamline security processes. Fortune 100 enterprises and cutting edge startups alike trust Torq to help them maximize their cybersecurity investments, respond to threats faster, and deliver protection at the speed of business.

Media Contact:
MikeWorldWide (MWW) for Torq
Krista Couch
[email protected]

Why Templates Deliver Critical Best Practice Workflows For Maximizing Enterprise Security

It’s difficult for even the most advanced security teams to stay on top of evolving incursions and ensure their processes effectively map to prevent them. That’s where pre-built templates come into the conversation. No-code, security automation templates can handle the considerable burden of having to maintain and update processes that integrate with a company’s security stack.

Having the right systems, tools, and people in place are essential for effective cybersecurity postures. But while templates may sound unsexy, they’re the critical connective tissue that helps enable all three to significantly mitigate the hundreds of thousands of daily cyberthreats the typical enterprise encounters. They also ensure modern compliance requirements are proactively and accurately addressed.

Comprehensive Templates for Comprehensive Security

Torq now offers hundreds of security workflow automation templates aligned to MITRE, NIST, and Defense-in-Depth standards. Security teams of all sizes can easily use these templates to rapidly boost incident response speed. They all deliver impressive time to value and ease of use for security teams of all sizes.

Available at no extra cost to Torq customers, these templates are entirely ready to deploy, with minimal configuration. They’re specifically designed to enable security teams of all levels to instantly deploy workflows across their infrastructure and third-party app ecosystem to identify and block cyberthreats before they have a chance to make a significant impact.

Torq templates can be deployed with a single click across thousands of security integrations and vendors. Torq developed its templates in conjunction with its 100+ ecosystem partners, including Orca, Wiz, Armis, and SentinelOne, to ensure customers can build out and standardize their security processes at cloud scale. They enable large security teams to focus on bigger-picture security management. And they dramatically reduce the workload for smaller teams overwhelmed by parsing endless security alerts, rather than focusing on critical threats.

How Torq Templates Mitigate Critical Security Events

Our expansive template library addresses hundreds of critical security scenarios, including:

  • Third-Party Identity Lifecycle Management—Workflows can vet all external network access, ensuring contractors and partners are approved, current, and can only engage with systems and data they are authorized for. Torq templates cross-check identity against IdM and SSO systems such as Okta. If a potential incursion is identified, Torq automatically shuts down the account, and alerts the security team to take further action.
  • Contextual Threat Hunting—Integrates with services like SentinelOne endpoint security to harness its alerts, and automatically enrich its findings. Torq’s template infuses reports with additional critical data from threat intelligence services such as VirusTotal, to detect suspicious files, domains, IPs, and URLs, as well as to identify potential malware and other breaches. The enriched data delivers a comprehensive contextual view into the alert for security teams to rapidly understand and mitigate the situation, as well as prevent further related attacks.
  • Cloud Security Monitoring and Remediation—Ensures storage classes like AWS S3 are protected with advanced encryption, or are appropriately publicly accessible, according to company policies. If a service such as Wiz or Orca detect that a storage class is improperly classified, Torq automatically collects the relevant data, and sends a critical alert to a security analyst to rapidly remediate the issue.

Get Access to Torq Templates Now 

Already a Torq customer? You can find our comprehensive Template Library here, or by clicking ‘templates’ on the left-hand menu in the app, just below your existing workflows. 

Get Started with Torq, Today

Not using Torq yet? Explore some of our most popular templates and see how Torq’s no-code automation accelerates security operations to deliver unparalleled protection. 

5 Questions to Ask When Developing an Automation Strategy

This post was previously published on The New Stack

Automation is like running a marathon. It sounds like a great and noble pursuit until you actually go out and start pursuing it. At that point, it’s easy to fail if you don’t prepare yourself ahead of time for the challenges that are inherent to the process.

Indeed, although automation can provide a number of awesome benefits, whether you actually reap those benefits depends on how easy it is to implement and manage automation tools. And, as many teams discover, doing these things may be harder than it often seems.

That’s why it’s critical to take a balanced approach to automation by being strategic about what and how you automate. Keep reading for a discussion on what to consider before developing an automation strategy for your team or business.

The Pitfalls of Automation 

If you work in IT or security, you probably don’t need to be reminded about why automation is theoretically useful. You already know about automation’s theoretical benefits: It can save time, reduce toil, reduce errors and so on.

What’s easier to overlook, however, are the potential pitfalls of automation. If your organization isn’t actually ready for automation, or the automation tools you choose are not a good fit for your organization, automation can do more harm than good.

Specifically, automation may lead to problems like:

  • Slower tool deployment because your team struggles to manage the complex configurations required to implement automated workflows.
  • High rates of false positives and negatives because your automation tools are not configured properly for your environment.
  • Dependency on key employees to manage automation tools because only those employees know how the tools work or have the skill sets to support them.
  • Half-baked automations where some parts of your workflows are automated but others are still manual, and no one is sure which is which.
  • The automation of poor processes, which results in problematic processes being performed faster. It would be better to step back and redesign a flawed process than apply automation to it.

To avoid these pitfalls, you need to take a measured and systematic approach to automation. Rather than jumping head-first into automation tooling without having a plan about how to deploy or manage it, ask yourself these questions.

1. What Will You Automate?

Although it’s tempting to imagine that you’ll automate everything, almost no one does that. There will always be some processes that you operate manually, either because you lack tools to automate them, or they don’t occur frequently enough to benefit from automation.

So, sit down ahead of time and identify the specific processes you plan to automate. Make your choices based on how much benefit you’ll gain by automating each process, as well as how easy it will be to automate it.

Keep in mind, too, that some processes should be only partly automated. For instance, maybe you need to grant just-in-time access to a user. Elements of the process like identifying the user and confirming current access rights can be automated. But confirming whether that access is warranted can be left to a human.

2. Who Are the Automation Stakeholders?

Deploying automations can change the way a number of teams or individuals work. You should identify who those people are and how automation will affect them.

If you deploy security automations, for example, not only your security teams will be impacted. Network engineers, developers, IT engineers and so on also may be affected.

Make sure you have plans in place to communicate to all stakeholders how automation will affect them and how they need to update their workflows as a result.

3. Who ‘Owns’ Automations?

Along similar lines, it’s important to determine who is responsible for maintaining automations and dealing with any unintended consequences of them.

Who will ensure that automation tools are updated to support a new type of resource? Who will document how the automation tools are deployed and configured? Who will be held responsible if an automation tool generates a false negative and you miss a risk as a result?

If you don’t have clear answers to these questions, you run the risk that your automations won’t be properly maintained, and that they’ll create chaos within your organization.

4. Why Are You Automating?

Your rationale for adopting automations should never boil down to “because automation is good.” Instead, be specific in determining the outcomes you hope to achieve.

Are you automating in order to speed up workflows? To reduce toil? To do more with fewer engineers?

By answering these questions, you ensure that you can accurately assess the impact and return on investment of your automation initiatives. Otherwise, you are left in the position of having a vague automation agenda and a low ability to justify your automation investments.

5. Do You Have the Skills to Automate?

Last, but certainly not least, it’s absolutely critical to ensure that your teams have the skills necessary to deploy and maintain automation tools.

This is vitally important because some automation tools are much harder to configure than others, no matter how easy they are to use once set up. A SOAR, for example, is great if it’s carefully tailored for your environment, but configuring it may require writing a lot of custom code and policies – processes that could be out of your reach if you don’t have skilled security engineers and developers at your disposal. On the other hand, security tools like Torq, which is designed to be easy enough so that even non-technical users can create security automations, require fewer skills to deploy effectively.

The point here is that you need to take a close look at your organization’s skill sets, as well as the automation tools you plan to use and make sure they are in alignment before you commit to automation.

Conclusion

Automation is great, but only when you wield it wisely. Instead of automating just to automate, be sure you have a purpose, a plan and automation tools aligned with them to maximize your chances of automation success.

 

Ready to begin automating with Torq?

Get Started

How Chatbot Automation Benefits Security Teams

This post was previously published on The New Stack

When you hear the term “chatbot,” your mind may at first turn to things like robotic customer support services on retail websites – a relatively mundane use case for chatbots, and one that is probably hard to get excited about if you’re a security engineer.

But, the fact is that chatbots can do much more than provide customer support. They can also do things like streamline security automations and help teams to work together more efficiently when identifying, researching and reacting to threats.

If that’s not exciting to security engineers, we don’t know what is. Keep reading for details on how chatbots can help security teams work smarter and faster, while also maximizing the benefits of other security automation tooling they have in place.

What Is a Chatbot?

A chatbot is an automation tool that can disseminate information, facilitate conversations and/or undertake actions in response to commands.

Some chatbots are designed to simulate human actors, meaning they are supposed to be able to have conversations that are similar to those you could have with an active human. However, not all chatbots work in this way, (and those used for security automation usually don’t). In a more generic sense, a chatbot is any type of tool that helps to streamline conversations, not necessarily a tool designed to simulate human conversational intelligence.

How Security Chatbots Work

In the context of security operations, chatbots can be deployed to initiate and manage conversations among human actors about security activity.

For example, a security chatbot could be configured to announce in a Slack channel that a security risk has been detected. From there, engineers who are part of the Slack channel could ask the chatbot for further information about the threat, such as which logs are associated with it or what the severity level of the threat is. In some cases, they may also be able to issue commands to the chatbot to direct it to take automated actions, like blocking an offending IP address.

When chatbots are used in this way, they enable a ChatOps approach to security operations. ChatOps is a practice that uses automated chats – meaning conversations between human and machine actors – to streamline workflows and the sharing of information.

The Benefits of Chatbot Automation for Security Operations

By leveraging chatbots for automation in this way, security teams gain a range of benefits:

  • Centralized communication: Chatbots help to provide a centralized communication interface that all stakeholders can use when researching a security incident. Since interactions with the chatbot are visible to multiple actors, information is as visible as possible, and everyone can track the status of security incident response.
  • Simplified response: Instead of having to sort through backend systems manually to view context about security events, engineers can ask chatbots directly to provide that information in a shared channel. Not only does this save time, but it also helps to ensure that everyone sees the same information.
  • Always available: Unlike human engineers, chatbots never sleep – or even get distracted. That means that they can instantaneously announce new threats or updates on an existing security workflow, regardless of the time of day or who is on call.
  • Record of response: The chat that chatbots facilitate becomes a record of the actions taken in response to an incident. If you need to determine who did what after the fact, you can use your historical chat data to do so.

In all of these ways, chatbots and ChatOps effectively serve as a front door to security automation. Although chatbots on their own don’t enable full security automation (for that, you need a security automation framework), they provide a centralized, user-friendly interface that stakeholders can use to request information or trigger automated security workflows.

Getting Started with Security Chatbots

What makes chatbots even better in the context of security is that they are relatively easy to set up. And if you have a security automation tool like Torq, you can take advantage of built-in integrations with chat platforms like Slack or Teams to deploy bots in just a few steps.

Once deployed into the chat system of your choice, chatbots provide a frontend for interacting with the rest of your security automation framework. You can also configure custom commands (like Torq slash commands), which your team can then use to trigger whichever actions they want from your chatbot.

You don’t need a chatbot to take advantage of security automation. But, chatbots can help you to take maximum advantage of other security automation tools you’ve deployed. They centralize security operations and maximize visibility, no matter which communication tools your team uses.

Automated Threat Intelligence Enrichment: An Overview

This post was previously published on The New Stack

Discovering security threats is good and well. But, in many cases, simply knowing that a threat may exist is not enough.

Instead, you also need threat intelligence enrichment. Threat enrichment plays a critical role in helping to evaluate and contextualize threats, root out false positives and gain the insights necessary to mitigate risks as efficiently and quickly as possible.

Keep reading for a primer on how threat enrichment works, why it’s important and where to look to get key insights from threat intelligence data.

What Is Threat Intelligence Enrichment?

Threat intelligence enrichment is the process of gaining context through security threat data in order to better understand the threat.

For example, imagine you’ve detected port scans against your servers. You know the IP addresses of the hosts from which the port scans originated, but you don’t know much more than this.

In this case, threat intelligence enrichment could include insights such as where the offending servers are located and which operating systems they are running. This information may, in turn, be useful for determining whether you’re dealing with a probe against your network from a generic botnet or a port scan operation that originates from a more sophisticated group of attackers, like state-sponsored actors. Threat intelligence enrichment could also inform you whether port scans like the type you’ve experienced are associated with any specific known risks, like a pervasive malware attack recently launched against other organizations.

All these additional threat data insights would provide you with the information you need to react as intelligently and efficiently as possible to block the threat. They would also help you know how dangerous the threat might be. For example, a threat from a generic botnet is probably less risky than a targeted attack by sophisticated threat actors, and threat enrichment helps you know the difference.

Which Threat Enrichment Data Do You Need?

The data that threat intelligence enrichment provides can vary widely in scope and form. In general, however, the more data you have to contextualize a threat, the better.

At a minimum, threat enrichment data should include information about where a threat originated, which resources it affected and when the threat was detected or was active. You should also determine whether the threat was correlated chronologically with any separate attacks or attempted attacks that took place against other systems.

In some cases, threat intelligence enrichment can go deeper. For example, as noted above, threat enrichment might provide details about whether the pattern of security events you’ve witnessed is associated with a specific type of attack or group of attackers. This type of information is usually generated by security researchers who systematically study cyber events.

Threat Intelligence Data Sources

There are many ways to obtain threat data that enables threat intelligence enrichment. You should take advantage of all threat intelligence sources available to you.

Start by compiling as much data as you can from your own internal systems to provide context on a threat. This includes information like the time a threat was detected and the systems it affected, as noted above.

You can also use threat intelligence databases or feeds, which record information about known threat types, patterns and actors. Some of these sources, like MISP, are free and open source. Others are proprietary. They either require subscriptions , or are built into proprietary security platforms you use.

Automating Threat Intelligence Enrichment

You can, of course, manage your threat intelligence data manually by correlating and comparing it by hand.

That approach, however, is not practical at scale. A better strategy is to usef automation tools like Torq, which provides continually updated threat intelligence by automatically collecting enrichment data about threats that may affect your business. An automated approach to threat intelligence enrichment not only saves your team time, but also helps you take full advantage of as much threat data as possible.

Putting Automated Threat Enrichment to Use

To a large extent, you can automate the operationalization of threat intelligence data by using it to drive automated workflows. You can, for example, configure specific actions based on threat enrichment data.

In some cases, however, threat enrichment will require some manual effort. In the case of complex threats, your team will need to study enrichment data by hand to determine the best course of action.

But in general, you should take advantage of automation wherever possible. The more you automate, the faster you can block threats and the lower your overall security risk.

An Introduction to Automation Basics

Automation is a powerful tool. With some foresight and a little elbow grease, you can save hours, days, or even months of work by strategically automating repetitive tasks. What makes automation particularly beneficial is that it eliminates manual interaction with multiple systems.

Rather than manually uploading data to an event response system or notifying key support personnel of an incident, tying these tasks together through automation can reduce critical time and help resolve problems faster and more efficiently. But, before we can fill in the gaps between all of the platforms we are responsible for, we first need to understand how data moves around on the web and how we can use that process to our advantage.

How Automation Works

To begin automation, we first have to understand how data gets moved around on the web and what methods are available for connecting different services. In the real world, we have phone calls and emails to coordinate between different entities, but on the web, we have “protocols.” The most common protocols for moving data from one service to another are arbitrary HTTP requests, formal APIs, and webhooks.

HTTP Requests

The World Wide Web is built almost solely on the concept of HTTP requests. These are the requests that browsers make to push and pull data from the websites they are interacting with. While this data is often interpreted and rendered as HTML, so-called arbitrary HTTP requests can be used for much more.

Whenever data is requested to update a website (such as the current weather, news, or any other type of information), a simple GET request is made to a target address, instructing its underlying server that you are trying to retrieve some information. This information can be used to build internal dashboards and automation tools, or even for more advanced use cases like supplementing information within Torq.

On the flip side, when data needs to be pushed back out (such as when a web form is filled out and submitted), a POST request is made. This is a great solution for automatically filing support tickets or sending emails using third-party platforms without formal API support.

Third-Party APIs

Speaking of API support, one of the most common ways to automatically send and receive data within online services is through the use of formal APIs. An API (or, for the truly unititated, an Application Programming Interface), is a set of contracts that can be used to interface with a third-party application.

In the case of the web, APIs are generally powered by HTTP requests, but with a bit more formality. They offer official support for things like authentication, authorization, and rate limiting, in addition to stability and longer-term commitment to the request contracts. In other words, if you need to integrate with a third-party service to either push or pull data, using an API is far more stable than using arbitrary HTTP calls.

Webhooks

The unintuitively named “webhook” is a web-based endpoint that listens for data from some external source and reacts to it in a pre-defined way. Rather than manually (or repetitively) polling for data using an HTTP request or third-party API call, a webhook can be used to receive that information as soon as it is made available. Think of it like an API, but in reverse.

For example, Slack, Twitter, Stripe, and many other providers can send JSON-formatted payloads to any defined address, allowing you to update internal databases as information changes in real time, or even trigger Torq workflows for more complex operations.

Choosing Your Automation Methods

Connecting an unknown number of services and systems together is no mean feat. It can require a lot of coordination and planning to ensure that the defined automations work as expected, and even then, there is always a chance that the method used to integrate those services won’t stand the test of time.

So, how do you choose an automation method? When is a webhook a better choice over an API call? When should you use an API call over an arbitrary HTTP request? There are a lot of variables to take into account, but it generally comes down to weighing your needs against what’s possible.

Speed vs. Reliability

It’s no secret that an API is far more reliable than an arbitrary HTTP request, but sometimes developing against an API requires more work and overhead than a simple HTTP call. When connecting multiple services into a cohesive automation, determining your risk profile when it comes to speed versus reliability is key. Proofs-of-concept and non-mission-critical integrations are common scenarios where it might make more sense to quickly create an HTTP request instead of an equivalent API call.

Time-Sensitivity

Webhooks are incredibly useful when you need to react to the data as it changes, but this may not always be what you need. Maybe you want to update data on a slower cadence (such as daily or weekly), or maybe you want to batch the events that get triggered by changes in webhook data. A good rule of thumb is that if changing data has time-sensitive consequences like alerts or other automations, then webhooks are the way to go (if available); otherwise, you can feel free to pull the data down only when you need it.

Building Your Automation Workflow

Successful automation is a game of checks and balances and how you connect multiple systems together is often a balance of what is possible and what is practical. Sure, integrating with formal API specifications across all of your platforms might be the “right” way to do things, but it’s important to also consider the time cost of doing that work.

Sometimes, a combination of simple HTTP requests and webhooks can solve for your specific use-case while cutting down on implementation time. Ultimately, what matters is that you take into account how quickly you can spin something up given the available solution paths and how stable it needs to be when making decisions about integration.

To ensure a more consistent and frustration-free experience with automations, platforms like Torq can help establish these connections for you. Torq provides hundreds of pre-built integrations that can perform common security tasks across other tools. This eliminates the need to adapt or expand the interface to the API, and can even help consolidate multiple API calls into a single pre-built action.

Whichever you choose, preparing yourself with the knowledge of various benefits and liabilities for each model will start you on the path to success.

JSON Basics: Building Blocks for Workflow Automation

Automation workflows add a lot of value to an organization’s day-to-day operations. At a minimum, they streamline the execution of complex, multi-step processes, thereby allowing people to focus on higher-value tasks. On top of that, automation workflows can provide valuable insights through the metrics that they gather – including the number of requests, the date and time they were requested, the time it took to complete each request, who made the request, and much more.

At first, automated workflows functioned much like a basic assembly line, where workers only know how to perform one step in the whole process.  Now, modern automation solutions like Torq’s no-code platform are able to use the data passed into a certain step, together with the data generated in that step to make decisions about retries, failures, and next steps in the process.

In the beginning, these workflows functioned much like a basic assembly line, where workers only knew how to perform one step in the whole process. Now, modern automation solutions can use the data that’s being passed into a certain step, together with the data that’s generated in that step to make decisions about retries, failures, and where to send the request next.

This is especially important when it comes to security and auditing. While gathering more context to achieve a more complete record of what is happening, that context can also be used to decide what a requester can send or receive at each step. For example, while someone in the payroll department can access salary data that someone on the helpdesk cannot, both can see who the employee’s manager is.

JSON Basics

Since modern intelligent automation workflows are built around their data, that data needs to have a consistent format across all steps in the workflow. The format that Torq uses to contain that data is JavaScript Object Notation, better known as JSON. Because JSON is a text-based, self-describing format, it is easy to work with and very flexible. Compared to older and more formally structured formats like XML (eXtensible Markup Language), it requires less overhead to process and less storage space to archive. It is also easier to extend on the fly without needing to refactor multiple schemas to ensure backwards compatibility.

JSON Basic Structure

JSON is also human-readable, since it is based on the concept of key:value pairs and follows basic formatting rules. In this case, the only purpose of white space is to make it easier for humans to read. You must use a valid format, which normally means beginning and ending with curly brackets (i.e. { }), although square brackets (i.e. [ ]) are used in some cases. In addition, every element except the last one needs to be followed by a comma so that everyone knows there are more values to follow.

In the following JSON key:value example, the keys are shapes and the value of each key is the number of corners that the shape has.

{    “triangle”: 3,

    “square”: 4,

    “octagon”: 8

}

Basic JSON key:value Example

Data Types

When it comes to values, there are really only three data types. However, the values can be stored in arrays or objects, as defined below:

TypeDescriptionExample
StringAlphanumeric sequence (written in double quotes).“day”: “Saturday”“time”: “2021-03-11”
NumberAn integer (not in double quotes).“guestsNumber”: 25
BooleanValue can be true/false (not in double quotes).“surpriseParty”: false

Note: Numbers and Boolean values don’t need to be contained in quotes. However, string values and key names must be contained in quotes.

What Is a JSON Object?

JSON objects are items defined with multiple unique key:value pairs below them. Objects are contained within curly brackets, which is why most JSON data that is handled within these workflows will start and end with curly brackets. In fact, all of the data used within a workflow is one single object containing multiple sub-objects.

If we extend our previous example to include the number of sides as well as corners, we’ll end up with a unique object for each shape:

{    “triangle”: { “sides”: 3, “corners”: 3 },

    “square”: { “sides”: 4, “corners”: 4 },

    “octagon”: { “sides”: 8, “corners”: 8 }

}

JSON Object Example

JSON Arrays

Now you know how to create simple key:value pairs and unique objects. Sometimes, however, you need to record things as data using a common format, but the data itself is unique for each item. In such cases, you would define an array using square brackets ( [ ] ) around the set of key value pairs that need to be stored in the data.

For example, you can make a single object called “shapes” that contains an array for the data: 

{    “shapes”: [

        { “type”: “triangle”, “sides”: 3, “corners”: 3 },

        { “type”: “square”, “sides”: 4, “corners”: 4 },

        { “type”: “octagon”, “sides”: 8, “corners”: 8 }

    ]

}

JSON Array Example

How to Use JSON to Reference Data

Now that you know what the structure of JSON looks like and how easy it is to follow, we’ll explain how to address specific places inside the JSON data. To do so, you can either target the retrieval of the current state or grab an entire array.

Referencing JSON Objects

Let’s start with the basics of accessing data from an object. JSONpath is built using dot notation, which is a common type of syntax used in many programming languages to access the properties of an object. The basic JSONpath for accessing an entire object is “$.” These two characters will be at the beginning of every JSONpath in Torq.

For instance, to access the value of “triangle” in the first example (a simple JSON with a few key value pairs), you’d begin the path with the root “$.” and add the name of the key that you want to retrieve. So, in our example, “$.triangle” would return the value of 3.

Let’s say you wanted to access something that’s multiple levels down in the object. Using the JSON in the second example, you’d build on the base of “$.triangle” and add “.sides.” So, in this case, “$.triangle.sides” would return the value of 3.

Referencing JSON Arrays

Arrays are handled slightly differently, since they consist of multiple instances of data in a single object. To access data in an array, you can use square brackets and specify the desired record number. Or, if you leave the square brackets off, you’ll get the entire object back. For instance, using the JSON in the third example, you’d start with the base and ask for all of the records in shapes with the “$.shapes” JSONpath. You would use “$.shapes[0]” if you only wanted the first record. (In JSON, record numbers start at zero, not one.)

You can also pull back the number of sides in every record without pulling the rest of the data. The syntax is similar, except that you replace the index number with a colon to access all records. So, “$.shapes[:].sides” would return “{ 3,4,8 }” as the result.

Once you’ve mastered the art of navigating JSON, you can start to do more advanced filtering within JSONpath. Using the third, “$.shapes[?(@.sides>5)]” would return a record of every shape in the array that has more than 5 sides.

There are many online tools that you can use to validate that these examples really work (like JSONpath.com). In addition, Stefan Goessner has a great reference page with more examples of filtering and syntax.

JSON-Based Workflows

Now that you know what the data structure looks like in JSON, as well as how to reference specific values in that data with JSONpath, you have the option to build highly customized workflows to bring sanity and a sense of control to the most challenging manual work within your organization……Not that you’d need it, since Torq offers data-driven, zero-code security automation. They also provide documentation with more information about JSON and some advanced examples of JSONpath. To learn more about what Torq brings to the market, you can begin by checking out their Getting Started page.

SentinelOne Integrates with Torq, Streamlining SOC Workflows with Automated Incident Response

Joint Solution Leverages SentinelOne Security Data for Improved Alert Triage and Remediation

June 28, 2022 09:00 AM Eastern Daylight Time

MOUNTAIN VIEW, Calif.–(BUSINESS WIRE)–SentinelOne (NYSE: S), an autonomous cybersecurity platform company, today announced a new integration with Torq, a no-code security automation platform. The combination of SentinelOne and Torq allows security teams to accelerate response time, reduce alert fatigue, and improve overall security posture.

“SentinelOne’s powerful intelligence and protection helps security teams protect their employees and customers – no matter how complex the environment,” said Eldad Livni, Chief Innovation Officer, Torq. “With Torq, security teams can extend the power of SentinelOne to systems across the organization to automate workflows, respond faster, maintain/boost compliance to benefit from a proactive security posture.”

The SentinelOne integration with Torq combines SentinelOne’s powerful detection and protection with Torq’s no-code automation, enabling customers to limit alert fatigue, respond to threats at machine speed, and proactively identify and remediate risks. Torq makes it easy for security teams to create automated workflows, with a drag and drop workflow builder and hundreds of templates aligned with industry best practices and frameworks from MITRE and NIST. With robust data from SentinelOne, the Torq solution has access to more high-fidelity threat data for improved enrichment, accelerated response times, and alert fatigue reduction.

Torq workflows can listen for SentinelOne alerts, and ingest these to trigger action in any security or operations tool. The solution deploys out-of-the-box in minutes with no coding, installation, or ‘connectors’ needed. Key benefits of the integration include:

  • Real-time threat enrichment – automatically enrich alerts from any system with data directly from SentinelOne Singularity.
  • Automated remediation – remediate threats with fully autonomous or partially autonomous remediation workflows to accelerate mean time to respond.
  • Optimize SOC workflows – clearly and quickly orchestrate threat hunting, information sharing, and ticket creation for vulnerability management.
  • Bot-driven collaboration – Create no-code interactive chat bots that allow users to perform critical actions, run deep visibility queries, or control SentinelOne endpoints from within Slack or other chat tools.

“The SentinelOne-Torq integration provides joint customers with a powerful combination of best-in-breed automated security solutions,” said Ruby Sharma, Head of Technical Partnerships, SentinelOne. “Not only are customers utilizing industry leading endpoint protection and XDR, they also have access to innovative security automation tools that can accelerate workflow automation. We are pleased to make this integration available via the Singularity Marketplace, and we look forward to expanding our offerings to address even more use cases.”

The SentinelOne-Torq integration is available via SentinelOne’s Singularity Marketplace. For more information visit www.sentinelone.com.

About SentinelOne

SentinelOne’s cybersecurity solution encompasses AI-powered prevention, detection, response and hunting across endpoints, containers, cloud workloads, and IoT devices in a single autonomous XDR platform.

Contacts

Will Clark 
fama PR for SentinelOne 
E: [email protected]

Automatically Update URL Blocklists in Zscaler Using Torq

Blocking access to certain URLs is a simple, effective strategy for protecting users and the network. But, in a world where new and increasingly sophisticated scams seem to appear almost weekly, the task of maintaining that list can become overly burdensome when performed manually. 

Torq offers a number of ways to automate URL blocklist management, reducing manual effort and speeding up response to new threats.

How to automate URL blocklists using Torq

All Torq users have access to the pre-built workflow template Add and Remove URLs from the Global Blacklist (Zscaler). This flow will use the Torq chatbot to check URLs on request, then add to a global blocklist in Zscaler if needed. 

The default applications in this workflow are Slack and Zscaler, for chat and network security respectively. However, these can be customized with just a few clicks. 

Here’s how it works:

  1. A user sends a request to the Torq bot, either to check an unknown URL or to remove a previously-blocked URL. 
  2. If removing, the bot will return the associated information from Zscaler and ask to confirm removal before finishing the process. 
  3. If adding a new URL, Torq will return the associated categories from Zscaler, and ask to confirm the block request.
  4. Torq performs the requested action within Zscaler, then generates an updated list of blocked URLs. 
  5. The Torq bot then sends a confirmation of the request, along with the updated list for the user to reference. 

A portion of the Torq workflow for automating URL blocklists in Zscaler

This is a good example that shows how simple, off-the-shelf templates from Torq can help you automate security tasks in just a matter of minutes, giving analysts time back for higher impact work.  

Get the workflow template

Already a Torq customer? You can find this workflow and dozens more in the Torq template library. There you can find other network security workflows, like Analyze Suspicious URLs and IPs in VirusTotal, Block Malicious Files as IOCs using CrowdStrike, and Create IP Penalty Box with Timeout using Cloudflare

Get Started Today

Not using Torq yet? Get in touch for a trial account and see how the no-code security automation platform unifies your security, infrastructure, and collaboration tools to create a stronger security posture.