At Torq, we like to say “if it talks, we can connect to it.” Our limitless integrations are what set us apart from the pack. 

Our hyperautomation platform connects to any system seamlessly, no matter its complexity. It’s our open architecture that empowers this dramatic unification of your tech stack, and lets you maximize your security investment while enhancing efficiency and effectiveness of your security operations.

One of our key tech partners is Abnormal Security, the leader in email security. With Torq and Abnormal, you can orchestrate and automate response to email security events, analyze emails and their attachments, and automatically perform remediation actions. 

Here’s a look at two use cases in which Torq and Abnormal combine powers:

Account Takeover

This use case is simple, but effective, and is designed to help you protect your organization in the event of an account takeover.

When Abnormal Security detects a compromised email account, Torq sends an alert to the chosen collaboration platform – Slack or Teams – to notify response teams and the user that their account is suspended. In some instances, Torq can also request clarification from the user regarding the alert. From there, the account can be suspended or locked in Okta or in Microsoft Entra ID.

This use case also gives the option to communicate with the user first to give them a heads up of the compromise and that their account will be locked or suspended. There is an option in the workflow to kill all of the users authorized sessions to the organization’s resources, as well.

This use case is designed specifically to ensure that a compromised account can’t cause more damage. 

Without Torq, the time from detection to remediation would be longer, giving the bad actor more time to impersonate a valid authorized user. With Torq, the response is immediate. 

Post-Breach Remediation

This use case solves an all too common problem: an email is classified as malicious after a user has already interacted with it. 

It works like this: Torq fetches all of the pertinent details, such as the user affected, the device, and the geography. 

If there was a malicious file in the email that was opened or downloaded, Torq triggers a scan in the EDR, determines if other users received or interacted with the email, and isolate and delete that file. From there, you can add the file hash to your EDR block list or, if it’s a link, you can search for communication to the bad actor and if it happened in other places in the organization. activities from the organization.

Those are just two ways Torq and Abnormal work together to automate and improve email security. If you’d like to see this integration in action, schedule a demo.

One of the superpowers of the Torq Hyperautomation platform is the ability to integrate with anything. We team up with leading security vendors to combine forces to create automations that make SOC analysts’ lives easier while also improving their organizations’ security posture.  

In our latest blog series, Hyperautomation Cheat Codes, we look at some of Torq’s key partners and highlight some of the automations that we pair up on. In fact, we make it so easy it’s like you have a cheat code (and it usually takes fewer steps than Up, Up, Down, Down, Left, Right, Left, Right, B, A, Start).

In this post, we’ll talk about how to automate Recorded Future using the enterprise-grade Torq Hyperautomation platform to level up how your organization collects, processes, analyzes, and disseminates threat intelligence.

Here are the top four Torq and Recorded Future automations:

Analyze URLs and Files in Recorded Future Sandbox

In three simple steps, this workflow submits URLs to Recorded Future Sandbox for analysis.

1. URLs in the urls_list are submitted as URLs and are analyzed as a website.
2. URLs in the files_url_list are downloaded and analyzed as a file in the sandbox.
3. Both lists are verified to have valid URLs here submitted to analysis, other values are removed

Boom! It’s that simple to use Torq and Recorded Future to analyze URLs and files in the sandbox. 

Enrich Hashes, CVEs and IP Addresses with Recorded Future

The focus of this automation is for users to receive a message with one or more CVEs, SHA256 hashes, or suspicious IP addresses from Slack and enrich the data with Recorded Future.

The first step is receiving a Slack message that extracts all indicators of compromise (IoCs). Then, it confirms the extracted IoCs with the requesting user. If provided in the event, the CVE detail is enriched and the Slack thread is replied to. The same is done for hash details and IP details if they’re provided in the event. 

The results are then sent to the Slack thread where the request originated.

Monitor an Outlook Mailbox for Phishing With Recorded Future

Thwart phishing attempts by cutting them off at the pass!

With this workflow you can automatically scan the messages arriving to a specific folder in Outlook with Recorded Future and Recorded Future Sandbox to look for malicious or suspicious URLs and files. The workflow looks for messages in the folder labeled “Not-Scanned” and uses Microsoft 365 Delegated access for easy setup on a mailbox.

The message headers will also be extracted and the public IP addresses that are not outlook.com domains will be looked up for a verdict in Recorded Future. 

After that, the workflow will also attempt to look for additional attachments at the top level of the message that are included and scan them – nested file attachments will not be scanned.

When results are found in either Recorded Future or Recorded Future Sandbox, the label on the email will be updated to indicate either Torq Investigated, Suspicious, Malicious, and/or Phishing (this workflow automatically creates the necessary labels in the mailbox if they do not exist). Then an email is sent back to the originator of the message with the findings.

TIP: Setup an Outlook rule that moves messages into the scan folder and sets the Not-Scanned category on the message.

Detect Impossible Travels In Okta Logins

This workflow analyzes users’ successful logins from different locations within a three-hour timeframe. If the end user does not accept ownership of a login, account hijacking is suspected and can be remediated by resetting that user’s password. When the password is reset, the user will receive a link by email to create a new password.

This workflow triggers only on successful logins and maintains the user’s login history using global variables. It obtains the geolocation of the source IP and compares it with the geolocation of the last login to find the distance between the two locations.

It can use VirusTotal and Recorded Future to enrich the source IP reputation. 

Those are just three of the myriad integrations Torq offers with Recorded Future to improve how your organization collects, processes, analyzes, and disseminates threat intelligence. Stay tuned for more installments of our Hyperautomation Cheat Codes series where we’ll examine more integrations and automations with other key partners to help you level up your cybersecurity.

Ready to see Torq in action? Click here to get a demo.

One of the superpowers of the Torq Hyperautomation platform is the ability to integrate with anything. We team up with leading security vendors to combine forces to create automations that make SOC analysts’ lives easier while also improving their organizations’ security posture.

In this post, we’ll talk about how the enterprise-grade Torq Hyperautomation platform integrates with SentinelOne to level up your organization’s SOC workflows with autonomous incident response. 

Here are the top three Torq and SentinelOne automations:

Enrich SentinelOne Incidents With Threat Intelligence From Intezer

Essentially, this workflow allows you to poll incidents in SentinelOne, and for each unresolved threat, it provides threat enrichment from Intezer with an optional Live Agent Endpoint Scan.

First, it will poll for recent threats in SentinelOne that are not resolved on a scheduled interval – for example one day. Each unresolved incident file hash will be queried against Intezer and the results will be provided in the notes of the threat.

A SentinelOne deep visibility query will also run to gather how many other instances of this hash have been found in the environment.

If the results from Intezer indicate a malicious or suspicious result, the customer’s Slack channel will be asked if an Intezer Live Scan is desired. If the answer is yes, the workflow will execute a remote script to install the Live Scan agent, run the scan, and gather the results of the scan, placing the results into the Slack channel and SentinelOne notes on the threat.

Threat Hunt for a Specified SHA1 Signature (SentinelOne) and Search Within SentinelOne XDR Solution for the Malicious File(s)

Using this workflow, you can receive a file signature from Slack and hunt for the signature across EDR agents, notify the owners of the endpoint, and kick off a scan of the device. 

Here’s how it works:

• Receive a Slack command with platform and SHA1 hash
• Add the hash to the blacklist for the platform if it does not exist
• Initiate a Deep Visibility query to threat hunt for the signature
• Go over the affected agents/hosts
• Retrieve the information from either Jamf or Intune
• If the owner is found in Slack, reach out to them directly, otherwise update the Slack channel
• Scan the endpoint/host with a full disk scan

From there, you can search in SentinelOne’s XDR solution for the malicious files. 

Enrich SentinelOne Findings With Threat Intelligence

This workflow retrieves the latest threats from SentinelOne on a schedule (say, every five minutes). And for each threat found, it retrieves the signatures of the files involved. 

Then, for each file, it queries VirusTotal and Recorded Future for analysis then updates the notes on the threat in SentinelOne with the results.

You can also run a deep visibility query on SentinelOne for other results for the same file hash and add the deep visibility count to the notes for the threat in SentinelOne.

Those are just three of the myriad integrations Torq offers with SentinelOne for autonomous incident response. Stay tuned for more installments of our Hyperautomation Cheat Codes series where we’ll examine more integrations and automations with other key partners to help you level up your cybersecurity.

Ready to see Torq in action? Click here to get a demo.

The Top 3 Wiz and Torq Automations

One of the superpowers of the Torq Hyperautomation platform is the ability to integrate with anything. We team up with leading security vendors to combine forces to create automations that make SOC analysts’ lives easier while also improving their organizations’ security posture.  

Integrating Torq and Wiz enables security teams to automate the remediation of cloud security issues, freeing up analysts’ time and giving them the ability to tend to the laundry list of low and medium issues that often go untouched. These low and medium issues still pose a threat, so creating an automation for them can help avoid a security incident. With Torq and Wiz, SecOps teams can create fully automated or human-in-the-loop remediation workflows for things like expired secrets, or unused privileged access keys. These automations are more powerful options than those available with legacy SOAR platforms.

In this post, we’ll talk about how the enterprise-grade Torq Hyperautomation platform integrates with Wiz to level up your organization’s cloud security. 

Here are the top three Torq and Wiz automations:

Handle Wiz Alerts For Public AWS S3 Bucket With Sensitive Data

Looking for a simpler way to deal with Wiz alerts for when public AWS S3 buckets contain sensitive data? You’re in luck.

This workflow receives an alert from Wiz when an AWS S3 bucket is found to be exposed to the public with sensitive personal data contained in it and it triggers on Wiz ID wc-id-1264.

When the trigger is received, the workflow will pull the bucket’s public access settings and tags and look for an owner tag. If an owner tag is not found, it will set notifications to a specific Slack channel.

From there, it checks the public settings on the S3 bucket to see if the issue was resolved before the alert from Wiz was triggered, and, if it is still publicly accessible, it will ask to limit access to the bucket. 

Once the user agrees, the bucket settings are updated and the Wiz alert is moved to in progress. If the user does not agree, or the question times out, a Jira issue is opened to track the issue and the issue ID will be added to the Wiz alert.

It’s important to note that this workflow will set the public block settings on the S3 bucket to “true” and block all public access. It is possible that your application will need a more granular update to the JSON policy to block the existing access; the existing policy will be provided in the Slack message

Enable AWS S3 Bucket Encryption On Alert From Wiz

This workflow is a simple and effective way to ensure that encryption is turned on for an AWS S3 bucket. 

First, the workflow receives an alert from Wiz and is triggered by an event with the control name “S3 bucket default encryption disabled.” If the owner tag is found, the owner will be contacted or notified in the Slack channel about the issue. 

This workflow then checks the encryption status on the bucket to see if encryption is still disabled and suggests remediation by enabling default AES256 encryption on the bucket. 

If the user or Slack channel rejects the notification, the workflow collects a reason and opens a follow up ticket and updates the notes on the Wiz issue. 

Remediate AWS EC2 Instance With Open SSH Access From Wiz Alert

This workflow receives an alert from Wiz and is triggered by an event with control name “Instances with open SSH to the world in AWS.”

If an owner tag is found, the user will be looked up in Slack, otherwise the Slack channel is updated. The user or channel is then asked to remediate the instance by shutting it down or removing the open SSH rule in the Security Group and by adding a specific network rule allowing SSH from a corporate owned network.

The user or channel will also have the option to open a Jira issue instead of doing the remediation. A Jira issue is opened for any issue with the process, and will be added to the issue notes in Wiz.

Those are just three of the myriad templates Torq offers with Wiz to improve cloud security. Stay tuned for more installments of our Hyperautomation Cheat Codes series where we’ll examine more integrations and automations with other key partners to help you level up your cybersecurity.

Ready to see Torq in action? Click here to get a demo.