Torq has been hand selected as a Wiz Integration (WIN) launch partner, bringing the power of Torq Hyperautomation to WIN, so that our joint customers can continue to seamlessly integrate Wiz into their workflows, empowering them to automate their response.

“Torq and Wiz work seamlessly together to give us a major real-time advantage in mitigating the ever-evolving cloud-based threat landscape.”

Jemuel Dalino, Application and Engineering Security Manager, Agoda

WIN enables Torq to deliver actionable remediation and response to threats with a full audit trail of automated security actions. Torq and Wiz work seamlessly together to provide a real-time advantage in mitigating the ever-evolving cloud-based threat landscape with comprehensive contextual and accurate malicious activity identification. And Torq frees up security teams’ precious time, empowering them to focus on strategic business initiatives without being overwhelmed by cloud alerts.

“Over 50% of our customers are utilizing our Wiz integration in order to strengthen their hyperautomation workflows and I’m thrilled for us to have been selected as a WIN launch Partner. I look forward to strengthening our relationship for the benefit of our joint customers.”

Eldad Livni, Co-Founder and CINO, Torq.

The combined value of Wiz and Torq streamline security for organizations that are on a cloud journey.

“A best-in-class cloud operating model reduces risk, improves ROI, and drives efficiency,” said Oron Noah, Director of Product Management, Wiz. “That value proposition is what lies at the heart of WIN, and what Torq as a partner helps to make a reality. This collaborative philosophy brings real customer benefits, and we are so thankful to have Torq on board for this launch.”

Interested to learn more about the power of Torq and Wiz together, schedule a demo.

Amazon Security Lake automatically centralizes an organization’s security data from cloud, on-premises, and custom sources it into a purpose-built data lake stored in a customer’s AWS account.

Amazon Security Lake reduces the complexity and costs for customers to make their security solutions data accessible to address a variety of security use cases such as threat detection, investigation, and incident response. Amazon Security Lake is one of the many solutions that now supports the Open Cybersecurity Schema Framework (OCSF), an open industry standard, making it easier to normalize and combine security data from AWS and dozens of enterprise security data sources. 

Operationalizing the above (and additional) scenarios on top of the security data lake requires a set of basic building blocks that can either be used directly by SecOps professionals, or combined into larger workflows driving specific outcomes.

Executing Automated Actions as a Response to Security Events

As an Amazon Security Lake subscriber, Torq consumes logs and events from Security Lake. In order to control costs and adhere to least privilege access best practices, Torq workflows can be automatically notified of new Amazon S3 objects for a source as the objects are written to the Amazon Security Lake by setting up one or more data access subscribers.  Data access subscribers are notified of new Amazon S3 objects for a source as the objects are written to the Security Lake data lake.

In Torq, this notification is received in an Integration Webhook, so the first step of the configuration process is to create a new Webhook integration in Torq, as described in Torq’s documentation here. Take note of the resulting Webhook integration URL (endpoint), as it will be needed to set up a data access subscriber in Amazon Security Lake.

Completing the creation of the subscriber also requires setting up a new AWS Integration in Torq, as described in Torq’s documentation here. This integration will also be used afterwards to pull data from the Security Lake in Torq Workflows. As described in Torq’s documentation, setting up an AWS Integration requires creating a new Role in AWS Identity and Access Management. For that role to be able to pull data from the security lake, please sure to add the following permission policies to the role:

1. Create a new IAM Policy with the following contents:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowInvokeApiDestination",
            "Effect": "Allow",
            "Action": [
                "events:InvokeApiDestination"
            ],
            "Resource": [
                "arn:aws:events:*:{accountId}:api-destination/AmazonSecurityLake*/*"
            ]
        }
    ]
}

Make sure to replace “{accountId}” in the JSON above with your own AWS Account ID.

2. Add this policy to the Permissions Policies for role you’re creating for Torq’s Integration
3. Add the following policy to the Permissions Policies of the role AmazonAthenaFullAccess (this is needed to enable querying, writing results, and data management through Amazon Athena, which is how Torq workflows will query data from the AWS Security Lake.

While setting up the AWS Integration in Torq, take note of the Torq Account ID and the AWS External ID, as you will need these in the process for creating a custom subscriber 

Next, follow the following steps to set up a new Data Access Subscriber through your AWS Console:

1. Open the Amazon Security Lake console at https://console.aws.amazon.com/securitylake/.
2. In the navigation pane, choose Subscribers.
3. Click Create subscriber.
4. For Subscriber details, enter the subscriber’s name and (optionally) a description.
5. For Log and event sources, choose from which sources you want to receive notifications in your previously created Torq webhook (you can choose whether you want to send notifications from all your Amazon Security Lake sources to Torq or select specific sources for each subscriber).
6. For Data access method, choose S3 to set up data access for the subscriber.
7. For Subscriber credentials, provide the Torq Account ID and the AWS External ID you got from AWS integration in Torq for AWS account ID and external ID, respectively.
8. For Notification details, select Subscription endpoint so that your Amazon Security Lake can send notifications through EventBridge to the HTTPS endpoint of the Torq Webhook created previously.
9. For Service Access, select the IAM role named AWSServiceRoleForAmazonEventBridgeApiDestinations, which is automatically created during the Amazon Security Lake set up process when run from the AWS Console, and which gives EventBridge permission to invoke API destinations and send object notifications to the correct endpoints.
10. Provide the Torq Webhook integration URL (endpoint) as the subscription endpoint. 
11. Choose Create.
12. Check the configuration of Subscription associated with the Amazon SNS Topic which has been created as a result of the previous steps, and verify that Raw message delivery is enabled for the Subscription. Enable it by editing the Subscription if it wasn’t.

Schematic configuration of Amazon Security Lake subscribers triggering Torq workflows

Depending on the settings you defined in step #5 above (Log and event sources) it might be necessary to define trigger conditions in your Torq workflows triggered from Amazon Security Lake events. Here’s an example of a trigger condition meant to restrict a workflow to be triggered by Route53 events in Amazon Security Lake from a region us-east-1 only:

A Torq workflow trigger condition definition example to restrict a workflow to be triggered only by Amazon Security Lake events for a specific account id, region and data source (such as AWS Route53)

Querying Data from Security Data Lake

The Amazon Security Lake creation and set up process run from the AWS console, automatically registers each Security Lake region as a new Database in AWS Athena.

AWS Athena is a serverless service which allows querying Amazon Security Lake S3 data (with an S3 bucket per region for which the Security Lake has been enabled) using SQL.

Querying Amazon Security Lake data from Torq workflows, either automatically triggered from Security Lake events, scheduled to periodically pull notifications of new objects by polling an Amazon Simple Queue Service (SQS) queue or run on-demand to search for specific data in the Security Lake, can be easily implemented by using SQL in AWS CLI steps to query Athena’s API.

The following figures illustrates the process of querying Amazon Security Lake from Torq Workflows in 3 steps:

1. Creating a dynamic SQL query for AWS Athena:

2. Using AWS CLI to execute the query in AWS Athena:

3. The result of Athena SQL queries is stored as a csv document in S3 and can be easily pulled into a Torq workflow by using an AWS S3 Read File step, and then the Convert CSV to JSON step from Torq Utilities to simplify data extraction and transformation in later steps in the workflow:

Bringing It All Together

Operationalizing Security Operations with fully automated or human-in-the-loop pipelines using the above “building blocks” is a process consisting of the following phases:

1. Identifying the relevant security events:
   
   Torq triggers can be configured with conditions, expected from the delivered event, in order to start performing automatic actions. In some cases, looking just at the event data might not be sufficient to decide whether it requires a certain security follow-up or not. For these scenarios, following up with additional automated enrichment and investigatory steps can be performed with Torq workflow steps.

2. Defining the required enrichment / hydration data:
   
   Upon receiving a security event that has a potential for a follow-up, certain parts of it, such as (but not limited to) User Identifiers, Device Identifiers, Network Addresses, etc… should be retrieved for further enrichment with additional systems (IAM, CMDB, Threat Intelligence and more) by introducing initial steps in a workflow triggered by security lake events.

3. Building the pipelines – what happens when the event occurs:
   
   Defining the response process can take place in an iterative manner. Main questions that need to be addressed are:
   • What additional information do we need to be able to better classify the event
   • Once classified, are there external notification / orchestration systems that need to be updated with this information
   • If building a human-in-the-loop pipeline, which role-players need to be provided an information about this event
   • If performing automatic remediation actions – what are they and which role-players can approve executing them

Summary

Amazon Security Lake provides a flexible and scalable repository for different kinds of security events. In order to  build flexible and scalable security operations, your teams will require this data to be at their fingertips with the ability to efficiently use it and to trigger processes based on it.

Implementing Torq workflows, that can be triggered either

• Manually by security professionals via Messaging / Chat or Web
• By identifying specific events reaching the security lake
• By using detections made by 3rd party security products

In these workflows, following capabilities can be delivered to security professionals:

• Retrieve data from security lake and present it to security role-players in a convenient fashion
• Enrich operational systems with context from the security lake
• Process the security lake data to make decisions on severity and priority of different security events
• Suggest and execute containment and remediation strategies based on processed contextual data

Examples of these and additional scenarios can be found at Torq Template Library.

No matter the industry, geography, or organizational size, cybersecurity teams are united by their many shared challenges: talent shortages, expanding attack surfaces driven by digitization and remote work, increasing velocity of software development, and the rapidly growing scope and sophistication of global cybercrime. In response, these teams have embraced and incorporated a range of specialized tools within their defensive arsenal in attempt to address and resolve these issues. Threat intelligence and security automation solutions form the front lines of their battle, yet these pillars of the cybersecurity ecosystem are often disconnected, creating a dangerous gap between intelligence and action.

This divide prevents security teams from deriving the full value from their solutions. Non-actionable threat intelligence increases analyst fatigue with yet another stream of feeds and alerts. While automated security playbooks without context-rich threat data lack the means to validate, prioritize and triage threats, resulting in inefficient processes and extending the MTTR.

By integrating actionable, relevant, context-rich threat intelligence within orchestration automation tools and processes, security teams can unlock the full potential of their existing security stacks – saving precious time and resources while streamlining response and remediation. 

Turning Intelligence Into Action with Cybersixgill and Torq

Cybersixgill and Torq have partnered to bridge the divide between intelligence and action, operationalizing Cybersixgill’s market-leading threat intelligence through next gen security hyperautomation with Torq. With this strategic partnership, we have pioneered end-to-end, no-intervention threat protection, helping to dramatically reduce MTTR  through customizable, automated workflows and playbooks, triggered by context-rich threat intelligence extracted in real-time from the cybercriminal underground.

Using Torq’s library of automation components, organizations can build an automation infrastructure to orchestrate immediate responses to Cybersixgill’s early warnings of potential threats, allowing teams to build automated, alert-triggered playbooks with any other tool in their environment – without writing a single line of code. 

Alerts from Cybersixgill’s rich threat intelligence insights can be programmed to autonomously initiate incident response workflows in Torq to instantly remediate issues at the first indication of a potential threat. Alternatively, security teams can harness Cybersixgill’s rich threat context to create automated threat hunting workflows, triggering data enrichment upon the arrival of an event or signal discovered through any other security tool. 

Torq and Cybersixgill make it easy for teams to turn manual security processes into automated, intelligence-driven workflows within minutes, eliminating reactive processes to build a resilient, proactive cybersecurity posture.

The Benefits of the Combined Solution

Cybersixgill gives users covert access to our complete body of context-rich threat intelligence from the deep, dark & clear web, including limited-access forums and markets, invite-only messaging groups, code repositories, paste sites and clear web platforms. We correlate our threat intelligence with each customers’ defined organizational assets, alerting teams to relevant threats at the earliest indication of risk, enabling preemptive action to be taken before they can materialize into an attack.

Torq’s enterprise-grade security hyperautomation platform unifies and automates the entire security infrastructure to deliver unparalleled protection and productivity. Torq drives maximum value and efficiency from existing security investments. It supercharges security teams with powerful, easy-to-use no-code, low-code, and full-code workflows that reduce manual tasks, freeing security professionals to focus on higher-value strategic activities.

Together, the combined solutions help users:

• Reduce risk with automated end-to-end intelligence-driven security workflows- Identify, capture and block threats as they emerge with seamlessly deployed playbooks to accelerate Mean Time to Respond and better secure your environment. 
• Save time and maximize team productivity- Eliminate manual work with automated workflows triggered by actionable and relevant threat intelligence data – built and deployed in minutes with no need for developers, professional third party services or month-long implementation delays
• Minimize cost and maximize resources- with a consolidated end-to-end no-intervention threat protection solution that allows you to make the most out of your existing security stack, with faster time to value.
• Optimize operations- by automating repeatable security processes, allowing you to shift valuable resources to higher priority tasks.

Schedule a demo to learn more about Torq Hyperautomation.