GenAI use case
GenAI can enable easy and conversational access to security technologies. This can be leveraged for query based & configuration based use cases in SOC, security administration, business unit collaboration, risk & compliance. A list of sample conversational use cases across these areas are captured below.
SOC- Investigation and Response
- Show last login for user abc
- Analyze this malware file
- Hunt for a specific IOC across all endpoints
- List all systems with CVE-2024-32113
- Create a management friendly incident report for phishing attack
- Block the IP address 192.168.0.35 for incoming traffic on Palo Alto Firewall 10.0.0.1
- Update CrowdStrike and Palo Alto firewalls with this new IOC
Security - Administration
- Block network segment 201.30.20.0 on Fortinet firewall 192.168.0.1
- Upgrade all my Palo Alto Firewalls with the latest content update
- Disable security policy named “Acme_tempaccess”
Business- Unit Collaboration
- Show all system access by user Bob during his notice period
- Open a ticket for allowing access to vendor Acme
- Create a report for all open compliance items for vendor Acme
Risk - & Compliance
- Show all business units with non-compliance for PCI
- List all non-compliance items for vendor Acme
- Rank business units for ISO 27001 compliance along with open items
- Create management friendly report for critical risks and actions for Finance BU
GenAI benefits
- Increase the speed, accuracy of SOC investigation response
- Reduce product skills in SOC security administration, replace with easy conversational access
- Reduce friction, increase autonomy speed for retrieval of risk, compliance reports. Provide easy to query conversational interface to business units GRC teams
GenAI Security challenges and risks
- Managing security and privacy in the RAG pipeline for accessing security policies & reports
- Matching data retrievals to the user’s roles and attributes while querying using security product API
- Establishing second-level approvals for certain automations including response actions for configuring security products
How Ackuity can help
- Ackuity security application enables easy conversational access to security products
- Ackuity security application provisions the use cases for SOC analysts, security administrators, business units and GRC teams
- Ackuity GenAI Security Gateway enables secure access to all the security products for the use cases
- Implements role-based access control (RBAC) for access to security policies, reports and other documents
- Authorizes response actions on security products via industry standard protocols (e.g. OAUTH, SAML)
- Filters data for privacy and other compliance requirementS
Architecture
.gif?width=1920&height=1080&name=Reduce%20your%20GenAI%20risk%20%E2%80%94%20with%20Ackuity%20GIF%20(2).gif)