workflow process
The way RedCarbon works
The RedCarbon Virtual Analyst plays a massive role in speeding up data analysis of incidents and consequent case closing.
VA also reduces workload by 80%.
RedCarbon Virtual Analyst
Integrating AI in analysis process
dramatically increase the number of case closed
Advantages of RedCarbon
AI manage the large majority of cases.
AI reduces workload.
AI Managed Cases
Workload reduction
01. Customer xDR System identifies an anomaly
The first AI process happens when the Virtual Analyst ingests the xDR System’s feed.
Various processes start simultaneously.
VA investigates the data miming Human behaviour and starts calculating an initial Risk Score.
Paralleling an enrichment phase begins and the VA elevates the incident that became a case.
In each step of this process, Virtual Analyst use AI and various RedCarbon algorithms to make three main things:
- assess the incident info
- enrich the incident info
- evaluate an initial Risk Level and Score
02. AI Security Automation
AI assessment & report human readable production start, the AI System runs with the inference engine and the Contextual Rules knowledge base to calculate a more accurate case Risk Score.
That produces a report, and when not different instructed, expect a human decision to move further.
03. Case is Assigned
Case Workflow & SOC Management is now the primary process. The Case is ready to be assigned, escalated, or closed.
The level of human interaction could be fine-tuned in the setup panel. If configured every day, Level-C or other stakeholders may receive a morning calculated day’s Business Risk Score.
RedCarbon vision is to integrate as much as possible commercial existing xDR datasources having a certain level of market share. Still, special large projects can incorporate info coming from customers’ data lakes.
Integrated xDR Datasources
Actually Integrated
Cynet
Fortinet FortixDR
Microsoft Defender
Palo Alto xDR
Sentinel One xDR
Trellix Endpoint
Trend Micro xDR
Coming soon
In development
CrowdStrike xDR *
Microsoft Sentinel xDR
Proofpoint xDR *
* it depends on the quality of the data feed
coming from the vendor platform
