XM Cyber (v2.0.3)
XSOAR is a comprehensive SOAR platform that integrates different security tools to centralize incident management, driving better detection, investigation, and response to suspicious activity across your organization.The integration uses attack graph context and prioritization data that XSOAR receives from XM CEM, and also allows XSOAR to feed relevant entities back to CEM to be defined as breach points in CEM scenarios.
- Author
- XM Cyber
- Support
- partner
- URL
- https://customers.xmcyber.com
- Categories
- Data Enrichment & Threat Intelligence
Incident fields (26)
- Affected Entities
- Affected Entities List
- Choke points
- Compromising Techniques
- Critical Assets at Risk Level
- Critical Assets at Risk List
- Critical assets at risk
- Entity ID
- Entity IP Address
- Entity is a critical asset
- Entity name
- Entity report
- Entity type
- Technique Best Practice
- Technique name
- XM Cyber MITRE
- XM Cyber advices
- XM Cyber avg. complexity level
- XM Cyber avg. complexity score
- XM Cyber critical assets trend
- XM Cyber current security score
- XM Cyber dashboard
- XM Cyber description
- XM Cyber report
- XM Cyber security score grade
- XM Cyber security score trend
Integrations (2)
- XM Cyber
- XM Cyber CEM
Layouts (3)
- XM Cyber Layout
- XM Cyber Security Score
- XM Cyber Technique Layout
Playbooks (1)
- Incident Enrichment - XM Cyber
Scripts (1)
- XMCyberDashboard
README
Product/Integration Overview
XM Cyber continuously identifies attack paths to critical assets. This integration retrieves events for newly at-risk critical assets, newly discovered choke points, and changes in overall risk score. Incidents are also enriched with incoming attack vectors to affected endpoints and a list of critical assets exposed by the incident.
Use Cases
- New attack path to a critical asset triggers alerts and options to quarantine/disconnect/patch.
- New lateral movement exposure triggers alerts and options to change policy, and scan endpoints.
- Incidents from EDRs are enriched with critical asset information and, if the severity is high, then action can be taken.
Dashboard
- XM Cyber Dashboard: This dashboard displays the information from the XM Cyber CEM integration for Security Score, Choke Points by Severity, Critical Assets by Severity, and Top Compromising Exposures.