By Mike Saurbaugh
How quickly can your security team produce information about the success of phishing incident response capabilities?
What if company leadership asks the CISO for data about the number of malicious phish that bypassed the secure email gateway and that employees caught and reported? Is this information available? More importantly, how rapidly does the team remedy employee-reported phishing threats?
With an integration between Cofense Triage™ and ServiceNow Security Incident Response (SIR), security teams reap great benefits. These include:
- Bi-directional APIs to integrate and enrich platforms
- Accelerated phishing email identification and mitigation
- Improved analyst efficiency to investigate and respond without switching screens
- Centralized visibility into enterprise incident management and response
Cofense and ServiceNow have long been technology partners and created an integration with Cofense Intelligence for phishing threat lookups and an earlier interoperability with Cofense Triage, both of which are in the suite of products that make up the Cofense phishing detection and response platform. As products evolved, Cofense and ServiceNow boosted security teams’ ability to manage phishing threats.
Think of Cofense Triage as a source of truth to highlight and inform analysts, who in the company reported emails as malicious, while removing the noise from benign reported emails. Now, take these highly credible reported phish and populate ServiceNow SIR with phishing incidents for analysts to remediate through next-steps automation actions across the enterprise. The result is a streamlined process to investigate, prioritize and resolve phishing attacks.
The APIs That More Than GET It
With the advent of a new set of Cofense Triage APIs (version 2), customers benefit from capabilities they had been asking for. Among them:
- Bidirectional support between platforms – GET, POST, PUT, DELETE
- Cofense Triage data ingestion and updating outside of the user interface
- Filtering, and sorting improvements using sparse fieldsets, for better performance
- To-One (many reports to one category), and To-Many (one category to many reports) relationships
- Expanding pagination parameters
Optimizing Your Phishing Incident Response
- Ingest employee-reported phishing emails from Cofense Triage based on severity, category, threat indicators and reporter reputation.
- Create security incidents in ServiceNow Security Incident Response (SIR) from events in Cofense Triage’s inbox, reconnaissance and processed queues.
- Ingest phishing threat indicators from Cofense Triage into ServiceNow SIR to enrich and operationalize incident response.
- Update and process/categorize phishing emails in Cofense Triage from ServiceNow SIR.
- Bidirectionally manage phishing threat indicators and observables between Cofense Triage and ServiceNow SIR.
Go Configure…
1. First, configure ServiceNow SIR to create an incident based on the desired criteria.
Ingest email artifacts from Cofense Triage – Inbox, Recon or Processed locations. The example below will create a security incident in SIR based on conditions met searching Cofense Triage.
- Location = Processed
- Report Category = Crimeware
- VIP Reporter = True
Figure 1. ServiceNow SIR Security Incident Creation Criteria Querying Cofense Triage
2. Review security incident in ServiceNow SIR after polling interval collects data matching criteria.
Figure 2. ServiceNow SIR Incident Locations Obtained from Cofense Triage
Figure 3. Security Incident Matching Creation Criteria (Processed location, Report Category, VIP)
3. Incident details shown below in figures 4-6 are from reported phish received by Cofense Triage and ingested into SIR. Fields populated were retrieved from polling APIs.
Figure 4. Cofense Triage Data Populating Fields in SIR
