An ESG study, ‘SOC Modernization and the Role of XDR’* commissioned by Kaspersky, has revealed that almost three-in-four (70%) respondent organisations struggle to keep up with the volume of alerts generated by security analytics tools.
This results in a lack of resources for important strategic tasks and leads organisations towards process automation and outsourcing.
Thus, to streamline the work of a SOC and avoid alert fatigue, Kaspersky suggests enterprises check the following advice:
- Organise work shifts in your SOC to avoid overworking staff and ensure all key tasks are distributed across people: monitoring, investigation, IT architecture and engineering, administration and overall SOC management.
- Overwhelming staff with routine tasks may lead to burnout in SOC analysts. Some practices, such as internal transfer and rotation, can help manage this.
- Use proved threat intelligence service that enables the integration of machine-readable intelligence into your existing security controls, such as a SIEM system, to automate the initial triage process and generate enough context to decide if the alert should be investigated immediately.
- To help free up your SOC from routine alert triage tasks, use proven managed detection and response service, such as Kaspersky Managed Detection and Response. The service combines AI-based detection technologies with extensive expertise in threat hunting and incident response from professional units including Kaspersky Global Research & Analysis Team (GReAT).