Cado's 'Impact' Rating: Prioritizing Alerts to Focus SOC Analyst Attention

SOC teams are often overwhelmed with a constant barrage of alerts, and the ability to effectively prioritize these alerts is critical to minimizing the risk of an attack and optimizing incident response. The various features of the Cado Platform work together to help SOC analysts focus their attention on the most critical alerts and incidents by providing an "Impact" rating from low to critical. 

The Impact is meant to be a reclassification/rescore of the vendor’s ‘severity’ rating, based on our analysis of the alert and additional data acquired either via Cado Host captures or in the contextual data sources the Cado Platform collects, to provide an enhanced level of focus. In other words, the analyst can focus on the most important events using Cado’s reclassification logic as guidance.

How It Works

The Cado Platform automatically collects alerts from AWS GuardDuty, Azure Defender, and GCP Security Command Center. But the Platform does more than just collect alerts:

• As soon as an alert is triggered, the Cado platform will begin to collect additional data, such as logs from cloud services
• This also includes other contextual data such as suspicious behavior or known malicious actions that may have occurred around the time of the alert
• If the platform finds higher-level alerts during evidence collection and analysis it will update the impact rating to reflect that.
• If it finds nothing extra of note, it will reflect the severity assigned by the platform that generated the alert. 

The Importance of Prioritizing Alerts

Given the sheer volume of alerts generated by modern security systems, SOC analysts need to make quick decisions about which incidents to investigate first. Without an effective way to prioritize, less critical alerts could consume time and resources, allowing more dangerous threats to go undetected. Cado addresses this challenge by providing automated analysis, leveraging threat intelligence, and integrating seamlessly with other security tools like XDR/EDR and SIEM platforms.

Adding Context

The Cado platform can provide additional context to the alert by acquiring lower fidelity alerts that have triggered around the detected event, as well as telemetry recorded by the detection platform such as process execution events, network connections, registry events, file events and logon events. This dataset in its entirety provides the analyst with a comprehensive understanding of the attack for them to make confident and informed decisions. 

Threat Intelligence Integration

Another important feature of the Cado platform is its ability to leverage both proprietary and third-party threat intelligence to enrich collected data. This enrichment adds a layer of context that helps SOC analysts make more informed decisions about the severity of an alert. Alerts are not only assessed based on the specific event but also cross-referenced with known threats, giving analysts a clearer view of the potential danger an alert represents.

For example, an alert might initially appear low-priority, but if threat intelligence shows that the observed behavior matches a tactic used by a known targeted attacker, it could be escalated for immediate investigation. This level of insight is crucial in ensuring that analysts can quickly differentiate between minor incidents and those that require urgent attention​.

Streamlined Incident Triage and Faster Response Times

One of the most significant benefits of The Cado platform's alert prioritization capabilities is the reduced Mean Time To Respond (MTTR). By automatically triaging incidents, providing enriched context, and highlighting critical alerts, Cado enables SOC analysts to respond faster and with greater precision. Automated analysis ensures that the time spent manually investigating low-priority alerts is minimized, allowing analysts to focus their efforts on more serious threats.

The inclusion of detailed forensic data, threat intelligence, and AI-powered insights in each alert also means that analysts can begin their investigation with a clearer understanding of the incident. This reduces the time required to gather evidence, ultimately leading to faster resolution times.

To see how Cado can help your SOC team prioritize alerts and streamline incident response, request a demo from our team.