Purpose-built capability uses ChatGPT, other Large Language Models and Machine Learning techniques to securely harnesses the power of AI to combat modern threats
Gurucul, the most visionary Next-Gen SIEM, today announced the launch of its new generative AI capability called Sme (Subject Matter Expert) to accelerate threat detection, supercharge security investigations and automate responses. Sme AI empowers Security Operations Center (SOC) analysts with powerful insights into a rich, correlated dataset across identity, security, network, enterprise and cloud platforms. It will improve SOC team efficiency and help counter the ongoing challenges of limited resources and skill sets, overwhelming alert fatigue, false positives and mis- or unprioritized alerts.
Gurucul pioneered the use of AI and ML in cybersecurity with STUDIO, an open analytics framework which allows users to easily build advanced machine learning behavior models in-house and incorporate third-party AI frameworks and models into the platform. Gurucul also led the way with automated threat hunting capabilities, first announced in February 2020, which applied advanced ML algorithms to assess a wide range of behavioral attributes to identify anomalies, outliers and indicators of compromise.
“Gurucul was founded more than a decade ago on the idea that the application of ML and AI on large data was an enabler for cybersecurity. The recent widespread acceptance and use of Generative AI validates our continued investment and innovation in ML and AI,” said Saryu Nayyar, CEO at Gurucul. “Sme AI is purpose-built to support analysts in their day-to-day activities and help them detect, investigate and respond to threats so they can stay ahead of adversaries. While attackers are using AI and manipulating common frameworks to build malware, the security community needs to invest and leverage purpose-built AI to fight this battle more effectively.”
Gurucul Sme AI dramatically improves threat detection and response capabilities:
Detect
- Provides proactive suggestions for detections and threat hunting queries. This increases threat hunting efficacy, reduces mean time to detection (MTTD), uncovers unknown threats and indicators, and quickly adapts to changing/dynamic/new datasets at a speed impossible for humans to manage alone.
- Creates new threat content based on recent trends, learnings across customers and industry verticals to dynamically build detection rules, models, queries, reports and more.
- Trained not only for cyber threat detection but also insider threat and ITDR, identity and access-based incidents including account compromise, AD/LDAP attacks, etc.
Investigate
- Auto-triages alerts based on historical triage patterns, investigation notes, types of detection, relevance, attack trends, etc. This helps analysts prioritize the investigation of the riskiest alerts, empowers users and speeds up investigations by moving away from multiple screens, clicks, queries and streamlining other interactions with the platform.
- Leverages contextually aware and enriched data for efficient investigations.
Respond
- Automates key incident response activities with ease including creating custom reports, taking bulk actions, and multi-step workflows.
- Supports natural language-based, free-form search to simplify and accelerate typical tasks and reporting.
- Provides auto-response based on historical response actions to significantly reduce manual steps for critical alerts.
- Recommends new SOAR playbooks based on the alerts and response action trends.
“This feature is the most recent example of how Gurucul is upholding our guiding principles of improving the user experience and fostering better collaboration,” says Nilesh Dherange, CTO at Gurucul. “We are constantly working to improve the reliability of our Sme AI by augmenting it with traditional ML techniques, scoping down attributes, workflows, and more.”
Gurucul will showcase its Sme AI capabilities at Booth #3041 at Black Hat USA 2023, August 9-10, in Las Vegas. The launch of Sme AI comes quickly after the launch of the Gurucul Security Analytics and Operations platform, Powered by Snowflake, that will enable customers to seamlessly run Gurucul’s Next-Gen SIEM, Open XDR, UEBA and Identity Analytics solutions on the Snowflake Data Cloud. The platform allows data, services and applications to be optimally deployed between the Snowflake Data Cloud and Gurucul’s cloud-native infrastructure.
In April 2023, Gurucul announced an extension of the capabilities of its award-winning Security Analytics and Operations Platform to help organizations cost-effectively secure their increasingly complex cloud architectures, reach deeper insights faster, and enrich enterprise-wide visibility. The latest innovations provide industry “firsts” like 500 days of searchable data, robust purpose-built security use cases, coverage for identity-based threat detection and response (ITDR), and unified observability for any cloud environment.
Gurucul was positioned furthest to the right for completeness of vision in the 2022 Gartner Magic Quadrant for Security Information and Event Management and ranked in the top three for all SIEM use cases in the 2022 Gartner Critical Capabilities for SIEM.
Visit AITechPark for cutting-edge Tech Trends around AI, ML, Cybersecurity, along with AITech News, and timely updates from industry professionals!
