Speed Root Cause Analysis with Higher Confidence

Root Cause Analysis is a Highly Time-Consuming Process 

Due to the high volume of alerts that security analysts face every day, many alerts are investigated and resolved without understanding the root cause, especially for alerts with weak signals, leaving organizations at risk. 

In resolving alerts, it may take ½ second to mark something as false positive because it looks familiar, but it may take a full day or more to determine the true root cause. The typical process of root cause discovery begins with experts making assumptions and continues with ongoing queries and sometimes endless guessing. A Security Information Event Manager (SIEM) makes the process easier, but the overwhelming number and frequency of alerts can cause analyst fatigue and impede the process of determining the root cause. 

AI Dramatically Simplifies Root Cause Analysis 

Artificial Intelligence can not only reduce the time of investigation by identifying patterns and suggesting the plausible root causes, it can also enable analysts to resolve alerts with higher confidence.  

DTonomy AI Assisted Security Orchestration Automation and Response platform (AIR) uses algorithms to analyze and correlate alerts and other contextual information. It continuously maps out all connections between different alerts, content, and analysts’ resolutions and recommends plausible root causes for alerts and groups of alerts. 

The AI engine will recommend root causes that have the highest confidence, and analysts can then validate against their domain knowledge and determine whether future alerts should be treated as the same root cause category. For example, our system could automatically recommend patterns with high confidence such as a suspicious process alert that is triggered due to a system running a periodic update. 

Transparent. Controllable. Adaptive. 

The DTonomy AIR engine is uniquely designed to ensure the system not only provides valuable deep high-quality insights to analysts proactively but analysts can also more easily understand and have full control of AI because it is: