Solution Overview

This advanced solution significantly enhances the experience of Security Operations Center (SOC) analysts working within the Microsoft Defender incident interface. By offering valuable threat intelligence information related to file hash entities, analysts are better equipped to identify and respond to potential security threats effectively. This enhancement provides a crucial layer of insight and analysis, empowering SOC analysts to make informed decisions and take proactive measures in safeguarding the security of the systems they oversee.

By leveraging the Microsoft Defender Streaming API, this solution seamlessly integrates file analysis data from ReversingLabs Spectra Core, the most extensive collection of goodware and malware files of over 40 billion searchable samples and 385 billion file hashes. As soon as an incident is triggered, this integration ensures that analysts aren't waiting around for sandbox detonations by rapidly presenting comprehensive insights into the characteristics of the files involved, including malware classification status, threat names, interesting strings found in the file during analysis such as domain names and IP addresses, and MITRE ATT&CK tactics and techniques.

Prerequisites

Valid credentials for ReversingLabs Spectra Intelligence and/or Spectra Analyze are required to use this solution.

Installation Guide

Download and following the installation guide here: Installation guide

ReversingLabs Scanner for Microsoft DefenderReversingLabs

ReversingLabs Scanner for Microsoft Defender

ReversingLabs

ReversingLabs Scanner for Microsoft Defender

ReversingLabs

ReversingLabs Scanner for Microsoft Defender
ReversingLabs