Thread by @chrissanders88

A lot of SOCs struggle to adopt case management tools they've acquired and implemented. One reason is that orgs can't decide if they want a tool to support existing processes or if they want a tool to define their processes. 1/

One story is that orgs often have poorly defined processes so they acquire a tool that directly or indirectly provides workflows. But, the org wants to cling to some facets of what they're already doing. The new tech limits that, so they never fully embrace it. 2/

Another story is that orgs acquire something that is more of an infinitely customizable sandbox, but they are unable to implement their own processes because they are so ill-defined. The org thought they had strong workflows but the tool reveals they don't, so it languishes. 3/

Ideally you have strong reliable workflows that a tool supports. Not everyone is going to be there, so an awareness of what you have, work works, and where gaps are is the next best thing. You want to understand where the tool provides customization and where it limits it. 4/

Said another way w/ examples:

If you buy ServiceNow and hope it'll define workflow for you, you're gonna have a bad time. If you buy Exabeam and want to customize it to facilitate your well-established workflow, you're gonna have a bad time. You have to know where you're at. 5/

You can substitute many vendors both commercial and free in those slots, so I'm not picking on these folks specifically. 6/

I do think case management is one of the weaker solution areas in infosec for a number of reasons. Obviously there's the tacit and metacognitive knowledge issues. But also, many security vendors tack it on to existing tools with little thought. 7/

At the same time, the sandbox stye tools are difficult to work with, often requiring full time staff to develop or configure them. They are often made to cover so many broad use cases they cover few specific ones very well. 8/

I think @TheHive_Project is probably the best thing going in this space right now. It's simple, focused, and somewhat customizable. Lots of potential. 9/

There's LOTS of room for new ideas in this space. However...

1. It probably doesn't come from SIEM
2. It probably doesn't come from SOAR
3. It never fully gets there without major industry shifts towards tackling the tacit knowledge problem.

10/

And because I know I'll get asked, the most successful setups I've seen that are the most accessible are:
- Using @TheHive_Project out of the box
- Using @Jira along with @Confluence wiki integration.

11/