Lumu Autopilot
In today’s rapidly evolving digital environment, prompt and effective responses to security threats are essential. Lumu Autopilot simplifies the entire incident management process, reducing human error and optimizing resource allocation. By utilizing advanced automation, it ensures incidents are handled with accuracy and efficiency, enabling your organization to stay ahead of threats and maintain a strong security stance.
Enable Lumu Autopilot
If your account is eligible for Lumu Autopilot, you must simply open the Lumu Portal’s settings and locate the Autopilot section. Once there, switch the Autopilot slider to On. It is that simple.
Key Benefits
- Improved Response and Autonomous Incident Management: Lumu enables organizations to respond to threats faster than humanly possible thanks to its integrations. This is already a powerful benefit, but it becomes even more powerful alongside Lumu Autopilot. Throughout the last 5 years, Lumu has not only accumulated a huge collection of network metadata, but has used it to create AI-powered playbooks that can be used by Lumu Autopilot to manage incidents like an expert cybersecurity agent.
- Incident Prioritization: By delegating incident management to Lumu Autopilot, you can further optimize manual incident management. Lumu Autopilot can and will take care of assigning the correct status to incidents that have been automatically handled and responded to, freeing up your cybersecurity team to focus their efforts on more complex tasks. Trust Lumu Autopilot’s AI playbooks to handle the bulk of your day-to-day operation, and optimize your resources to empower your organization’s cybersecurity posture.
- 24/7 SOC Compliance: Many organizations aim to have 24/7 SOC monitoring, but for many, this may not be achievable due to logistical, organizational, and financial challenges. Autopilot offers the capabilities of a 24/7 virtualized SOC, eliminating the complexities associated with an on-site SOC. This enables smaller organizations to achieve 24/7 SOC compliance, even if it wasn't previously an option for them.
Autopilot Operation
Once activated, you will be able to see evidence of the actions taken by Lumu Autopilot by going to the details of the incident you wish to monitor. Inside the summary, you will find a new subsection named Autopilot Actions that shows you a timeline of the measures enacted by Lumu Autopilot while operating the incident.
You will also find evidence of Autopilot’s operation on the Operation Timeline.
Escalation Alerts
With its AI-powered playbooks, Autopilot can identify when an incident's complexity necessitates manual intervention. In such cases, Lumu will send you an email notification, alerting you that the incident has been escalated so your cybersecurity team can start investigating and operating it promptly.
Autopilot Periodic Reports - Wrap-up
The portal can produce a regular summary, allowing you to thoroughly review Autopilot’s activities over a specified time period. This wrap-up report will provide clarity on the steps Autopilot has taken to manage your organization's cybersecurity, presented in an easy-to-read format that can help reassure other stakeholders.
This wrap-up can be enabled and configured by going into the Autopilot section, activating the corresponding switch, and selecting the desired frequency from the drop-down menu. Once done, save your changes and you will be set.
Escalation Alerts
Autopilot lets you decide the user or users who are going to receive the escalation alerts produced by the Auto-escalate incidents feature (seen in the section below). By default, this feature automatically alerts the first user added to your company's Lumu account. To configure new users, go to the Autopilot section and do the following:
1. Go to the Escalation Alerts section, and click Edit (1).
2. Select the users from the dropdown menu.
Duplicated names may appear, since the same person can have different mails and roles within the Lumu Portal.
3. Click Save Changes (1) once you finish selecting the users.
Once you have successfully saved the changes, the selected users are going to receive the escalation alerts for every auto-escalated incident.
Environment Driven Actions
Autopilot brings the possibility to automatically manage incidents on your environments. By leveraging the labels given to your incidents, Autopilot can auto-close and auto-escalate them to speed up the incident handling process of your company.
To use this feature, go to the Autopilot section and do the following:
1. Go to the Environment Driven Action section at the bottom, and click Edit (1).
2. Select the incidents labels from the drop-down menus.
3. Once done, click Save Changes and you will get a confirmation message.
Related Articles
Incidents
Effective incident analysis is at the core of proficient cybersecurity operation, for that reason, the Lumu Portal offers a centralized and intuitive way to manage your incidents, track their statuses, and review which incidents have been solved—for ...Incident Details
Clicking on an incident will display the incident details view. This view will provide you with tactical and strategic vision of the adversarial activity and intent related to the incident, as well as provide vital intel so your organization can act ...Incident Filters
Filters are a set of criteria you can use to pinpoint specific incidents. Multiple filters can be used at the same time to narrow searches. Time Range The Time Range filter can be found beneath Closed Incidents. Time Range filters allow you to sort ...Lumu Playback
The cybersecurity industry has developed numerous methods to defend against zero-day threats and emerging attacks. However, many attacks still slip through undetected due to the increasingly sophisticated evasion tactics employed by cybercriminals. A ...Lumu Portal
Lumu simplifies Continuous Compromise Assessment by consolidating its management, reporting, and related contextual intelligence within a single portal. Security teams no longer need to chase down data from multiple network monitoring tools. The Lumu ...