ReliaQuest GreyMatter

The biggest strength in my opinion is ReliaQuest's overall expertise in the field. This allows them to communicate with us effectively, relaying the most important information for us to act on any incident. From there, would be the benefit of their automation in response. ReliaQuest can automatically handle incidents when given the proper permissions either through verbal communication or automated playbooks built inside GreyMatter. This allows for full 24/7 coverage of our environment. Lastly, the depth of research by the built in AI in the description during alerting. The scope of information from current to past alerts gives a full view of what is happening now compared to how it was handled in the past. This greatly improves response time and keeps our analyst's time on alerts as low as possible.

Flexibility to pivot between different integrations and seamlessly close offense.

ReliaQuest GreyMatter is compatible with many popular security products. The GreyMatter platform ingests all the logs into one location and generates security alerts based on the detected threats. In addition to the alerts, GreyMatter also utilizes AI to generate additional information, such as recommended actions to take based on the threat. My personal favorite feature of GreyMatter is the automated response plays (ARPs). With the ARPs, actions such as blocking IPs or disabling accounts can be automatically taken depending on what is detected. This allows for threats to be immediately shut down, rather than losing time to manually take action.

One of the limitations of the the responses I have found is actioning new alerts that are similar or the same as previous alerts that have been resolved. If a new alert is identical to an old alert, it should be resolved in a similar fashion. This may have to do with better communication on our end or settings that we can action on the platform, but this should cut down on some of the noise in the alerts. Another draw back I have noticed is more in the feature add requests. This is not a negative on their end, things change and evolve and new ideas are communicated and received well. The time it takes to deploy new ideas may or may not be as quick as one would like. Finally, the default settings can be aggressive in some places and not others. Containment of devices is good practice in an emergency but could lead to additional issues. However, if the default is to contain a domain controller, that could cause systems to fail. Be sure to set up rules and automations as needed for your environment.

Fairly basic threat intelligence and inability to customize your own rules / detections. Everything must be run through RQ team.

ReliaQuest GreyMatter is very expensive. It can be very costly, if not impossible for smaller businesses to afford it. Connecting all the log sources is also a major project. You can expect to spend hours, as well as meeting with ReliaQuest's engineers, to make sure everything is set up correctly. The GreyMatter mobile app can be finicky at times. Occasionally I am not able to run response plays from the mobile app and have to use the desktop version instead.