实例探究 > Rule every threat with CASE STUDY | Roku Cloud SIEM

Rule every threat with CASE STUDY | Roku Cloud SIEM

公司规模

1,000+

地区

America
Europe

国家

United States

产品

Sumo Logic Cloud SIEM

技术栈

Cloud SIEM
MITRE ATT&CK framework

实施规模

Enterprise-wide Deployment

影响指标

Customer Satisfaction
Digital Expertise
Productivity Improvements

技术

分析与建模 - 预测分析
网络安全和隐私 - 安全合规

适用功能

商业运营

用例

网络安全
远程控制

服务

系统集成
培训

关于客户

At its start in 2000, Roku pioneered streaming to the TV with its platform that connects viewers, publishers, and advertisers to the vast ecosystem of media content. With its product portfolio of streaming players, TV models, and a channel store, Roku serves millions of customers across North America, Latin America, and Europe. Roku has established itself as a significant player in the broadcast media and consumer electronics industries, providing a reliable and innovative service to its extensive customer base. The company is committed to maintaining a strong security posture to protect its infrastructure and ensure the trust of its customers.

登录后查看完整内容

挑战

When adopting a SIEM solution, Roku needed to avoid alert fatigue and stay agile to quickly address true issues. Maintaining a strong security posture is essential for Roku. “Our security team works day and night to protect the infrastructure and provide a reliable service for our customers. Our customers and their trust are important for us,” shared Huseyin Karaarslan, Sr. Security Engineer at Roku. As an important part of this strategy, Roku wanted to adopt a SIEM solution to gain cyber situational awareness and an ongoing picture of the company’s environment.

登录后查看完整内容

解决方案

For its cyber situational awareness, Roku wanted rapid and accurate insights into their domain to understand what’s happening and to ensure active responders could make quick, accurate decisions. This requires an investment in data collection and analysis to maintain a continuous picture of Roku’s infrastructure, and for that, Roku chose Sumo Logic Cloud SIEM. Built natively in the cloud, Cloud SIEM makes it fast and easy to gain deep security insights with pre-built applications including out-of-the-box dashboards, queries, and rules. With 700+ rules that each map to a tactic and technique related to the MITRE ATT&CK framework, Roku’s security team had a strong starting point for obtaining security insights. As a first step, the team embarked on tuning Cloud SIEM rules. “Cloud SIEM’s rules are powerful, and we wanted to tailor them specifically to our organization and infrastructure. Tuning was important for us to familiarize ourselves with the tool, prove value in our investment, and optimize the platform so we could focus on true alarms that require our attention,” commented Karaarslan.

登录后查看完整内容

运营影响

Optimized situational awareness with rule tuning.
Built natively in the cloud, Cloud SIEM makes it fast and easy to gain deep security insights with pre-built applications including out-of-the-box dashboards, queries, and rules.
The security team’s tuning process was highly efficient, beginning with using the Sumo Logic platform to write queries to identify the rules that created the highest volume of alerts.
Through this tuning phase, the security team quickly determined if a rule was working, needed further tuning, or if it no longer applied to the organization.
As a result, Roku is experiencing optimized cyber situational awareness with Cloud SIEM that empowers the security team to rapidly identify and act on critical alerts.

登录后查看完整内容

数量效益