A 360 Degree Alert Experience to present all information in one place

Vmware CBC XDR | Alert Triage for Cybersecurity Incident Response

Carbon Black Cloud (CBC) Extended Detection and Response (XDR)

2023, VMware Carbon Black Cloud (R&D)

Project Summary | My Role |

Integrating MITRE Attack information
Integrating MITRE Attack information
Providing Asset information In Situ
Feeding Asset Details In Situ to reduce navigation
Concept to capture user exploration path to facilitate triage documentation
Concept to capture user exploration path to facilitate triage documentation
A 360 Degree Alert Experience to present all information in one place
A 360 Degree Alert Experience to present all information in one place
A query mode to reduce cut/paste when writing queries
A query mode to reduce cut/paste when writing queries

Project Summary

In 2023 Carbon Black began development of their Extended Detection and Response (XDR). XDR is a consolidation of endpoint and workload security capabilities that provide critical visibility into the network and cloud – reducing blind spots, detecting threats faster, and automating remediation using authoritative context across these domains.

I was added to the team to bring my alerts experience to the project, with the goal of finding ways to advance and innovate the alerts experience within XDR. Responding to, and triaging, Cybersecurity Incidents requires information that exists outside of the current alert detail forcing Incident Responders and SOC Analysts to open multiple tabs, navigate across the platform, and create complex queries. This requires excessive clicking, constant maintenance of the desktop (to organize and reduce spawned tabs and windows), and secondary tools to capture and share the data they have explored and the actions they have taken.

My Role

  • Via remote interviews I closely observed and documented the behavior, techniques and workflows of Security Analysts
  • Created (and shared) wireframes demonstrating potential improvements