ReflexSOAR

Open Source Security Automation, Incident Response, Case Management | Discord:

[ReflexSOAR @reflexsoar]

We just released v2022.06.00 with a couple bug fixes and enhancements, more details here:

https://t.co/tfE4MHDaTy

[ReflexSOAR @reflexsoar]

You ever just blindly import a rule and turn it on in the SIEM? Be honest, we've all done it. In the next release of @reflexsoar we automatically assess the rules hit volume, query speed and tuning options before the rule is even turned on.

[ReflexSOAR @reflexsoar]

What are detection repositories? Reflex will soon support sharing detections via repos, some native, some custom. New detections are automatically baselined for slowness, high volume, etc. #reflexsoar #soar #secops #infosec

[ReflexSOAR @reflexsoar]

We've been quiet, by design. We've been hard at working putting the finishing touches on our next release. Internally we are excited for what is coming and know you will be too when you see it. It's worth the wait.

[ReflexSOAR @reflexsoar]

It's been awhile. ReflexSOAR is still alive and kicking, we are repositioning the project so that we can dedicate resources to it full time and bring it to the next level. Your support and patience is appreciated. A new release is coming with enhancements, features and bug fixes

[ReflexSOAR @reflexsoar]

We've created a Discord server to help the Reflex community come together and chat with us and other Reflex users. Join us! https://t.co/hPl9C0QOnS

[ReflexSOAR @reflexsoar]

Wouldn't it be nice if you could just paste the Sigma rule into your detection engine? We got you, ReflexSOAR will convert it for you! We promise Detections are coming soon!

[ReflexSOAR @reflexsoar]

Use RQL and Event Rules to easily tag or filter events with internal sources communicating to external destinations.

[ReflexSOAR @reflexsoar]

The next release is almost ready, we are finishing off notifications channels to Teams, Slack, Email as well as polishing up our MITRE ATT&CK coverage map for our built-in detections rules (preview below)

[ReflexSOAR @reflexsoar]

Teasing a Beta feature available with Detections launch. Select the MITRE ATT&CK Tactics/Techniques when setting up a Detection, Reflex will map it to MITRE for you! Check your MITRE ATT&CK coverage easily from within Reflex, and see details on the Technique

[ReflexSOAR @reflexsoar]

Why did we choose the name ReflexSOAR? Reflexes are fast, involuntary and protective actions; just like your SOC response should be.

[ReflexSOAR @reflexsoar]

Next release may be delayed a bit as we add a desired feature. Notification Channels will allow Event Rules/Case activity to msg your teams via Teams, Slack, Email, PagerDuty, etc. MSSPs can alert directly to their customers to shorten feedback time. #soc #soar #reflexsoar

[ReflexSOAR @reflexsoar]

Started early testing of Detections in ReflexSOAR. Reflex Agents will act as detectors so you can scale as needed and get to alarm sources in hard to reach environments. Also some other enhancements, bug fixes and micro features coming, a new dashboard and more!

[ReflexSOAR @reflexsoar]

Even more changes to Event Rules in the next release (coming soon). We have introduced a feature so rules can check if IP values are in a list of CIDR ranges in an Intel List. Allowing updates to many rules at once by updating the Intel List. #soc #infosec #soar

[ReflexSOAR @reflexsoar]

We are adding Event Rule priority in our next release somyou can chain Event Rules in a specific order and use the results of one Rule to impact another rule. Hopefully this extends Event Rule usefulness as we brainstorm our automation plans!

[ReflexSOAR @reflexsoar]

@Am6Vue2 Can you please open an issue on https://t.co/6g03OQnhH2 . This way we can share some screenshots and other troubleshooting information and help get you fixed.

[ReflexSOAR @reflexsoar]

We just released v2022.06.00 with a couple bug fixes and enhancements, more details here:

https://t.co/tfE4MHDaTy

[ReflexSOAR @reflexsoar]

@Am6Vue2 If you need additional support you can open an issue at https://t.co/6g03OQnhH2 and we will help troubleshoot

[ReflexSOAR @reflexsoar]

@Am6Vue2 If you used our install script the default credentials for the UI would be [email protected] and a randomly generated password that is output during install time. If you chose to go docker compose on your own the default is [email protected]/reflex

[ReflexSOAR @reflexsoar]

Teasing a new feature we are working on...Detection Rules directly in @reflexsoar! Let us know what you like or dislike about your current alerting platform. Stay tuned! #reflexsoar #soc #infosec #soar

[ReflexSOAR @reflexsoar]

We've been live for a month and are continuing to work on our next feature; an Alert engine. If you could pick, what would you wish your alert engine did that it doesn't do today? Stay tuned for a preview of Detections #reflexsoar #soc #soar #infosec