SmartHunt is a managed service from Infoblox Exposure Management | Axur that performs the platform’s initial setup and ongoing tuning, with a focus on keeping settings healthy, automating ticket triage, and reducing detection failures. The service is organized into playbooks and varies according to the subscribed plan.
Please note: The scope and limits described in this article are tied to the plan subscribed to by your company.
Coverage Areas
SmartHunt Services may cover the following areas:
Brand Protection, except Malware;
Online Piracy;
Data Leakage;
Deep & Dark Web, according to the configured filtering rules;
Executives & VIPs, including configuration and setup.
What is included in the offering?
Initial setup and ongoing tuning
The SmartHunt team is responsible for the platform’s initial setup and tuning. After onboarding, ongoing operations are carried out based on the playbooks applicable to the customer’s plan.
Activities may include:
Ticket triage through automation, as well as automation maintenance and management;
Creation, adjustment, and maintenance of collections, also called search bots;
Adjustment of filtering rules and in-depth Threat Hunting (TH) analyses;
Execution of tenant maintenance and tuning activities, according to the playbooks;
Handling customer requests through tickets;
On-demand guidance and education, according to the customer’s needs.
Maintenance playbooks
Operations are structured around three main playbooks:
1. Setting Health
Focused on preventive actions to keep the configuration healthy and ensure that resources are delivering the best results.
Key indicators:
Noise reduction rate, with monitoring and action on false positives;
Bot conversion.
Key actions:
Analysis of the customer’s complete configuration after onboarding;
Bot creation and conversion analysis;
Keyword library management;
Asset and brand configuration management;
False-positive analysis and handling;
Creation and adjustment of filtering rules;
Safelist management;
Education and guidance.
2. Automations
Focused on creating and managing ticket automations, aligning validation criteria, and monitoring the SLA for relevant cases.
Key indicators:
Need for human validation;
SLA for relevant tickets, such as incidents, handling, and quarantine.
Key actions:
Creation and management of automations;
Analysis of tickets that were not automatically triaged and escalation to the product team when necessary;
Alignment between triage criteria and the attributes available on the platform;
Analysis of tickets interrupted and submitted for takedown by the customer;
Education and guidance.
3. Detection Rate
Focused on analyzing cases manually created by the customer to identify and correct causes of missed detections, including in-depth Threat Hunting analysis to prevent future occurrences.
Key indicators:
Detection rate, comparing cases created by Infoblox with cases created by the customer;
Aborted takedowns on tickets opened by the customer.
Key actions:
Analysis of tickets created by the customer;
Mapping knowledge about the sources monitored by Infoblox;
Analysis of Threat Hunting, filtering rules, and bots to identify gaps that caused or could cause a missed detection;
Education and guidance.
Configuration reviews and automation management
The frequency of configuration reviews and the limit on automations managed by the team vary by plan:
Plan | Configuration review frequency | Automations managed by the team |
Starter | Every 60 days | Up to 10 |
Business | Every 30 days | Up to 25 |
Corporate | Every 15 days | Up to 75 |
Enterprise | Every 7 days | Up to 150 |
The customer may create as many automations as they want. The limit above applies to automations managed by the SmartHunt team.
Reviews may be triggered, among other reasons, by low bot conversion, a significant increase in false positives, low automation conversion, or a significant increase in tickets opened.
Detection rate and SLA analysis
The Detection Rate playbook analysis is triggered when:
The customer opens a ticket questioning a missed detection; or
There is a significant increase in case creation, based on the 20-case threshold.
After the analysis is opened manually, the SLA is:
Plan | Analysis SLA |
Starter | Up to 5 days |
Business | Up to 5 days |
Corporate | Up to 2 days |
Enterprise | Up to 2 days |
Deliverables
The team may provide the customer with:
A report of the actions performed on the platform;
A report of the playbook indicators, as applicable to the subscribed plan.
What is not included?
Customized reports;
Manual ticket triage, unless the team considers it necessary;
Triage criteria outside the company’s scope of operations or that cannot be automated;
Recurring meetings or meetings without a previously scheduled time, unless there is a confirmed urgent need;
Customer support outside the communication channels;
Support outside Brazilian business hours (GMT -3).