Functions

This article describes how Functions are related with Signals, essential components of Functions, and multiple usecases where Functions are applied.

What are the vital functions and infrastructure items that are most important to a modern organization?

Functions are a major component of the Resolution Intelligence Cloud, designed and deployed to provide continuous operational and security analytics on those critical items.  These may include other services, microservices, assets, entities, databases, applications, and infrastructure components – essentially most things that are critical and important in the digital and IT realm – that define what an organization is and how it creates and delivers the goods and services that make each organization unique.

Protect What Matters Most with Functions

Best practices for Functions should consider only the most important – VIP – assets, entities, and applications that are foundational to each organization. For a SaaS company, the components that keep the organization’s website up and running are vital.  However, malware on a laptop is not – this is the type of design-thinking that should be considered when evaluating and deploying Functions within RIC.

Components of Functions

A Function is comprised of a few key elements that provide continuous analytics for each VIP asset:

1. Functions will be associated with Assets, Entities, Applications
2. Functions will have Escalation Policies  
3. Escalation Policies will be comprised of the Users that will be routed critical information from each Function and Asset 
4. Functions will have “Route Signals”   
5. This is the logic that comprise the signal management and describe the Asset names and the events and scenarios that form the reason for the Function

Functions Ownership and Management Functions can be owned and managed within Escalation Policies to specific Users and teams within an organization.  More detail on Escalation Policies will provide additional context for designing Functions for the most efficient management and escalation policies.  Proper design of Functions and Escalation Polices within each Function will provide the most efficient resolutions, expertise, and specialized attention at those critical times when something important – and potentially very bad – is occurring within an environment.

Functions and Signals 

Functions drive further efficiencies and focus within organizations regarding signal management (events and alerts). Properly constructed “Route Signals” (the operational logic of the Service) reduce overall signal noise as only multiple and similar signals impacting an asset are correlated into Situations.

A Function without the correlation of signals into Situations (and multiple Situations create ActOns) would be effective at monitoring an asset but would drive signal noise and inefficiencies for the SOC and threat hunters.

Use Cases of Functions

1. Payment Gateway Systems
   Functions should be designed for and associated with VIP assets so that problems are identified and resolved before actual negative consequences, such as the payment systems of an organization
2. A Function designed to monitor CPU-load utilization, for example, would drive the appropriate autonomic resolutions (if possible) and notify the correct Users and teams if necessary if performance degradation and the threat driving that degradation could not be resolved within human (SOC) attention
3. Websites
   Multiple Functions will be deployed within our platform to oversee and keep a SaaS organization’s critical web infrastructure up and running despite the complexity of attack scenarios
4. VIP Databases
   Functions should also be designed to provide continuous analytics to entities and databases and not only thought of as Asset or infrastructure safeguards
5. Service Level Agreements
   Functions can be associated with Service Level indicators, which provide further efficiencies for managing previously stated agreements, routing policies, and timeframes for attention and resolution

Let's configure Functions to route noiseless signals from target devices within the Resolution Intelligence Cloud.