The managed detection and response (MDR) industry is facing new challenges including the need to manage the influx of security data. Data analytics platform provider Snowflake provided an example of how it can help MDR providers navigate these challenges through its partnership with MDR vendor ReliaQuest during this week’s Snowday 2023.

Omer Singer, head of the cybersecurity strategy at Snowflake, noted MDR providers now find themselves at the intersection of technological advances, the migration of attack surfaces to the cloud and the evolving threat landscape. Plus, security giants like CrowdStrike, Microsoft and SentinelOne are expanding their reach into the MDR domain by bundling managed services with their popular solutions.

With the shift to the cloud, the volume of security data has skyrocketed, Singer told SDxCentral. “We're hearing from customers that when they move up into the cloud, there's actually 10 times more telemetry.”

“That has put a lot of MDRs in a tough spot because they were built to secure on-prem infrastructure. Now they're getting a lot more data coming in faster, with a lot more variety to it. So I think there is that need to be able to store and analyze data at a much greater scale,” he said.

Brian Foster, president of product and technical operations at ReliaQuest, echoed the key is data handling.

“Our view on security operations is that the hardest, gritty operations are a data problem,” he said. “What I find with MDR vendors is ultimately they're having to figure out how do I deal with the amount [and the viability] of data that’s coming into the system. Making sense of that is critical.”

One way to deal with this issue is to take all the security-related data into the MDR platform and figure out what data makes sense, but many MDR vendors don’t know how to deal with “tons and tons of enterprise data at scale, efficiently at speed, so that they can work quickly to respond to threats,” Foster said.

However, ReliaQuest's approach to the data problem is to leave the data where it is and dynamically pull it into its data platform, which is built on Snowflake's Data Cloud. “Because we leave the data where it sits and only pull the data we need, we could be much faster, more efficient in how we use the data and ultimately respond faster to the customer in terms of responding to threats, etc.,” he added.

Singer touted Snowflake's growing relevance in the current MDR landscape, offering scalable and efficient data storage and analytics solutions built in the cloud with artificial intelligence (AI) and machine learning (ML)-enabled automation.

Integrating with Snowflake’s Data Cloud, MDR providers can transform from service providers to product companies.

When customers sign up for ReliaQuest’s product GreyMatter, they get Snowflake attached to it as that’s where the provider stores their data, Foster said.

“We integrate with wherever the data is stored. If it's in a security information and event management [SIEM], if it's in a security data lake, it's in an endpoint detection and response [EDR]. If it's in their cloud applications, we're going to pull that data into GreyMatter on demand,” he explained.

“I'm putting it into Snowflake where we're doing all of our analytics. We have our own API that's built on top of it. It's all leveraging and using the Snowflake’s infrastructure and Data Cloud, and that allows us to quickly identify if that's a threat or not, automatically respond to it, and then once we're done with that we can release the data.”

Snowflake’s capabilities allow MDR providers to facilitate data sharing using Snowflake’s Secure Data Sharing or via the connected application deployment model. The data-sharing capabilities make this “a two-way street” between security teams and MDR providers, Singer said. “If two organizations use Snowflake, they're able to share data without even needing to copy it over. And so this can potentially address the big challenges for security teams that might want access to particular data that their MDR has.”

More and more MDR providers are using data science and generative AI (GenAI) to automate their tasks and boost data analysis efficiency. For example, large language models (LLMs) can provide natural language explanations of complex rule logic and gnarly log lines, Singer noted.

“There's a big opportunity to apply generative AI and large language models to a range of use cases within MDR and security operations. But one of the challenges is that this is pretty sensitive data. This is data that customers generally don't want you sending out to some third-party LLM for training in an inference,” he said.

“That's a challenge that Snowflake is addressing by enabling customers to run large language models within the data platform. And that way the training first happens against the data within the security and governance of the Snowflake environment,” Singer added. “Being able to support these very powerful open-source LLM models within Snowflake is a big focus for us.”

Image credit: Snowflake Inc.