USING CISCO SECUREX FOR SOC AUTOMATION

Abstract

Relevance. The article is devoted to the analysis of the capabilities of the Cisco SecureX platform in the context of automating processes within Security Operations Centers (SOC). The study emphasizes the relevance of this research, which is driven by the growing number of cyber threats, the increasing complexity of attacks, and the shortage of highly qualified professionals in the field of cybersecurity. It is underlined that traditional SOC operation methods are insufficiently effective under conditions of multivector attacks, which objectively necessitates the implementation of orchestration and automation technologies. The research systematizes the core functional features of Cisco SecureX, including: integration with multi-component cybersecurity infrastructures (SIEM systems, EDR platforms, IDS/IPS solutions), which ensures the creation of a unified information space; orchestration of SOC processes through the use of response playbooks, enabling the automation of routine operations, reducing incident handling time, and minimizing the human factor; enhanced analytical capabilities, based on the use of machine learning mechanisms and event correlation from heterogeneous data sources; improved accuracy of threat detection through multi-layered data analysis, including the examination of user behavioral patterns and network activity. Particular attention is paid to the research aspect of SecureX’s impact on SOC efficiency. The study substantiates that the use of this platform makes it possible to reduce the Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR), which are critical indicators for evaluating SOC performance. It is demonstrated that integrating SecureX with Threat Intelligence systems provides a more comprehensive contextual understanding of attacks, increases the level of proactive defense, and contributes to the development of an adaptive security architecture. From the standpoint of scientific novelty, the article presents a systematization of approaches to SOC automation, in which Cisco SecureX is considered not only as a tool for practical implementation but also as a subject of research for evaluating the effectiveness of integrative security platforms. The paper identifies promising directions for further study, including: advancing the level of cognitive SOC automation based on AI, optimizing response playbooks through adaptive algorithms, and assessing the scalability of SecureX in diverse organizational environments. Thus, the implementation of Cisco SecureX is justified both from the perspective of theoretical research and practical application. The platform contributes to the formation of a new approach to information security management, based on integration, automation, and analytics, which determines its strategic significance for enhancing the cyber resilience of modern organizations.