Revelstoke
Unified Data Layer Augmenting SOAR Operations

No matter how far back one travels in time, one will not find a day in history when successful problem-solvers didn’t devise innovative solutions to some of society’s most pressing challenges by virtue of their creativity, knowledge, and skills. Bob Kruse and Josh McCarthy, co-founders of cybersecurity automation specialist Revelstoke, are archetypes of these individuals who have utilized their technical acumen and problem-solving aptitude to help peers steer emerging cybersecurity challenges.

Having worked together for over a decade in industry-leading cybersecurity companies, Kruse and McCarthy were well-known for their baseline familiarity with SOAR. Their peers often approached them, expressing their dissatisfaction with existing platforms. It wasn’t long before the duo realized businesses struggle to navigate the complexities of available monolithic SOAR platforms. Driven by their problem-resolution aptitude, they, along with David McKinley, CTO of Revelstoke, and Nick Graves, Chief Architect, developed the eponymous SOAR platform that empowers businesses to enhance their security posture and bolster the operations of their SOC teams.

Revelstoke’s revolutionary low-code, no-code automation platform allows users to address fundamental SOAR needs, focus on big-picture items, and identify areas of deficiencies. It enables users to automate processes, optimize workflows, and scale their operations as needed, simplifying and amplifying SOAR processes and associated outcomes. Unlike other peer-level solutions, it is built on the company’s proprietary unified data layer (UDL), an innovative component that enables SOC teams to work faster, more effectively, and smarter.

“The UDL takes away the tech debt and complexities of managing data models from users and provides them with the flexibility to switch between different integration vendors,” says McCarthy, CPO of the company.

Since SOC teams employ numerous cybersecurity tools to execute their SOAR operations, they often generate datasets in distinct formats that hinder efficient data transfer among multiple devices and platforms. Revelstoke normalizes inbound alert data as well as integration actions, creating a universal language to work with case data and leverage the capabilities of integrated products, enabling various platforms to communicate and saving users from writing integration-specific code while also preventing vendor lock. This is possible as the UDL allows Revelstoke to create abstracted versions of the various integration actions and then identify which integrations can fulfill the dependency at run-time and supplements the information in the back end to foster efficient communication. This functionality is available in all major categories of products, including vulnerability management, end-to-end lifecycle case management, endpoint protection, SIEM triage, and more.

The UDL is extremely valuable for enterprises constantly onboarding different vendors and customers and acquiring companies with entirely dissimilar software stacks. Rather than creating unique workflows for each use case and maintaining them, they can leverage the UDL and implement the same workflows for all. Using Revelstoke’s intuitive low-code drag-and-drop Kanban interface, built-in integrations, performance metrics, and reporting capabilities, SOC teams can dodge threats faster and give stakeholders a comprehensive overview of their impact on the bottom line. As organizations attempt to improve the effectiveness and compliance of their SOC operations, case management is becoming increasingly vital in SOAR platforms. Riding on the coattails of this emerging trend, Revelstoke offers case management built into its platform.

The UDL takes away the tech debt and complexities of managing data models from users and provides them with the flexibility to switch between different integration vendors.

Businesses can manage their cases to ensure efficient and consistent incident response processes, bolster the impact of senior staff, bridge operational skill gaps, and guide junior investigators and analysts. Users can automate data collection, escalations, closures, and postmortem reporting, reducing caseloads. Analysts can manage inbound signals, identify false alarms, and improve their threat-hunting capabilities. Augmenting Revelstoke’s capabilities are the company’s premier service offerings that ensure the SOAR platform’s efficient and successful delivery and implementation.

Throughout its interaction with clients, Revelstoke’s team stays embedded with them, conducts thorough discussions to precisely identify their challenges, and eliminates security bottlenecks. It builds client workflows depending on their preferences and delivers support service over the contract’s life cycle. Due to this customer-centric implementation model, Revelstoke keeps its finger on the pulse of its clients’ changing requirements and feedback and improves security workflows. It has helped numerous businesses replace legacy SOAR platforms and seamlessly implement Revelstoke to multiply the productivity of their SOC teams. As McCarthy says, “We offer better support and knowledge, and that’s what makes a difference in our client’s SOC operations.”

As the winds of change continue to blow in the space of cybersecurity and threats become handbrakes of organizational progress, Revelstoke will continue to radically transform the SOAR space and help businesses stay one step ahead of lurking cybersecurity menaces.