Name: GreyMatter Agentic Teammates: The Exponent of Your Security Team
Uploaded: 2025-10-24T17:46:03.369Z
Duration: 30 min 12 s
Description: GreyMatter Agentic Teammates: The Exponent of Your Security Team

Transcript for "GreyMatter Agentic Teammates: The Exponent of Your Security Team": Welcome in, everyone. My name is John Marshall, director of product marketing for ReliaQuest. And today, I'm gonna walk you through our product gray matter and, how we use a Genesys team mates to make you multiple. But before we jump in, I just wanna go over a couple of housekeeping items. So your audio is gonna be muted for the webinar, but doesn't mean you can't join the conversation. So feel free to ask any questions in the q and a box throughout the presentation. I'm here. I'm gonna answer any questions that I see that pops up. But also we have individuals from our product team who's, online to help you answer, to help me answer any questions, in real time as well. And then at the end, you know, I'll I'll I'll stay on to kind of answer some questions, as well. And then if we don't see anything there, or that comes in a little bit later, we'll make sure we email you and follow-up, on those questions. The recording will be available, to all the attendees, so you you will have that even after, we're done. But that's enough with the housekeeping power of it. I do wanna take a step back for a moment and just think about the reality of today's stock before jumping in. Right? So security teams today are being asked to do pretty much the impossible. Right? You have the attack surface is essentially exploding. You know, there's, threats moving at machine speed. So we have in our annual threat report that the average time it takes for an attacker to break out, so I can move laterally laterally and things, is around forty eight minutes. But we've seen above average attackers do that in eighteen. Right? So it's constantly getting, faster and faster, yet most teams are still kind of stuck in this firefight, mode where they're looking at playing a whack a mole with alerts. There's limited resources, budget. Right? There's, the team being burnt out as analysts. And I used to be in the same situation. Right? I was an analyst for a couple years before moving over to where I am now. And, you know, I had to do a lot of tier one, work. I wanted to do other things like Brett Hunt. I wanted to do advanced session engineering. Right? I want to do intel research, etcetera. But the reality is, right, no matter how hard your team works, there's always more work to be done. And usually, there's not a lot of people to cover it all. So, that's where a Genesys team come in. Right? What we build is, role aware, autonomous personas using AgenTic AI to multiply your team, right, to multiply your expertise. So the gray matter platform already takes you out of this reactive cycle of of of looking at alerts. Right? Because it handles all that, you know, for you. And we have other kind of, webinars and and demo videos on how that works. I'll go through it very briefly so you so you can see it. But if you wanna catch up on it, feel free to check those out. But now the agentic teammates makes you exponential. Right? So our agentic AI secured operations platform takes you from reactive, moves you into, you know, a proactive state, and then it it actually makes you more predictive with the AgenTic teammates and they help you do more of the work that you actually wanna do. It's almost like having a team of of expert threat hunters and intel researchers and detection engineers right behind you, ready to kind of make you multiple. So let's just kinda jump in and I'll actually show you what this is like in the platform. So what you're seeing on screen right now is a typical alert that we get, you know, from plugging into your environment, whether it's just plugging into your your your existing tech stack like, you know, your EDR, your firewall, whatever it may be. We have our detections that can trigger based off that. So we see, you know, this is a file that was transferred to some sort of threat host. The way the platform works, with every single alert that's generated, it actually goes through and analyzes everything one by one. So I see this is the the summary that came on. Right? So I understand what's happening here. There was this unauthorized SSH connections from some internal host right out to this external IP here. I can see a couple different things about the alert. Right? Some of the details, the artifacts that triggered it. So again, there's that, internal IP, that external IP as well. The port was 22 for SSH, some other artifacts. And I have an entire write up here on the media description that was generated by, AgenTic AI. Right? So the the the platform itself went through and analyzed the entire, alert that triggered and provided a summary, provided an analysis that went through a bunch of different steps. You can see it looked through firewall logs, historical searches, things of that nature. And it made some recommendations or could potentially took some actions here, right, based off of the feedback that you provided to to do. So that is where you would see the outcome. What actually happens here on the right so this is kind of the transparency here of all the different steps that the platform takes to get you to, that answer on the left. So the first thing it does is it generates a plan. So with all of our our AgenTic AI, it's it's looking at the different detections, looking at the what the alert looks for, the the trigger artifacts, etcetera. It generates a plan as step number one. So here it says, we have this alert for file transfer to the host. There's these, artifacts that it was triggered by. I have these skills. Right? So we provide every single persona a skill, or multiple skills that they can share across from each other. And essentially, this could be like doing maybe, research or maybe understanding risk of a user or things of that nature. We also have tools that we provide. So, like, hey. Maybe you want to do, artifact enrichment or maybe you need to, you know, look at decoding a a PowerShell script or something of that nature. Like, these are tools that you have, you have skills, but they're all kind of a a master persona. So a persona, an agentic persona or a teammate here, are collection of of agents, if you will, that dynamically work as one to achieve a specific goal or specific role. Right? So it's not it's outside of a task. It's more of a an actual role. So in this case, it's more IR. But it basically generated a a plan that says, hey. Based off this, I'm gonna look for these things and that's gonna be the purpose of my plan. And then as you see, the next couple steps is it actually went through and looked at each, or execute on each plan with each tool. So the first one I did was look through an understanding of the historical, data, the understanding of what's happening, what alerts may have triggered that may be relevant or could be associated with this activity. So you will see here that, like, hey. Here's some additional alerts for the same IP. Right? There's some support scanning activity. Might have been some other stuff that we saw that's more recent. But you see the summary here. So it's gathering that information and using it in its investigation. It'll do some artifact enrichment. Right? It'll do some intel enrichment. So think of, like, the bad IP that we saw, the external IP. And what is this IP? Right? So we were able like, the the platform was able to see that it's owned by Verizon, and there's multiple intelligence sources that provide, consistent information. So you see, we looked at spur, looked at virus total, looked at abuse IPDB. Like, gray matter itself is connected to over 45 different, threat intelligence feeds. And then we have our threat research that is also plugged into it as well. So it's able to kind of understand what's going on. The platform here just reaches out and says, hey. Based off this information I'm seeing, you're the ones that had something about it, and here's what they had to say about it. And so you're able to see that. And even when we look at the different technologies that are connected to gray matter. So we don't require you to move any sort of, tools or replace any sort of tools or or or things like that. You take gray matter, you plug it into your current existing tech stack. If you're a Splunk shop, if you are a Microsoft shop, if you are a CrowdStrike shop, whatever it may be, whatever technologies you have, you plug it in and then the the platform actually goes out. It pulls those alerts as you see, but it will also go out and do additional searching, to understand what's happening across the environment. So for this case, right, it looked at the host in a specific place. Right? We looked at the username. We We see some firewall logs. We see data coming from the network, activity. There's a lot of other things that are happening that you're getting that data that wasn't necessarily within the initial, data pool because you're you're looking at it as from a an actual investigation standpoint. Right? So the agentic AI is going through and doing all this autonomously. Right? And the and the best thing about this is if you see this has this has, some additional information that we wouldn't have before. And so what it did was it actually made a a replan, a new plan. So a replan, it said, hey. You know, I have this information. I need to actually replan around this. So it replanned around this, and this happens if there's an error. It happens if there's some sort of issue or whatever it is as well. But the idea is that, again, it's truly autonomous, it's hands off. You just need to understand that it will take it just like if you were a human analyst who ran through this, it will actually go through and replan around it. I'm back when I was an analyst, if I found new data, found new information, I'm like, oh, well, now I gotta do this because that's something new now. Right? Or maybe I got an error over here that I need to figure out how to do it because I need to finish this investigation. So the rest of the steps, I won't go all the way through, but you can see it even did some URL analysis. You know, I made an observation and replanned again based on that observation and also went through and did some command line analysis, and even searched Google. Like, these are steps that it takes, you know, based off of the day. Like, sometimes if I go to another alert, it may be completely different, but it's based off of the alert that, that was generated. You have this final decision right here to take an action to do something around, just around this. Now this is kind of standard. Again, I won't go through all of it because that's something that is standard for for, what we've been talking about for a while. What I wanna talk about in this particular demo is now going beyond that. Right? So what if I wanted to, talk to a team of experts? What if I wanted to get to a point where I'm talking to or do some follow-up questions with this particular, investigation? What I can actually do now is go into here where it says chat with gray matter teammates. That pulls up my chat here on the right. Right? And I've I've already kind of premade some some different questions. But now what I can do is I can ask different questions about the activity that's here and it's I'm now pulling from expert, Agenstic AI, right, Agenstic personas, like a detection engineer or like a, intel researcher or a threat hunter, things of that nature. So, one of the questions that I asked here was, hey, do I have any detection to protect me from the threat group, Black Boston, because they do similar activity here. And so the response I got back was yes. Right? Your environment specifically has detections for Black Boston, which are reinforced by this comprehensive, rule set. And it kinda give me some examples or the one that is primary, for this. But the idea is that this this allows me to chat with some experts and make me a little more multiple in terms of the actual investigation so I can get an understanding of what's happening. So scrolling up a little bit to the to the top. Right? So you're seeing the first one. Right? It says IP associated with, Scatter Spider. You see it's going directly to a threat intel, analyst. That's that's the persona there, the teammate who will actually answer that question, and it will do things like search for digital risk. Right? So it's gonna search to open deep and dark web. It'll also do a Google search depending on whatever it needs based off of that, and it will provide information on that. Now this one, it said there was no, association with this. Obviously, it's looking at black box activity. Right? But you can start talking to both of them. So the way our our platform works with a Genesys team is there's multiple roles that we believe are essential for the, security operations, team. Right? There's just IR, which we kind of already saw. Then there's, threat detection, so detection engineering. There's intel research. There's threat hunting. And then there's just general IT health, making sure that the tools you're using to, detect and contain and investigate and respond to threats are actually still up and running and could help. So you can engage with the teammates here. Those are the kind of the first, like, five of of of the roles you can you can grab from this by asking these questions. You can start with them here, but there's other places you can use them there as as well as, like, Intel. Right? So if I went over to Intel here, right, what I can do is I can see in our Intel environment where we have gray matters a lot of the things that are coming here. So I see, you know, threat reports. I'm gonna probably cycle through a bunch of other things that we're seeing. Like, a lot of good data about things that are happening out there in the threat landscape. But if I am a a a threat intel researcher and I wanna do threat research, you know, I'm being getting asked from my board, hey. We need to know if I'm impacted by Scatter Spider. Like, a lot of times what happens is you gotta go to these different places one by one and kind of string that data together and make a report and then, you know, you get generic information. You're you're trying to make it so that it's easy. You know what you're looking for. You know what you want, but it's, difficult to do that and do that at scale. You can probably do that, but it might take you hours, sometimes even days. So what you can do here is you can actually engage with the teammates here. So some of these you'll see is a bunch of different reports that were in. You can engage with the teammates here to say, I need you to do some research for me on my behalf. So if I wanted to say, you know, what is, the impact of scattered spider on my organization based on my detection coverage. What happens here is I'm actually telling the the the platform to engage with the threat research teammate. Right? So the teammate will come and say, okay. I am going to now generate this report. So what you're seeing is you're looking at the the question or the request that I gave it. That's gonna initiate some steps. And all this is, again, transparent. You can see exactly what it's doing. But you're looking at the threat intel teammate. You're looking at, gray matter. Choose the right teammate for you to say, based off this, we're gonna look at it. Now one of the things I did ask was not just give me the impact of Skydispider, but also base it off my threat detection coverage. So what you'll end up seeing here as well is an interaction with the detection teammate. Right? So I need to understand what's happening there as well. Like, you're looking through it. You see, hey. We're doing the research. We're doing we're looking at digital risk. We're looking at Google. We're looking at some additional things. Now for the sake of time, I'll swap over to another one that I've done already that's simp like, similar to this, and this is what came over. Right? So you'll see this was the report that was generated where it says, hey. This is Scatter Spider evolving social engineering and ransomware tactics. The first thing he gave me was an executive summary. So it says scatter spiders, you know, is who who they are. They're financially motivated. Right? And it also talks about a a detailed analysis of my specific detection coverage. So it says, based off your 346 deploy detection rules, you have decent amount of of of of coverage. That's a strong foundational coverage against the common TTPs. However, look at that that, next sentence. It also reveals critical gaps in detecting Scatter Spider's signature method. So, yeah, the TTPs are cool, but you probably have or you need some additional coverage around vishing, around SIM swapping. Right? These are the things that Scatter Spider actually does, MFA fatigue, you know, cloud based threats. Because something like that could lead to a significant data breach, and potentially, you know, ransomware because we know ScatterSpider, Black Hat, they kind of work together with ransomware. So this is something that outlines immediately for the report that, hey. You're covered from a detective standpoint, but some things that you may wanna look at will be here. It goes through an overview, the background, all the different TTPs, even sort of recent campaigns. And the way it's doing that, it's pulling data from we already have in Intel, but also looking at the open web. We have tippers on the dark web. We have things on the on the deep web and it's pulling those things around. As you saw, it found some stuff from Google. It's looking at a bunch of different things to provide you with a write up or a report that you can leverage in, you know, giving it to your board or your or your team or whatever it may be for you to understand that. But it's taking what you already know and, what it's already known about your environment. So you're seeing yet the targets that are are exploited, you know, the vulnerabilities. And then you have here the mitigation strategy as well. So it's like a a common thing we like to see, which is what are the recommendations I need to do? And it it could be outside of gray matter. Right? It's employee security training. Maybe you see them train your employees or or employ, robust MFA policies or do something with maybe more endpoint and network monitoring, things of that nature. Again, current detection looks good. Right? But there's other gaps we wanna focus on, like social engineering. Right? There's no rules for that. MFA bypass. There's no nothing from that perspective. And what I can do here, right, is as I'm looking at this and I'm seeing the analysis come by, I can actually go back here to my, you know, team and say, well, the detection team made or or if I want to say, well, deploy these detections for social engineering or or or MFA bypass or whatever it may be, then that engages the detection, teams to actually go in and deploy that. Right? So again, that's all AgenTek AI being done in the background. So outside of writing up a report, they can actually do things. Right? They can deploy the text, they can kick off hunts. So for instance, a good example of this is if I wanted to kick off a hunt to see if I have been impacted in the last, you know, couple of months or thirty days, whatever it may be, or scatter spider, I can kick off that with my threaded, threat hunting, capability inside of, the team mix. What I wanna focus on here though before getting into that is more like the OIA. This is very important because it's not just generic threat research that you already kinda saw, but it looks at specific impact based off my industry, based off my tech stack, based off my, you know, detection coverage and gaps. And you will see here is the true impact of SCADA Spider on this customer here, which is just a demo environment, Xpony Inc. But it says, hey, you're a software company based in United States, so that means you're a high risk category because SCADA Spider actually has documented history of successfully targeting technology companies in The United States. Right? And then but it gets into more specifics. So outside of industry, if you look at the risk specifically to you, right, it's significantly elevated because you use technologies that they actually love to leverage. So identity infrastructure, you know, Cisco Duo, Okta, you know, Entra ID. These are things that will allow them to get a foothold to come come into an especially with your cloud presence as well, like, you know, AWS, GCP, they can move laterally there. So it lists out the thing that you actually have and tells you what what you what you should do. A a great one here, I'll I'll just call out here, is there's a road map time frame. So, hey, what you can do right now, which is a comp you know, immediate thirty days, what you can do in the short term, which is sixty days. Right? And then from there, what you can do in the medium term, which is more of like, hey, from there to ninety days and even success metrics on how to get that. And you can see where we pulled the sources from. Here's another one here that, I I I ran a lot earlier, but you can see there's a lot more sources from all over. Right? So we've got stuff from, you know, various different people, various different, you know, search that we've ran, executed. We're not specifically just looking at us. We wanna make sure we're giving you the right information at the right time. Now again, this is just one of the kind of the the teammates' capabilities and skills. It's just creating a a, you you know, tailored threat report. The additional ones, again, like, as you kinda can see, or they're pointing out here is creating new detections, looking at my detection gaps, telling me where I I need to deploy more, you know, doing any sort of searches across the environment. If I wanted to say, you know, have I saw this activity in my environment before? This would be a good question because what will happen is it'll go through and create any sort of searches which kind of already looked at some of these, but there's no additional searches here for a sock bullish, sock bullish activity. But I can leverage these teammates as, follow ups or as additional questions here. Now the other part of this, right, is outside of leveraging teammates for that. Right? So you have intel research, you have threat hunting, you have detection, etcetera. Once they start talking to each other more and more, right, because they do talk to each other, they can share information, but they start leveraging data from our customer environments. They start leveraging trends. They start noticing detection gaps, threat hunting findings. They start looking at, you know, things that are happening on the open deep and dark web. What What they end up doing is they take all the data they're seeing about you and your environment and what's happening on the open, deep, and dark, and they start to create threat models, attack path mappings, and things of that nature where they can actually show you, hey. What is this you actually do today? So it ends up saying to yourself again, when I say prediction of of security, it's not predicting the future. It's more so predicting how this could impact your environment based off what we know about it moving around right now in out in the wild or maybe in over here in another industry. So you end up having them talk to each other and work with each other, to see to see a lot of that. So this is just kind of the the first, you know, version of this or the first, I would say, teammate, if you will. We'll have another one that looks at, you know, threat hunting. We'll have another one that looks at detection capabilities as well and even IT health. But I wanted to highlight one of the ones that were very it's very critical to a lot of our customer base, which is that we need to understand what attacks are. Basically, that's and we have one or two, threat researchers, but they can be a lot multiple. Now with this, you can create threat reports at the within minutes and still be able to, you know, become the the the main, you know, MVP, the operator here that is, your expertise kind of multiplied. So for the sake of time, I do wanna answer some questions. I'm seeing some pop in the chat. So I'll go over here to the question. I continue to keep asking questions as I go through. But the first one here, says, how do the agentic teammates know which one should handle a request? Good great question. So gray matter in itself is an agentic platform. So we think about the platform itself, it's it's it's agentic. And what happens is the platform itself is a kind of a master orchestrator, an agentic orchestrator, and it knows where to go. It knows who to talk to. It knows what your request is. And so it basically says, I look at the request and I know who to talk to, I know who to pull in. So for this, as you as you saw on this one, it knew who to pull in for the right ones, whether it was detection specific, whether it was, you know, intel specific, it knows that. So you don't have to worry about, you know, whether it's this, whether it's that or reaching out directly. All you need to know is, hey. Here's what I'm trying to get across, and you answer and you ask it that way. But great question. Another one here. What models do you use and how do you train them to avoid errors? Great great question. So we use a multiple, models, commercial models, that we use use some proprietary models as well. But I wanna mention that we don't train any models. Right? So we leverage the models and we have kind of an overlay that says, you know, we're gonna choose almost like the overshare. We're gonna choose what makes the most sense. We're gonna learn them kind of in parallel sometimes and figure out which answer makes the most sense, and then we'll provide it to the, user end user of which one actually is. The training we do is not really training. A lot of times training takes a long time. That's why you have some platforms that may take weeks or months to understand your environment, and then we have to get it right or or anomaly happens and you have to retrain. It takes a lot of time. We stick to guidance and providing it, that information. So you things like memory, things like personalization, things like just giving it rag, etcetera, to ensure that we can do these things in real time. Right? Because threats move in real time, we have to update things in real time. So we take a lot of kind of the commercial models, put our proprietary information on it, and then we do a little bit of, a lot of, training and, sorry, not training, but a lot of, guidance versus training to ensure that it's accurate. And then, obviously, we get feedback. But for this one, for instance, like, you're not gonna get a lot of negative feedback here or negative information because it's going out to places that we have verified. Like, there's sources we verify. This is where you get good information from. So threat intelligence feeds, thing that we're seeing, pippers, etcetera, like news and things that have that nature. Like, that information is verified. So when it goes out to reach it, it's just pulling it back. So, for this one specifically, you don't really have a lot of errors. Do maybe one more. The teammates only respond when we prompt them or can they run-in the background? So the teammates run-in the background, and they can also respond to any sort of request you've made. So you think about this, there's things that they can do. They can kick off hunts in the background. If you want to have it, you know, potentially schedule things like a a pace every every day schedule me a report or intel research. Like, that can be done. But they also do things on their own. They're they're autonomous. Right? So we think about the difference between, kind of what you're seeing today with task based agents and this this persona based agents. Task based agents, a lot of times, are things that do one specific task. Right? Like, you think about, hey, it runs a playbook or it analyzes data or it creates a script. Like, those are tasked with agents. We use those as skills. Right? So a a persona, think about threat intel, should be able to analyze data. It should be able to, you know, run a playbook. It should be able to do these different things. But the threat hunter should also be able to, you know, understand data and run playbook service. What are the skills that are shared across personas? And for us, right, what we do is we have them act autonomously in the background to deploy new detections, to, you know, run threat reports, to execute threat hunts, to understand the environment, to provide you with predictive, analysis of your environment and just general security posture recommendations. So that happens. But we also will have them operate semi autonomously, which is which is what you're seeing here where you can interact with them directly and say, hey. I actually need information more on this alert or more on this, hunt finding or explain to me what happened here with this detection gap and why I need to to do this a little bit better. I'm seeing a few more, but I wanna make sure I'm respectful for everyone's time. So what I'll do is I'll end it here. I'll go off camera. For those of you who have to drop, please feel free. Thank you for your time. Continue to keep asking questions. I'm still gonna be here. And then we'll also have, again, people on the product team who have already been answering questions, it looks like, who are gonna continue to keep answering questions. And then again, like I said before, if we don't get to it by the time this kind of ends, we will make sure we email you, an answer to your question, for sure. So, again, thanks for the time. I appreciate it. This is, our AgenTic AI security operations platform, Gray Matter, and our AgenTic teammates, and it was a pleasure. Thank you.