What is an ActOn?
To scale with digital operations, risk management requires three fundamental shifts in the decision-making process:
- Everyone in the organizations need to be empowered to make decisions.
- To make smarter decisions, everyone needs to use relevant, timely insight based on actual data — and not rely on top-down strategy or static rules.
- Organizations must automate low-level tasks/decision-making.
An ActOn is an actionable insight that empowers people to make smarter decisions.
An ActOn identifies a situation that may cause or has already caused negative impact on an organization’s confidentiality, integrity, and/or availability (CIA), and it provides the situational awareness needed to quickly determine appropriate response.
ActOns gather, prioritize, and present curated, contextual data — like related alerts, events, asset, and user data, evidence, and more. Data can paint a picture of what happened, but related data — or situational awareness — explains why it happened. It’s often the “why” (versus the “what”) that makes an insight actionable.
Each ActOn has a quantified risk score (based on likelihood, impact, and confidence), so security and IT analysts know where to focus first. ActOns increase efficiency and effectiveness by giving teams the contextual information they need at their fingertips to make informed decisions as quickly as possible.
As the SANS Institute called out in its report, “Security and Operational Intelligence, “[Resolution Intelligence Cloud’s] ActOn capabilities enable you to create a customized approach to responding to alerts. Whether it’s tracking analysis activities, letting users quickly jump into a ‘war room’ for analysis discussions, or enabling automated actions, the platform levels up any security team. […] Among all the noise a typical enterprise may see, ActOns help analysts determine ‘what matters’ and, therefore, where to focus.”
