APi Group Increases Visibility by 47% and Secures Expanding Attack Surface Across their Microsoft 365 E5 Suite

Increase in Visibility Leads to Faster Response Times

One of APi Group’s main objectives is to mature and modernize their security operations program as the organization rapidly evolves, which includes optimizing their Microsoft 365 E5 tools to increase efficiency, visibility, and value. To do this, APi relies on the powerful combination of the Microsoft 365 suite and the unified view ReliaQuest GreyMatter provides.

Carl Lee, Information Security Lead at APi Group shares, “The ability of GreyMatter to detect and take automated response actions utilizing that integration with Microsoft Defender and Azure Sentinel is a key component of our security strategy.”

As a Microsoft 365 E5 and ReliaQuest customer, APi Group has achieved a 47% increase in visibility across their Microsoft 365, Cisco, and Palo Alto security stack. In addition, utilizing GreyMatter has enabled them to perform automated response actions across multiple tools from one console – reducing the complexity of their day-to-day operations. In fact, they have seen a 52% decrease in response times since becoming a customer thanks to automated playbooks. With automation and improved visibility, the team can now execute faster threat detection, investigation, and response, across a diverse set of organizations under the APi umbrella.

Making Sense of a Complex Environment

An essential element of APi Group’s security strategy is to understand their cybersecurity hygiene and gaps in coverage. But they also need to augment the team and avoid burnout at the same time – which is not an easy goal to achieve. To add to the challenge, their Microsoft environment is complicated – they use Azure Sentinel, Defender, Office 365, and a multitude of other tools.

Adding ReliaQuest to their security tool stack has helped APi Group solve these challenges head on. As Lee states, “The integration between ReliaQuest GreyMatter and our security tools has become a force multiplier for the team. ReliaQuest uses a risk-based approach and the MITRE framework, driving our implementation of detections and automations, which provides the most value for our overall security.”

The integration of tools and increased visibility has reduced complexity across APi’s security program – since becoming a ReliaQuest customer they have increased MITRE ATT&CK coverage by 275%, a game changer for the team. Now, they can more accurately decide where to invest in resources that will better secure their organization.

Better Detection for an Expanding Attack Surface

While APi Group faces the challenge of a continuously expanding attack surface, they know implementing a program providing high-fidelity threat detections for Microsoft environments will help them manage risk. Lee explains, “The Microsoft stack is great, but one of the challenging things is that people cannot easily pick up the query language. So, when it comes to making accurate detections, you really need solid detection content – and that’s where ReliaQuest comes into play for us.”

Lee’s team is working collaboratively with ReliaQuest to tune detection logic and produce solutions for their Microsoft toolset that result in faster, higher fidelity detections. He shares, “One time we had Malware hit an endpoint. My team thought it was contained, then we get a call from the analyst at ReliaQuest who was seeing strange activity. He ended up executing an isolate play for us. They do analysis, give us context, and recommendations on what to do. The second set of eyes, the quick automated plays, and higher fidelity detections have been crucial for us to have.”

• ATT&CK coverage by 275%
• APi Group has achieved a 47% increase in visibility across their Microsoft 365
• ReliaQuest GreyMatter security operations platform is built on an XDR architecture