NetApp has partnered with Cisco Splunk to release an automation playbook that links its ONTAP storage environment with a security operations platform. This playbook focuses on supporting enterprise data protection systems by automating the response process following the detection of a cyber attack.

NetApp and Cisco Splunk recently introduced a Splunk SOAR-based ONTAP-linked playbook to enable enterprise security and storage operations teams to respond rapidly to cyber threats occurring at the data layer. Through this, the two companies plan to connect security operations and storage operations into a single response procedure.

NetApp ONTAP is an enterprise data storage operating system, and Splunk SOAR is a security orchestration, automation, and response platform. The new playbook is designed to enable storage operations and security organizations to respond more closely within an enterprise's multi-layered security framework.

It is a method that reduces threat response time and lowers repetitive manual tasks in data protection by executing necessary measures according to predefined procedures when a security event occurs. This allows the security team to manage threat blocking metrics, and the storage team to implement data protection measures more systematically.

David Darling, Group Vice President of Security at Cisco Splunk, stated, “An effective security strategy requires visibility and a response framework across the entire IT infrastructure, including the data layer,” adding, “By integrating ONTAP storage with security operations processes, capabilities to respond to data-targeted threats can be enhanced.”

Dallas Olson, NetApp's Chief Commercial Officer (CCO), explained that the collaboration between the two companies aims to strengthen the alignment between storage operations and security organizations. He added that they will support customers in gaining visibility into their entire IT environment and minimizing service disruptions.

This playbook is expected to be used as a case study to connect storage operations and security monitoring into a single workflow to respond to data-centric cyber threats such as ransomware.