Overview

Phantom is the only security automation & orchestration platform that addresses everything from preventative protection and incident response to regeneration of the environment. Phantom streamlines security operations through the execution of digital “Playbooks” which significantly cuts down on time spent utilizing the dozens of point products found in typical enterprise security environments. Phantom doesn’t replace existing security products, but instead makes a company’s investment in them smarter, faster and stronger. Simple actions can be automated from within Playbooks thus allowing Phantom to act as an “operating system” for an organization’s numerous security products.

Phantom enables organizations to automate on arbitrary security data such as incidents, threat indicators, vulnerabilities, emails and more. Additionally, it consumes and operates on JSON (JavaScript Object Notation) internally, making it extremely flexible and giving security operations full access to the contents of the security data for the purposes of automated decision-making.

Going one step further, Phantom executes investigative and containment actions to control the environment and remediate security events. Customers can either push data to the platform, or pull it from a number of externally supported SIEM or analytics tools. Phantom currently provides integration with over 40 of the industry’s leading security solutions.