Upload File

deep node - the ultimate threat hunting platform (1)

  • Home
  • Documents
  • Deep Node - The Ultimate Threat Hunting Platform (1)
10
Deep Node, Inc. The Ultimate Threat Hunting Platform

Upload: janie-lee-mabe

Post on 06-Apr-2017

149 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Deep Node - The Ultimate Threat Hunting Platform (1)

Deep Node, Inc. The Ultimate Threat Hunting Platform

Page 2: Deep Node - The Ultimate Threat Hunting Platform (1)

Sophisticated Hackers Cutting Through Traditional Security Defenses, Evading Detection Until It's Too Late

How Do You Stop "Unknown Unknown" Cyberattacks?

q  Targeted, stealthy, and persistent

q  No prior threat intelligence exists

q  Exploits zero-day, new attack vector

q  Does not generate alert or event

q  "Authorized" / internal access

q  Operates within statistical norms

Traditional Defenses

ü  SIEM

ü  IDS/IPS

ü  NGFW

ü  Endpoint

Critical Data

"Unknown Unknown" Cyber Threats

100 – 200 Days Industry estimate for time-to-detection of a cybercrime CISCO 2016 Annual Security Report

“The trend lines between time-to-compromise and time-to-discovery plainly show attackers are getting better/faster at what they do at a higher rate than defenders are improving their trade. This doesn’t scale well, people.” Verizon 2014 Data Breach Investigations Report

Page 3: Deep Node - The Ultimate Threat Hunting Platform (1)

We Enable Analysts to Cut Through the Blinding Complexity of Cyberspace to Catch the Most Sophisticated Threats

Go Threat Hunting with Deep Node to Discover "Unknown Unknowns"

THE ULTIMATE THREAT HUNTING PLATFORM

Screenshot:  An  ac&ve  covert  channel  and  exfiltra&on  in-­‐progress  discovered  by  an  analyst  using  Deep  Node  

²  3D VISUAL ANALYTICS AND PATTERN RECOGNITION

²  AI-ASSISTED ANOMALY DETECTION AND BEHAVIORAL ANALYSIS

²  REAL-TIME SITUATIONAL AWARENESS

²  UNLIMITED SIMULTANEOUS FEEDS à WIRE DATA, SIEM, IDS...

²  CYBER-COMBAT MANEUVERING & INSTRUMENTATION

Page 4: Deep Node - The Ultimate Threat Hunting Platform (1)

Elevate Analyst Productivity à Hunt Down the Hackers Already Inside the Network à Engage in Real-Time Cyber Operations

Our Value Proposition to Security Operations

Analyst Productivity Threat Hunting Cyber Combat

Find  answers  faster   Discover  "unknown  unknowns"   Counter  the  adversary's  tac8cs  

Improving  Core  Performance  Metrics  and  KPIs  

§  Incident  and  event  inves&ga&on  speed  §  Ticket  clearance  rate  /  &me-­‐to-­‐close  §  Time-­‐to-­‐detec&on  of  hidden  threats  §  Time-­‐to-­‐mi&ga&on  and  containment    

Incident  Resolu9on  on  a  Common  Opera9ng  Picture  

Report,  review,  and  replay  incidents  using  video  capture    from  Deep  Node  to  bridge  communica=on  across  shi>    rota=ons  and  facilitate  discussion  across  all  stakeholders,    from  analyst  to  manager,  CISO  to  CEO,  MSSP  to  client.    

Page 5: Deep Node - The Ultimate Threat Hunting Platform (1)

Go Hunting Inside Critical Data Streams to Reveal Anomalous Patterns, Suspicious Simultaneity, and Hidden Correlation

Connecting-the-Dots to Catch What Doesn't Want to be Found

Screenshot:  Inves&ga&ng  IDS  alerts  at  cri&cal  assets    in  context  to  concurrent  network  traffic  (wire  data)  

Myriad  Data  Sources  and  Feeds...  

ü  Network  traffic  (wire  data)  

ü  SIEM  events  and  logs  

ü  IDS  alerts  

ü  SCADA  /  Internet-­‐of-­‐Things  

ü  NetFlow,  PCAP,  syslog  

ü  Threat  intelligence  

Live  and  Real-­‐Time  

Incident  /  Inves9ga9on-­‐related  

"Big  Data"  or  Historical  

...From  Any  Time,  Past  to  Present  

Page 6: Deep Node - The Ultimate Threat Hunting Platform (1)

Our Patent-Pending "Timewell" Allows Analysts to Look Into the Past to Investigate Anomalous Patterns and Behaviors

How It Works

(Above) Investigating the communication pattern between two hosts in context with all other host activity on the network

When you look into the screen, you look back in time at a record of activity for the time period and feed(s) selected

Page 7: Deep Node - The Ultimate Threat Hunting Platform (1)

Watch Deep Node in Action

Detec&ng  a  Covert  Channel   Connec&ng-­‐the-­‐Dots  on  SSH   Stopping  a  Brute  Force  AJack  Hun&ng  for  a  hacker  embedded  in  the  network;  ac&ve  exfiltra&on  in-­‐progress  

Seeing  suspicious  simultaneity  in  network  traffic  flows  to  catch  lateral  movement  

Taking  ac&on  in  real-­‐&me  to  counter  a  common  aJack  strategy  

hJps://www.youtube.com/watch?v=ABit2JIUWpE   hJps://www.youtube.com/watch?v=TCpL8cgZJPs  

Click on Links Below to be Redirected to YouTube

hJps://www.youtube.com/watch?v=x7LFd7ufHf0  

Page 8: Deep Node - The Ultimate Threat Hunting Platform (1)

Does  not  require  replacement  or  reconfigura&on  of  any  exis&ng  security  technology  

Complements  all  future  security  investments  (e.g.,  new  threat  intelligence  feeds)  

Will  not  interrupt  opera&ons–an  enhancement  to  current  workflow  when  needed  

Vendor-­‐agnos&c—Ingests  and  visualizes  data  feeds  from  any  and  all  vendors  

Fast  and  easy  deployment;  op&onal  appliance  or  local  installa&on  

Affordable, Easy to Deploy, and Providers Immediate Gains in Advanced Threat Hunting and Faster Event Investigation

A Low Risk, High Reward Investment

Page 9: Deep Node - The Ultimate Threat Hunting Platform (1)

Immersing Threat Hunters Inside Cyberspace to Capture Economies-of-Intellect and Unlock the Power of Collaboration

Vision of the Future

Security Operations Director / Commander

John  

Jane  

Jim  

Packet  inspec&on  

PaJern  analysis  

Asset  monitoring  

Page 10: Deep Node - The Ultimate Threat Hunting Platform (1)

step into cyberspace...


Proactive Threat Hunting Combining the use of …Proactive Threat Hunting Combining the use of threat intelligence, analytics and automated security tools with human smarts Benefits

GUIDE TO CYBER THREAT HUNTING - Tyler Technologies

Threat hunting as SOC process

ATT&CKing The Command Line & Hunting For More...Threat Hunting Automation Motivation Current Reality Threat hunting used to detect activity we are currently missing. As defenders,

Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION [email protected]. ... to put new

2020 THREAT HUNTING REPORT - ExtraHop

Introduction into Threat Hunting - Sri Lanka CERT|CC · What is Threat Hunting Cyber threat hunting is an active cyber defence activity. It is "the process of proactively and iteratively

Workshop threat-hunting

DEMYSTIFYING THREAT HUNTING · 2021. 1. 26. · We wanted to clear up the confusion. Demystifying Threat Hunting will explain: • What threat hunting is – and what it isn’t

Threat Hunting Report can be viewed here - News · THREAT HUNTING REPORT 3. THRET HNTING REPORT 4 KEY SURVEY FINDINGS ... Among the respondents to the threat hunting survey, six in

The awakening of cyber threat hunting: Intelligence

Threat Hunting Workshop

Threat Hunting with Splunk

Your Practical Guide to 1 – Setting up your threat hunting program Hunt Evil: Your Practical Guide to Threat Hunting 5 3 Common Myths About Hunting Hunting is not a reactive activity

2019 THREAT HUNTING REPORT - DomainTools · threats (58%), improving speed and accuracy of threat response (53%) and reducing the number of breaches (52%). THREAT HUNTING GOALS What

Kaspersky Threat Hunting · • Immediate protection against any detected threat through automatic antivirus database updates. • Retrospective analysis of incidents and threat hunting,

Hands-on Learning Experiences for Cyber Threat Hunting Education · Cyber Hunting • Cyber threat hunting has emerged as a critical part of cyber security practice. However, –

Threat Hunting - csirt.jabarprov.go.id

Threat hunting with MITRE ATT&CK

Threat Hunting 102: Beyond the Basics

Building a Successful Threat Hunting Program

TTPs for Threat Hunting in Refineries · TTPs for Threat Hunting in Refineries Dan Gunter | Twitter: @dan_gunter Principal Threat Analyst @ Dragos October 2018. ... •Not Red Teaming

Threat Hunting with Qualys€¦ · Threat Hunting with Qualys: Going Beyond Your EDR Solutions. Adversary Threat Tactics are Changing Early 2010s Zero ... Rapidly weaponizing newly-disclosed

Threat Hunting Guide - Broadcom Inc

Abstract Tools for Effective Threat Hunting

Threat Hunting with Splunk Hands-on

“Threat Hunting in Active Directory Environment”

THREAT HUNTING- IOCs VS TTPs- Happiest Minds

FALCON OVERWATCH MANAGED THREAT HUNTING · Director of Information Technology, TransPak. CrowdStrike Products FALCON OVERWATCH MANAGED THREAT HUNTING CROWDSTRIKE MANAGED THREAT HUNTING

Threat Hunting with ELK training - Intellectual Point

Enabling Efficient Cyber Threat Hunting with Cyber Threat

Threat Hunting

Towards a Threat Hunting Automation Maturity Model

Threat Hunting Using a Machine Learning Approach

The Elastic Guide to Threat Hunting - copyright