4
endace.com page 1 END_fp_end_xsoar_1.0_0620 © Copyright Endace Technology Limited, 2020. All rights reserved. Information in this data sheet may be subject to change. FUSION PARTNER Security teams are overloaded with alerts from security tools warning of Indicators of Attack (IOAs) and Indicators of Compromise (IOCs). Many of these tools lack integration to simplify workflows and save analysts time sifting through data to get from an indicator to concrete evidence. Attackers often use sophisticated reconnaissance and propagation techniques that may not be visible by examining the original indicator. And many modern threats include tools that can spoof activity and modify, or simply erase, log files and other traces of activity, making it hard to quantify the depth and breadth of an attack. Cortex XSOAR combines security orchestration, incident management, and interactive investigation to serve security teams across the incident lifecycle. Cortex XSOAR can ingest alerts from multiple sources, and allows security teams to create and execute standardized, automatable playbooks for accelerated incident response. The open EndaceProbe Analytics Platform provides 100% accurate, always-on recording of network-wide traffic and integrates to deliver rapid search capability inside solutions including: • Palo Alto Networks Strata Panorama and Next Generation Firewalls • Palo Alto Networks Cortex XSOAR • A wide range of commercial and open-source security solutions such as IDSs, SIEMs, AI /ML tools as well as NPM/APM solutions. EndaceProbes can also host virtualized third-party tools - IDSs, agents, sensors etc. - allowing monitoring coverage to be extended without additional hardware deployment. Integrating Cortex XSOAR and EndaceProbe Integrating Endace’s network history with Cortex XSOAR gives analysts rapid access to enterprise-wide network forensic data, providing rapid in-context drill-down for investigating, reporting on and resolving security threats, and automated archival of critical packet evidence. Integration Features • Simple playbooks provide in-context drill down from threat alarms to relevant recorded packet data from anywhere in your network • Automate archival of packets of interest for reactive investigations, proactive threat hunting and business compliance • Leverage hundreds of Cortex XSOAR third-party product integrations to coordinate response across security functions based on insights from Endace’s recorded network history. • Run hundreds of commands (including for EndaceProbe) interactively via a ChatOps interface while collaborating with other analysts and Cortex XSOAR’s chatbot PRODUCTS Palo Alto Networks Cortex XSOAR EndaceProbe EndaceVision and Investigation Manager BENEFITS • Accelerated incident response with rapid access to accurate, in-context network history • Automated archiving of definitive forensic evidence for all detected threats • Triage, investigate and respond to threats with increased speed, reliability and confidence using comprehensive network-wide recorded traffic. Palo Alto Networks and Endace Automated and Accelerated Incident Response with Cortex XSOAR and Network History Use Case Example One Accelerate Incident investigation with In-context drill-down to definitive network forensic data Challenge: High volumes of alerts warning of potential attacks or data compromise take too long for analysts to sift through. Too many non- correlated evidence sources make it slow and cumbersome to separate real threats from false positives and to investigate and respond to real threats. Solution: Deploying EndaceProbes across your network and integrating recorded network history into investigation workflows gives analysts in- context access to definitive forensic evidence right in Cortex XSOAR. Links to EndaceVision and InvestigationManager allow advanced analysis of network traffic, including comprehensive filtering, application and flow breakdowns. Endace’s high-speed, federated search returns relevant packet data to the XSOAR War Room or allows it to be tagged to an evidence board for joint investigations, streamlining the investigation process and dramatically improving the speed and accuracy of incident response. Benefit: Analysts have, at their finger-tips, relevant network evidence from before, during and after all threat alarms. They can quickly dispense with false positives and confidently and accurately investigate and resolve real threats. Full packet data is the only evidence that allows analysts to see definitively how far a threat spread, any associated command and control activity, whether data was stolen and what the exfiltrated payload contained.
