It’s not a SIEM. But it does address SIEM user dissatisfaction with a software platform that combines advanced threat detection with correlated security analytics, auto mitigation capabilities – and a lot less.
Santa Clara, CA – Cyphort Inc., Today unveiled a powerful security analytics platform that empowers enterprise security teams with the prioritized, actionable intelligence required for fast, interactive threat investigation and response to advanced threats. Dubbed the Anti-SIEM, the software solution builds on Cyphort’s expertise in advanced threat detection, then adds a sophisticated, scalable analytics engine that ingests, analyzes, and correlates data from Cyphort collectors and other security tools deployed in the network. Consolidated results are presented, along with identity information, as an adjustable timeline view of the complete security incident.
“The Anti-SIEM is the result of extensive research that Cyphort conducted with nearly 1,000 SIEM users from large organizations across the US,” said Manoj Leelanivas, CEO and president at Cyphort. “We’ve used these insights to create the Anti-SIEM. It’s everything users want in a SIEM – and less. Meaning, less cost, noise, complexity, and wasted time.”
The multi-pronged research project – conducted over several months by Cyphort in cooperation with the Ponemon Institute, Osterman Research, and InterQ Research – revealed specific problem areas where SIEM time, cost, and complexity issues were negatively impacting the productivity of security analysts and incident response teams. The research also provided insight into specific areas where Cyphort technology could be employed, optimized, and extended to restore productivity, accelerate response, and save money in the process.
“The research revealed many of the specific manual tasks required by Tier 1 and Tier 2 responders, who typically begin their work with data generated by the SIEM,” explained Frank Jas, CTO of Cyphort. “Understanding their processes and workflows enabled us to develop additional analytics and UI features within the Anti-SIEM to minimize the need for many manual, time-consuming steps.”
The Anti-SIEM is a distributed software platform that begins with a focus on threat detection, by ingesting raw data from web, email, and lateral spread traffic, as well as log and event data from a variety of other security tools in the network. All information is fed into its analytics engine, which uses machine learning and behavioral analysis technologies to first identify advanced threats, then correlate all related alerts and log events from other sources, and finally add user/host identify information. The Anti-SIEM then presents analysts with a consolidated timeline view of the entire security incident, showing the threat and all related events over time, as well as progression through the cyber kill chain. The entire process takes as little as 15 seconds.
The scalable architecture of the Anti-SIEM allows organizations to store threat, log, and event data for months or years, and thus easily adjust the timeline view of user/host-based security incidents. The platform further assists incident response teams by offering “one-touch” auto-mitigation capabilities. For example, the Anti-SIEM can automatically create and publish new rules and policies so that in-line devices can block similar threats in the future.
“The introduction of the Anti-SIEM is welcome news to us,” said Vladislav Ryaboy, Director of GSOC, Crawford & Company, the world’s largest publicly listed independent provider of claims management solutions. “Not just for the threat detection and security value, but also the productivity gains that the analytics engine will provide us. This will definitely reduce the noise level for our existing security team and make them a lot happier.”
In delivering the Anti-SIEM, Cyphort is also emphasizing its commitment to deliver “less” of what customers don’t want. That includes:
– Less cost: The Anti-SIEM saves money in multiple areas, including lower licensing and deployment costs, and measurably higher productivity gains through its analytics engine to automate event processing capabilities. Savings can easily exceed $100,000 annually.
– Less noise: Relevant alerts, logs, and event data are now automatically analyzed and consolidated into a single security incident, thus significantly reducing the noise from distracting alerts.
– Less complexity: Research revealed that most SIEM deployments require 3 months or more before customers get the value they want. The Anti-SIEM minimizes deployment complexity and reduces time-to-value to just a few days, sometimes even hours.
– Less wasted time: By automating the proactive detection, analysis, and consolidation of information related to advanced threats, security teams waste far less time on low-level tasks and can focus on priorities for the organization.
“Managing incident response and threat mitigation is difficult and time-consuming, and our research shows that most organizations are not well-prepared to deal with many of the critical aspects of security management,” said Michael Osterman, Principal Analyst of Osterman Research. “The Anti-SIEM promises to significantly alter the security management landscape by improving the speed and efficiency of threat detection and response, while simultaneously lowering the costs of these critical processes.”
The Anti-SIEM can be deployed with an existing SIEM to improve productivity and strengthen security. Or it can be deployed in place of a SIEM for organizations that want the benefits of a SIEM without the drawbacks. In either case, the Anti-SIEM solution and its components can be purchased a 1- or 3-year software license. Specific pricing depends on customer deployment requirements.
[su_box title=”About Cyphort” style=”noise” box_color=”#336588″][short_info id=’101648′ desc=”true” all=”false”][/su_box]
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.