Provides Visibility Into Endpoints and User Accounts Compromised by Advanced Threat Actors – Enabling Faster Neutralisation of Intruders and Reduced Risk of Data Breach
According to the 2015 Verizon Data Breach Investigation Report (DBIR), 60 percent of breached organisations were initially compromised within minutes, but for most breached organisations, it took substantially longer to detect the intruders. LogRhythm, The Security Intelligence Company, is helping organisations reduce the time it takes to detect intruders across potential points of entry with the release of its Endpoint Threat Analytics Module.
This latest addition to the company’s Holistic Threat Analytics Suite delivers advanced endpoint behavioural anomaly detection and other machine analytic techniques to identify systems compromised through zero-day attacks and custom malware. The Endpoint Threat Analytics module, combined with LogRhythm’s User and Network Threat Analytics modules, gives organisations a holistic view of threats and intrusions across the broad attack surface.
Many intrusions begin with an attacker compromising an endpoint through targeted spear phishing. Once inside, attackers will compromise additional systems and user accounts. In many cases, hundreds of systems and user accounts will be compromised prior to a data breach being realised. Unfortunately, as the DBIR data indicates, even when the intrusion is widespread, most organisations are ill-equipped to detect quickly the activities of an advanced cyber adversary operating within their environment.
LogRhythm’s Holistic Threat Analytics Suite spots advanced threats by modeling a wide variety of behaviours across the entire IT environment. This approach provides holistic visibility into advanced threat operators when “behavioural shifts” occur as they compromise endpoints, applications and user accounts.
LogRhythm’s Holistic Threat Analytics Suite comprises three analytics modules that can be deployed individually or as a whole based on customers’ threat detection needs and overall risk posture:
- The new Endpoint Threat Analytics Module leverages LogRhythm’s System Monitor sensor for real-time forensic data acquisition and extensive visibility into endpoint activity. This module detects threats such as custom malware compromises, suspicious process and user activity, and local data exfiltration.
- The User Threat Analytics module provides extensive visibility into user activity and detects compromised accounts and other suspicious user activity, including insider threats.
- The Network Threat Analytics module leverages LogRhythm’s Network Monitor sensor for real-time generation of Layer 7 SmartFlow™ data, providing extensive visibility into network communications activity at an application level. This module identifies such threats as remote zero-day attacks, internal scans and probes, suspicious application communications and network-based data exfiltration.
These modules leverage LogRhythm’s patented AI Engine technology that applies machine learning and other machine analytics techniques to highly contextualised log and machine data. When all three modules are deployed, customers can correlate and corroborate advanced threats across the holistic attack surface, realising additional analytics value and increasing their chance of detection.
“A successful intrusion doesn’t have to equal a successful breach if you can detect the intruder early in the threat lifecycle and limit dwell time,” said Jon Oltsik, senior principal analyst at Enterprise Strategy Group. “LogRhythm’s Holistic Threat Analytics Suite with the new endpoint anomaly detection capability offers a comprehensive approach to detecting and responding to intruders before they can turn system compromises into damaging data breaches.”
“Advanced threat actors will leverage every possible angle to gain a foothold within their target environment, and they will be successful,” said Chris Petersen, chief technology officer, senior vice president of products and co-founder of LogRhythm. “The best way organisations can be assured of detecting initial compromises quickly is by having visibility across all possible vectors of entry and points of further attack. To achieve this, organisations must be looking for behavioural shifts across user accounts, the network and endpoints.”
The LogRhythm Holistic Threat Analytics Suite, including the User Threat Analytics module, Network Threat Analytics Mmdule and new Endpoint Threat Analytics module, as well as LogRhythm’s supporting Co-Pilot Services, are available today to LogRhythm customers.
About LogRhythm
LogRhythm, a leader in security intelligence and analytics, empowers organisations around the globe to rapidly detect, respond to and neutralise damaging cyber threats. The company’s award-winning platform unifies next-generation SIEM, log management, network and endpoint monitoring and forensics, and security analytics. In addition to protecting customers from the risks associated with cyber threats, LogRhythm provides innovative compliance automation and assurance, and enhanced IT intelligence.
Consistently recognised by third-party experts, LogRhythm has been positioned as a Leader in Gartner’s SIEM Magic Quadrant report for four consecutive years, named a “Champion” in Info-Tech Research Group’s 2014-15 SIEM Vendor Landscape report, ranked Best-in-Class in DCIG’s 2014-15 SIEM Appliance Buyer’s Guide, awarded the SANS Institute’s “Best of 2014” award in SIEM and received the SC Magazine Reader Trust Award for “Best SIEM Solution” in April 2015. Additionally, the company earned Frost & Sullivan’s Global SIEM/LM Market Penetration Leadership Award and was named a Top Workplace by the Denver Post. LogRhythm is headquartered in Boulder, Colorado with operations throughout North and South America, Europe and the Asia Pacific region.
