SOT
SOAR
Security Orchestration, Automation and Response
NG SOAR
Next Generation SOAR
AM
Asset Management
VM
Vulnerability Management
FinCERT
Financial Computer Emergency Response Team
GovCERT
Government Computer Emergency Response Team
Product overview
Building behavior models and detecting deviations from them using several dozen built-in static analysis rules.
Security Vision UEBA will detect changes in user and account performance, devices and processes, traffic volumes and other behavioral attributes.
By analyzing raw data streams from various sources (data lakes, SIEM, NGFW, proxy servers and other network and Windows/Linux devices), the product will ensure the detection of new types of incidents. Built-in behavioral analysis capabilities can be supplemented by setting up new or adapting existing sigma and correlation rules.
Application
Collection of “raw” events from various sources
Integration with information security and other sources of information security events; when collected, events are converted into incidents when their number accumulates (for example, when volume indicators are exceeded) and total weight (each event has weight). There are white lists (for exceptions) and lists of critical systems (for automatically creating incidents without taking into account events and their weight)
Combining analysis technologies
~30 unique correlation rules in combination with methods of mathematical statistics (~50 built-in rules) and machine learning: open-source datasets (ddos, bot, lateral, malware, suspicious, etc.), emulation of attack scenarios at the Security Vision cyber testing site, as well as training the system on client traffic (“supervised” models)
Built-in investigation and response processes
The ability to automatically send new incidents and events to SOAR or SIEM, automatically enrich information on objects from internal and external sources (AD, Whois, etc.) as well as built-in response actions (adding to NGFV blocklists, adding to SIEM active lists and other operations)
Get a demo of a
Security Vision product
Mail us to
sales@securityvision.ru
or get a demo
Still have questions?