DATA SHEET : Eslog+ 1 WHAT IS Eslog+ DESIGNED to SOLVE FOR?
Total Page：16
File Type：pdf, Size：1020Kb
DATA SHEET esLOG+ Critical visibility accelerating detection across modern hybrid IT environments CLOUD, DETECT. VALIDATE. COMPLIANCE. HYBRID, HUNT. ACCELERATE. REPORTING. OR ON-PREMISES. PRIORITIZE. REMEDIATE. SIMPLIFICATION. Gain critical threat Identify the most Minimize threat actor Realize the traditional visibility that evolves elusive of threats. dwell time with rapid benefits of a SIEM regardless of your Focus on those that response to prevent without the complexity environment. Remove matter most. business disruption. and cost. potentially dangerous blind spots. Whether your data is on-premises, in the cloud or machine learning, customized rule-sets and behavioral somewhere in between, esLOG+ evolves with the analysis to make sense of expected and unexpected requirements of your modern hybrid IT environment. events and behaviors across your environment. This cloud-native, SIEM alternative, embedded in eSentire’s Proprietary threat-hunting methodology and full forensic Managed Detection and Response services, aggregates investigation are performed to confirm a threat’s presence meaningful and actionable intelligence from your network and determine the extent to which the threat actor has assets, endpoints, applications and cloud services. And, spread. Minimizing threat actor dwell time, false positives you can have it up and running in a fraction of the time of are eliminated and our analysts alert you to confirmed a traditional SIEM. threats, giving you step-by-step guidance to contain and eliminate attacks. Data visualizations, customizable esLOG+ is designed to be more than a compliance and reporting and KPIs are available, giving your team visibility reporting tool. esLOG+ provides critical visibility across to what our analysts are investigating and ensuring you your threat landscape to eSentire Security Operations meet the strictest of regulatory requirements. Center (SOC) analysts who leverage big data analytics, VISIBILITY AWS Services Database Google Compute Platform Microsoft • Microsoft SQL IT Infrastructure • MongoDB esLOG+ handles the • Active Directory Operating System • MySQL on-premises sources • Azure • Host Metrics • Oracle you expect a traditional • O365 • Linux SIEM to cover, with the Compliance and Security DevOps • Windows added ability to support • Docker • Box Storage a collection of custom • Duo • Github Web Server applications via script. It • Cylance • Jenkins • Apache also delivers an extensive • Crowdstrike • Kubernetes • Apache Tomcat library of available • Cisco ASA • IIS integrations including, • Okta • Nginx but not limited to: • Palo Alto • Trend Micro • Zscalar DATA SHEET : esLOG+ 1 WHAT IS esLOG+ DESIGNED TO SOLVE FOR? Improving visibility and scalability across hybrid Mapping threats to affected resources IT environments Performing ad hoc queries on stored data for Reducing costly deployment, staffing and forensics ongoing maintenance requirements Accelerating investigation and response times Accelerating time-to-value Eliminating false positives Applying advanced analytic and hunting Prioritizing alerts capabilities to detect known and unknown threats Simplifying reporting Correlating multiple events into a single incident Addressing policy and compliance requirements FEATURES 24x7 MONITORING WITH CRITICAL THREAT VISIBILITY Cross-Platform Monitoring and Visibility • AWS Security esLOG+ collects, aggregates and monitors data esLOG+ integrates with your AWS cloud environment across on-premises, cloud, multi-cloud and hybrid providing SOC analysts with a comprehensive view platforms like AWS, Microsoft Azure, Apache, and the to see who is accessing AWS and when they make Google Cloud Platform providing our 24x7x365 SOC changes (CloudTrail), what they change (Config), where analysts with critical visibility to threats across your this impacts network traffic and latency (VPC Flow), and entire threat landscape. how this affects your security and compliance posture • Azure Cloud Security (Inspector). esLOG+ utilizes machine learning and monitoring • Apps for Extended Log Analytics capabilities across your Azure environment for esLOG+ extends functionality of log analytics with real-time visibility, analysis and data visualizations. an extensive library of apps that help optimize data • Google Cloud Platform Security collection for better security monitoring. esLOG+ integrates directly into your GCP environment, providing instant insights into potential security issues and user activity for Google VPC, IAM, Cloud Audit and Google App Engine. DATA SHEET : esLOG+ 2 ADVANCED DETECTION CAPABILITIES AND HUMAN-BASED THREAT HUNTING EMPOWER RAPID INVESTIGATION AND RESPONSE Embedded Threat Hunting and Forensic Real-time Search and Visualizations Investigation esLOG+ has preconfigured and customizable searches esLOG+ includes embedded threat hunting and forensic and dashboards with KPIs, giving our SOC analysts and investigation of aggregated log data to accelerate your security team visibility into abnormal behaviors precision that facilitates rapid response and threat illuminating what matters most. containment. Log Retention Big Data Analytics esLOG+ retains all raw log data giving SOC analysts esLOG+ leverages the power of big data and advanced the ability to correlate information with data from analytics to end-user behavior, to detect anomalies esENDPOINT and esNETWORK to conduct thorough (deviations from the established baseline) and to flag forensic investigations, drill down into details and assist exceptions to identify real and potential threats. with root cause analysis on any security incident. Machine Learning Integration False Positive Elimination esLOG+ utilizes machine learning and predictive esLOG+ increases the velocity and accuracy of threat analytics to make sense of expected and unexpected detection so our SOC analysts can determine what is behavior across your environment with pattern, noise vs. true security events to ensure your team is anomaly and outlier detection. only alerted to verified threats. SIMPLIFIED MANAGEMENT WITH DATA VISUALIZATIONS AND REPORTING Co-Management Simplified Compliance Management Reporting esLOG+ provides a co-managed model with access esLOG+ ensures compliance mandates are met with to run your own advanced search queries, generate centralized logging, continuous monitoring, and alerts, manage profiles, run reports, and investigate automated retention policies with various out of the events alongside our SOC analysts. box, and custom security reports that meet regulatory Time to Value requirements such as HIPAA, PCI, SEC, GDPR, and more. esLOG+ is a pure SaaS offering that features simple- to-deploy collectors with rich filtering capabilities that can be up and running within minutes. It offers access to all the latest capabilities without the need for time-consuming, expensive deployment and upgrades. DATA SHEET : esLOG+ 3 BENEFITS Comprehensive 24x7x365 threat monitoring Improved post-attacks forensics Complete threat visibility across your threat landscape Reduction of false positives Flexibility to run your own queries, alerts, profiles, Minimizes threat actor dwell time with integrated reports, and investigate events alongside eSentire response analysts Threat containment* and co-managed remediation Removes traditional complexity and cost of a SIEM with rapid time-to-value Unparalleled insight with visualizations and customizable searches Comprehensive, correlated and accurate analytics of security events provided by eSentire’s SOC Simplified compliance management and reporting Detection of known and unknown threats *Requires esNetwork and/or esEndpoint HOW DOES IT WORK? CLIENT on-premises and cloud-based collectors NETWORK APPLICATIONS ENDPOINTS ACTIVE IDENTITY AND ACCESS CLOUD CLIENT IT / ASSETS DIRECTORY MANAGEMENT SECURITY TEAM esNETWORK esENDPOINT esLOG+ CONTAINMENT CONTAINMENT • Inspection of network data Inspection and recording of full packet capture all endpoint telemetry PLATFORM ALERTS Fully Managed Fully Managed Co-Managed • BI-DIRECTIONAL COMMUNICATION • MANAGED DETECTION AND SECURITY OPERATIONS THREAT INTELLIGENCE RESPONSE PLATFORM CENTER Data enrichment and cross • SUSPICIOUS EVENTS • FORENSIC INVESTIGATION correlation of logs, PCAP and • ANOMALIES • CONFIRMATION OF TRUE POSITIVE full endpoint telemetry • POTENTIAL THREATS • TACTICAL THREAT CONTAINMENT • CO-MANAGED REMEDIATION • BEHAVIORAL ANALYTICS • MACHINE LEARNING • BIG DATA ANALYTICS DATA SHEET : esLOG+ 4 BETTER TOGETHER: esLOG+, esNETWORK AND esENDPOINT Logs provide critical visibility that enable better resets. esENDPOINT provides deep insight into processes, observation, orientation and decision making in disrupting file changes, and more at the host level, with the ability the attacker kill chain. But, logs alone are limited in the to isolate damaged systems or stop processes in near depth of data that permits deeper investigation and real-time. esLOG+, when deployed in combination remediation of security incidents. In addition, log-based with esENDPOINT and esNETWORK, provides our SOC security can delay detection of events and response analysts with a comprehensive set of enriched signals due to lag time of inbound signals as opposed to the that eliminates blind spots in which threats can lurk. Most near-instantaneous feedback of a live network stream or Managed Detection and Response providers rely solely endpoint technology. The greater the signals and forensic upon log data and are limited to simple alerts generated by data available to analysts, the greater