BOULDER, Colo.--(BUSINESS WIRE)--According to the 2015 Verizon Data Breach Investigation Report (DBIR), 60 percent of breached organizations were initially compromised within minutes, but for most breached organizations, it took substantially longer to detect the intruders. LogRhythm, The Security Intelligence Company, is helping organizations reduce the time it takes to detect intruders across potential points of entry with the release of its Endpoint Threat Analytics Module. This latest addition to the company’s Holistic Threat Analytics Suite delivers advanced endpoint behavioral anomaly detection and other machine analytic techniques to identify systems compromised through zero-day attacks and custom malware. The Endpoint Threat Analytics Module, combined with LogRhythm’s User and Network Threat Analytics Modules, gives organizations a holistic view of threats and intrusions across the broad attack surface.
Many intrusions begin with an attacker compromising an endpoint through targeted spear phishing. Once inside, attackers will compromise additional systems and user accounts. In many cases, hundreds of systems and user accounts will be compromised prior to a data breach being realized. Unfortunately, as the DBIR data indicates, even when the intrusion is wide spread, most organizations are ill-equipped to detect quickly the activities of an advanced cyber adversary operating within their environment.
LogRhythm’s Holistic Threat Analytics Suite spots advanced threats by modeling a wide variety of behaviors across the entire IT environment. This approach provides holistic visibility into advanced threat operators when “behavioral shifts” occur as they compromise endpoints, applications and user accounts.
LogRhythm’s Holistic Threat Analytics Suite is comprised of three individual analytics Modules that can be deployed individually or as a whole based on customer’s threat detection needs and overall risk posture:
- The new Endpoint Threat Analytics Module leverages LogRhythm’s System Monitor sensor for real-time forensic data acquisition and extensive visibility into endpoint activity. This Module detects threats such as custom malware compromises, suspicious process and user activity, and local data exfiltration.
- The User Threat Analytics Module provides extensive visibility into user activity and detects compromised accounts and other suspicious user activity, including insider threats.
- The Network Threat Analytics Module leverages LogRhythm’s Network Monitor sensor for real-time generation of Layer 7 SmartFlow™ data, providing extensive visibility into network communications activity at an application level. This module identifies such threats as remote zero-day attacks, internal scans and probes, suspicious application communications and network-based data exfiltration.
These Modules leverage LogRhythm’s patented AI Engine technology that applies machine learning and other machine analytics techniques to highly contextualized log and machine data. When all three Modules are deployed, customers can correlate and corroborate advanced threats across the holistic attack surface, realizing additional analytics value and increasing their chance of detection.
“A successful intrusion doesn’t have to equal a successful breach if you can detect the intruder early in the threat lifecycle and limit dwell time,” said Jon Oltsik, senior principal analyst at Enterprise Strategy Group. “LogRhythm’s Holistic Threat Analytics Suite with the new endpoint anomaly detection capability offers a comprehensive approach to detecting and responding to intruders before they can turn system compromises into damaging data breaches.”
“Advanced threat actors will leverage every possible angle to gain a foothold within their target environment, and they will be successful,” said Chris Petersen, chief technology officer, senior vice president of products and co-founder of LogRhythm. “The best way organizations can be assured of detecting initial compromises quickly is by having visibility across all possible vectors of entry and points of further attack. To achieve this, organizations must be looking for behavioral shifts across user accounts, the network and endpoints.”
The LogRhythm Holistic Threat Analytics Suite, including the User Threat Analytics Module, Network Threat Analytics Module and new Endpoint Threat Analytics Module, as well as LogRhythm’s supporting Co-Pilot Services, are available today to LogRhythm customers.
LogRhythm, a leader in security intelligence and analytics, empowers organizations around the globe to rapidly detect, respond to and neutralize damaging cyber threats. The company’s award-winning platform unifies next-generation SIEM, log management, network and endpoint monitoring and forensics, and security analytics. In addition to protecting customers from the risks associated with cyber threats, LogRhythm provides innovative compliance automation and assurance, and enhanced IT intelligence.
Consistently recognized by third-party experts, LogRhythm has been positioned as a Leader in Gartner’s SIEM Magic Quadrant report for four consecutive years, named a “Champion” in Info-Tech Research Group’s 2014-15 SIEM Vendor Landscape report, ranked Best-in-Class in DCIG’s 2014-15 SIEM Appliance Buyer’s Guide, awarded the SANS Institute’s “Best of 2014” award in SIEM and received the SC Magazine Reader Trust Award for “Best SIEM Solution” in April 2015. Additionally, the company earned Frost & Sullivan’s Global SIEM/LM Market Penetration Leadership Award and was named a Top Workplace by the Denver Post. LogRhythm is headquartered in Boulder, Colorado with operations throughout North and South America, Europe and the Asia Pacific region.