ThreatEye NV
AI-Driven Detection of Enterprise Threats
and Analysis of Encrypted Data Traffic

Bsiness continuity and operational resiliency are under attack and challenged at an unrelenting pace. Traditional security tools attempt to stop attacks by using deep packet inspection or rules-based monitoring on unencrypted traffic, which is no longer sufficient.

In Q2 2021, 91.5% of malware arrived over an encrypted connection. Attackers are always looking for an advantage to go undetected, hiding activity within encrypted channels to exploit a blind spot or a gap in security architecture.

Maintaining visibility has grown increasingly complicated and challenges both NetOps and SecOps teams. While encrypted traffic has been standard practice to drive privacy, its strength and effectiveness has and will continue to evolve, increasing the blind-spot for threat actors to operate within.

For organizations to make an immediate impact against adversaries and stay ahead of tomorrow’s threats, a different security strategy is needed.

Eine neue Herangehensweise: Die ThreatEye NV Network Detection and Response (NDR)-Plattform wurde speziell für die heutige Netzwerksicherheitsumgebung entwickelt und kombiniert Datenerfassung der nächsten Generation, fortschrittliche Verhaltensanalyse und maschinelles Lernen für die Erkennung von Bedrohungen und die Einhaltung von Sicherheitsvorschriften.

Unbeeindruckt von der Verschlüsselung kombiniert ThreatEye NV die Merkmale und Eigenschaften des Netzwerkverkehrs mit einer auf maschinellem Lernen basierenden Streaming-Analyse.

Im Gegensatz zu Verkehrsanalyselösungen, die auf DPI-Technologien basieren, nutzt die ThreatEye-Plattform Deep Packet Dynamics (DPD) zur Analyse von Verkehrsströmen.

DPD liefert detailgetreue Datenflussaufzeichnungen mit über 150 Merkmalen für jeden Datenfluss – und das alles ohne Prüfung der Nutzdaten. Packet Dynamics, gekoppelt mit maschinellem Lernen, bietet einzigartige Möglichkeiten, verschlüsselten Datenverkehr wieder sichtbar zu machen.

• Detect threats and anomalies that others miss – ThreatEye’s Deep Packet Dynamics (DPD) is agnostic to packet contents and is used to create a historical inventory of traits and behaviors for profiling and fingerprinting, a technique that works equally well with both encrypted and unencrypted traffic. Machine Learning models are applied to identify advanced behavioral threat actor anomalies.
• Threat Detection in Real-Time – Reduce operational outages with faster detection through industry-leading real-time detection analysis. Designed to process millions of events per second, ThreatEye NV’s multi-stage analysis pipeline is fueled by analyzers – or models – engineered to analyze network traffic without multiple passes over the data stream. In addition, analyzers are explicitly architected for network security and scale via parallel processing.
• Eliminate Encryption Blindness – Increased adoption of encrypted network protocols is causing the erosion of network visibility for security teams. As a result, legacy tools are losing visibility. Encrypted Traffic Analysis, the application of machine learning applied to deep packet dynamics, is the perfect solution for analyzing encrypted traffic without decryption.
• SOC Enabled – Decrease Time to Investigate and Respond – ThreatEye NV’s multi-stage analysis pipeline correlates and enriches traffic with findings detail, risk scores, and MITRE ATT&CK labeling. Using ThreatEye NV, you can respond in real-time and accelerate triage with integrated packet analysis.
• Validate End-to-End Encryption Compliance – ThreatEye NV provides encryption-policy specific alerting and reporting for security compliance. The increased adoption of encryption to secure applications calls for a greater need to ensure all platforms conform to the encryption standards of the enterprise.
• Secure Your Entire Network – From Core to Edge to Cloud – The ThreatEye NV solution includes lightweight, easy-to-deploy software sensors available for deployment anywhere and everywhere visibility is needed.
• Cohesive Response – ThreatEye NV interconnects seamlessly with existing security tools like SIEMs, SOAR, and Threat Intelligence. Workflow automations with products like Cisco SecureX can take immediate action on security events to quarantine hosts or block threats. SIEM integration can provide correlation with EDR events and malicious activity on previously unseen encrypted channels.

Die Sonde von ThreatEye NV extrahiert ein umfangreiches Metadatenset mit mehr als 150 dynamischen Paketmerkmalen, um die Erkennung von Bedrohungen und Anomalien, die Reaktion, die Suche, die Forensik und die Erstellung von Berichten zur Überprüfung der Compliance zu unterstützen.

Da sich die auf der Paketdynamik basierenden Metadaten auf die Eigenschaften und das Verhalten von Paketen und nicht auf deren Inhalt konzentrieren, funktioniert diese Technik der Datenerfassung sowohl bei verschlüsseltem als auch bei unverschlüsseltem Datenverkehr gleichermaßen gut.

ThreatEye NV is powered by a streaming machine learning engine (MLE) that ingests the high-fidelity metadata generated by its software probes.

ThreatEye NV’s ML engine is purpose-built for network security. Unlike traditional batch processing, streaming ML is fueled by analyzers —or models— engineered to analyze network traffic without multiple passes over the data stream. Analyzers are architected for specific use cases and scale via parallel processing.

ThreatEye NV’s SaaS offering includes SOC-enabled dashboards to increase responsiveness. The dashboards support SOC analysts’ workflows and are fully customisable to meet all requirements. ThreatEye NV also supports response capabilities to inform as well as take action.

All data is available in real time and via RESTful API and integrates important complementary technologies. Individual integrations can be tailored to the needs of your company. ThreatEye NV’s powerful integrations are capable of remediation and action based on the customer’s technology stack.

• Integrated continuous packet capture with single-click pivot-to-PCAP SPLT (Sequence of Packet Lengths and Times)

• ElasticSearch
• DataDog
• Azure
• InfluxDB
• Splunk
• Kafka – real-time streaming
• Crowdstrike
• Cisco Secure X
• Cortex XSOAR

• email
• webhook
• index
• logging
• slack
• pagerduty

ThreatEye NV is a SaaS offering with software sensors deployed as containerized software applications. his containerized approach allows the solution to be deployed either onpremises, in a private or public cloud, or a mixture of both (Hybrid Cloud).

Regardless of the deployment option, ThreatEye NV’s software components scale to ingest network data directly from physical or virtual network taps at wire-speeds up to 40Gbps.

Find out more about ThreatEye’s POC programme today.

Minimum Requirements: ThreatEye NV hardware recommendations are based on standard internet traffic composition per bandwidth. Therefore, the network traffic mix may affect performance.