Endace
In today's fast paced cyberthreat landscape, there are two key elements to protecting networks: visibility, and agility.
This is where the power of full packet data comes in. Capturing, indexing and storing a 100% accurate record of network activity provides irrefutable evidence that allows security teams to quickly determine the scope and severity of cyberattacks so they can respond appropriately. It gives SecOps teams the visibility they need to see – definitively - what's happening on the network in a way that no other source of data can.
Having the agility to respond to threats quickly and accurately requires more than simply recording network packet data, however. Both security tools and the SecOps analysts that use them need to be able to analyse that data quickly and efficiently to look for evidence of cyberthreats.
Many security tools need to analyse packet data to detect potential threats. Typically, they capture packets, analyze them, and discard them again. This means definitive evidence about precisely what happened during that event is lost, making it difficult for SecOps teams to get a coherent picture of what's really happening. And organizations are paying for packet capture many times over.
Deploying a common hardware platform capable of recording an authoritative, network-wide record of network activity can help. A common platform can provide security tools with the packet data they need to analyse, while also indexing and recording that data to provide a definitive evidence source for analysts. By integrating this packet-level network history with their security tools, SecOps teams can pivot quickly from alerts to concrete evidence, reducing investigation times from hours or days to just minutes.
Endace's EndaceProbe Analytics Platform does this by enabling solutions from leading security and performance analytics vendors - such as BluVector, Cisco, Darktrace, Dynatrace, Micro Focus, IBM, Ixia, Palo Alto Networks, Splunk and many others – to be hosted on and/or integrated with the EndaceProbe platform. Hosted solutions can access analyse live packet data for real-time detection or analyse recorded data for back-in-time investigations. The EndaceProbe's powerful API-based integration allows analysts to go from alerts in any of these tools directly to the related packet history for deep, contextual analysis with a single click.
By uniting their security tools together with a common hardware platform and leveraging a common, authoritative source of packet-level evidence organizations can create a "community of interoperability" across all their security tools that enables faster response and greater productivity.
The dramatic OPEX/CAPEX cost savings from consolidating hardware and hosting multiple analytics applications on the same common hardware platform frees up budget to deploy more tools in more places, eradicating network blind spots. And it enables teams to deploy solutions where - and when - they're needed without slow, costly hardware rollouts, giving organizations the agility they need to quickly evolve to meet changing needs.