IntSights enhances its platform to expand investigation capabilities and threat library

IntSights announced enhancements to the company’s External Threat Protection Suite, offering customers a brand new experience and functionality to its TIP module that greatly streamline research and investigation workflows, reducing timelines from days to hours. The result is faster research for threat hunters and SOC analysts while they are working both within and outside of the IntSights platform.

Delivered through an elegant single pane of glass and deployed in a matter of hours, IntSights’ External Threat Protection (ETP) Suite provides enterprise-grade external threat intelligence and IOC management capabilities enabling security teams to defend against a rapidly evolving threat landscape while significantly reducing their workload.

Centralizing the collection, management, and integration of dozens of threat intelligence sources in the same platform, security teams can streamline investigation and proactively block threats with IntSights’ built-in TIP capabilities.

Cyber Threat Intelligence (CTI) and SOC teams are tasked with investigating Indicators of Compromise (IOCs) as rapidly and accurately as possible. These teams require up-front access to information such as when the IOC was discovered, reporting sources, and its relevance to their organization. IntSights continues to innovate and expand its TIP for increased speed of access to all the relevant threat information required to thoroughly investigate and respond to IOCs and other cyber incidents.

“As we have seen from recent headlines, companies of all types and sizes and across every industry are facing major cybersecurity challenges and have to meet the needs of their organization with comparatively limited resources.” said Guy Nizan, CEO and Founder at IntSights. “The enhancements we continue to make to the IntSights ETP allow these teams to significantly streamline threat investigations and proactively block threats from within their connected security devices. Our mission is to empower every organization with threat intelligence, and you just can’t utilize TI successfully without built-in TIP capabilities.”

New enhancements to the IntSights ETP platform TIP module

• Expanded investigation capabilities: Building on existing IOC graph/link analysis database, IntSights has further expanded its threat intelligence platform to include expanded mapping capabilities on threat context, with the ability for customers to deep-dive into each indicator for further details, add investigation notes, and export the full map and details.
• Expanded threat library & MITRE ATT&CK framework mapping: IntSights has also updated its existing threat library and content with a new user interface including more advanced search capabilities through regular expression (RegEx) like those used in search engines to speed investigation time for fast results, as well as details on MITRE ATT&CK framework Technique IDs (TIDs), a list of common tactics, techniques, and procedures (TTPs), mapped to relevant threat library topics.
• IntelliFind – dark web search: A free-form search engine utility enables customers to search outside of their digital footprint on the clear web, into dark web sources. With this tool, security practitioners can extract information from IntSights dark web repositories (e.g., track threat actors, review postings on hacking forums or black markets, explore malware related chatter, etc.) and immediately discover how they pertain to organization-specific assets and mentions across the entire intelligence surface.
• IntSights extend – Browser Extension (TIP/VRA): IntSights customers can speed external research and investigation efforts from any web resource, including SIEM environments, by using the Extend browser extension for Google Chrome and FireFox, which allows them to quickly view relevant IOCs and CVEs with mouse-over context while performing research outside of the IntSights platform.
• Splunk app integrations (TC, TIP, VRA): IntSights has released an enhanced native bidirectional app for Splunk, a “Leader” in Gartner‘s 2020 Magic Quadrant (MQ) for Security Information and Event Management (SIEM) solutions, which enables IntSights customers to bring actionable threat intelligence into their Splunk environment for a holistic view of threats targeting their environment.

from Help Net Security https://ift.tt/3vpCjVk

Related Items