ExtraHop turns security analysts into threat experts with Reveal(x) winter 2019

ExtraHop released new capabilities designed to help Security Operations Center (SOC) and Network Operations Center (NOC) teams identify and safeguard critical assets, detect late-stage and insider threats, and transform security analysts into threat experts with streamlined investigation workflows.

Demand for business agility and uptime have accelerated the modernization of IT, which is now dynamic and distributed – from the data center, to cloud infrastructure and SaaS, to remote sites and device edges. These changes introduce complexity and expand the attack surface, contributing to high rates of false positives and obscuring true threats. Analysts constantly waste time, through no fault of their own, working to validate the constant flow of alerts to determine if investigation is warranted.

The winter 2019 release of ExtraHop Reveal(x) improves SOC and NOC analyst productivity through contextual discovery of the enterprise attack surface, full-spectrum detection, and one-click guided investigation for incident response.

Detections incorporate device and user context to identify known and unknown threats using an array of machine learning, rule-based, and custom techniques. Detections incorporate suggested next steps and are made actionable through clear evidence, enabling front-line analysts to validate, close, or escalate prioritized events with confidence. Senior analysts get detail on users and devices to support rogue device detection, insider threat investigations, threat hunting, and forensics.

Features of the Winter 2019 release include:

• User-to-device mapping: Correlation between users and devices allows analysts to investigate, expediting validation without the need to cross-reference with other tools.
• OS auto-discovery: Operating system (OS) auto-discovery confirms and compares the OS each device is using with known behaviors of those systems to identify spoofing.
• Role classification: Expanded role auto-classification uses behavior to automatically infer more device types (e.g., mobile device, DHCP server, domain controller or DNS server), and then maintains groupings to keep analysts focused on what matters most.
• Dynamic device grouping: Device grouping permits users to define rules for attributes and behavior to better prioritize monitoring, detection, and triage.
• Rules engine: The rules engine detects known threats, policy violations, and risk-based detections.
• Guided investigation workflows: One-click guided investigations link each detection to the right next steps, as well as the device’s transaction and behavior details, for instant validation of threats and faster MTTR.
• Expanded integrations: ExtraHop now integrates with ServiceNow CMDB, QRadar SIEM, and Palo Alto Networks firewalls.

“As the world’s leading security solutions integrator, Optiv’s goal is to help our clients create clarity from the cybersecurity chaos. Simplifying client workflow is an important piece of that puzzle,” said Woodrow Brown, director of partner strategy and research, Optiv.

“ExtraHop’s Reveal(x) gives our clients’ security analysts, as well as Optiv’s SOC analysts managing clients’ security services, an actionable path to respond to incidents, complete investigations, and improve their time to value.”

“Forcing analysts to switch between tools or manually pull together disparate data for an investigation increases cognitive load, delay, and the chance of missing a critical piece of evidence,” said Jesse Rothstein, CTO and Co-Founder, ExtraHop. “Our focus in this release is to bring authoritative data about every device’s communications, OS, users, and network behavior into a contextual workflow that guides analysts to the right answer immediately.”

With ExtraHop, security and IT teams can detect threats up to 95 percent faster, reduce resolution time by nearly 60 percent, and decrease unplanned downtime by as much as 86 percent. The ExtraHop approach has been recognized by numerous organizations including Credit Suisse, JMP Securities, and leading independent analyst firms including Enterprise Management Associates.