Endace OSm 7.1 allows analysts to reconstruct and extract files from recorded packet data

Endace announced OSm 7.1 for the EndaceProbe Analytics Platform, enabling analysts at all levels to gain deeper insight into malicious network activity from packet capture data.

The new features benefit customers by:

• Enabling security analysts to easily reconstruct and extract files from recorded packet data to rapidly understand the nature and extent of threats or breaches. Analysts can analyze the actual files – malware, ransomware, executables, zip archives, exfiltrated data, and more – used by attackers to compromise user and network security and steal data. This gives analysts certainty about exactly what happened.
• Allowing analysts to generate detailed logs – including DNS, HTTPS, TLS, SMTP, database transactions, and many others – from recorded packet data. This gives analysts rich contextual insight into activity that has occurred across the network and enables more accurate threat assessment and response.
• Enabling MSSPs or organizations with multiple tenants to securely share packet recording infrastructure. This allows teams from different organizations or divisions to take advantage of continuous packet recording while keeping each organization’s data separate.

Continuous, always on, packet capture has always been the gold standard for understanding the threats traversing networks. However, until now, packet analysis has often been limited to senior security analysts with deep experience in packet forensics. The OSm 7.1 release makes packet capture more useful to security team members with little or no packet forensics experience.

Junior analysts can reconstruct, extract and save files that have traversed the network along with easy-to-understand logs. This lets them quickly reconstruct and analyze malicious activity, analyze files, and see exfiltrated data without needing deep packet forensics expertise.

“Recorded network traffic is key to solving the most complex and threatening security incidents,” says Cary Wright, VP of Products at Endace. “These new capabilities, combined with the EndaceProbe platform’s always-on, global-scale network recording puts vital evidence in the hands of SecOps teams – so they can respond to threats faster and with greater confidence.”

OSm 7.1 also extends the power of always-on packet recording to multi-tenant environments such as MSSPs, federal or government organizations securing multiple entities, or large enterprises with multiple divisions. Multiple entities can now share a common recording infrastructure and each securely search, access and analyze only their own traffic.

OSm 7.1 is available immediately for EndaceProbe customers.