announced its first commercial product, called Backstory, a
cloud-based enterprise-level threat analytics platform that has
been designed to help companies quickly investigate incidents,
pinpoint vulnerabilities and hunt for potential threats.
Network infrastructures at most enterprises regularly generate
enormous amounts of network data and logs on a daily basis that can
be helpful to figure out exactly what happened when a security
incident occurs.
However, unfortunately, most companies either don’t collect the
right telemetry or even when they do, it’s practically impossible
for them to retain that telemetry for more than a week or two,
making analysts blind if any security incident happens before
that.
Backstory solves this problem by allowing organizations to
privately upload and store their petabytes of “internal security
telemetry” on Google cloud platform and leverage machine learning
and data analytics technologies to monitor and analyze it
efficiently to detect and investigate any potential threat from a
unified dashboard.
“Backstory normalizes, indexes, and correlates the data, against
itself and against third party and curated threat signals, to
provide instant analysis and context regarding risky activity,”
Alphabet subsidiary Chronicle said in a blog post.
“With Backstory, our analyst would know, in less than a second,
every device in the company that communicated with any of these
domains or IP addresses, ever.”
traffic, NetFlow, endpoint logs, proxy logs—into meaningful,
quickly searchable and actionable information to help companies
gain insights into digital threats and attacks on their networks,
but at scale to offer a more complete picture of the threat
landscape.
signals collected from a variety of partners and other sources,
including the Alphabet-owned VirusTotal, Avast, Proofpoint and
Carbon Black. “Backstory compares your network activity against a
continuous stream of threat intelligence signals, curated from a
variety of sources, to detect potential threats instantly,”
Chronicle said.
“It also continuously compares any new piece of information
against your company’s historical activity, to notify you of any
historical access to known-bad web domains, malware-infected files,
and other threats.”
Since Chronicle wants customers to collect and upload as much data
as possible, Backstory will not be priced based on the volume of
customer’s data, but rather Chronicle will sell licenses based on
the size of the company.
“Building a system that can analyze large amounts of telemetry for
you won’t be useful if you are penalized for actually loading all
of that information. Too often, vendors charge customers based on
the amount of information they process,” Chronicle explained.
“Since most organizations generate more data every year, their
security bills keep rising, but they aren’t more secure.”
services, called Threat Hunter and Azure Sentinel, which Microsoft
is pitching as the “first native SIEM within a major cloud
platform” to help companies detect, prevent, and respond to threats
across their networks.
Splunk, a company that offers a similar product, saw its stock
down 5% at the time of close on Monday following the announcement
of the Backstory service.
Read more http://feedproxy.google.com/~r/TheHackersNews/~3/EpyP7lsRjDo/backstory-cybersecurity-software.html