ARIA SDS Packet Intelligence

The ARIA SDS solution provides a centralized view in which an end-user cannot only monitor their environment, but also deploy and configure security applications, such as ARIA Packet Intelligence, onto the Myricom SIA SmartNIC. This single pane of glass approach makes it easy to rapidly reconfigure the security applications deployed to all or a portion of the SmartNICs in response to cyber threats or policy changes.

TPlaybooks within any SOAR environment, such as Cortex XSOAR or D3, can take advantage of the ARIA Packet Intelligence API to affect the flow of network traffic. The ARIA PI packet classification capabilities can be leveraged by setting rules, via API, to take action on network data packets. This can be activities such as redirecting or dropping desired traffic streams.

Once the rule is deployed, the ARIA PI dashboard provides insight into network status on the amount and type of network traffic that the action is being taken on. Using this data, an end-user can take immediate action based upon data provided by the application. For instance, the monitoring and analysis of packet data may reveal a threat inside the network. With a simple rule adjustment this traffic can be dropped to prevent any damage.

A powerful integration between ARIA SDS Packet Intelligence and Sumo Logic’s Continuous Intelligence platform delivers a better way to automatically detect internal network threats, including ransomware, malware, and advanced persistent threats. Find and stop the most harmful attacks, early in the kill chain.

With this integration, SOC teams can prioritize intrusion events and alerts, so they can quickly identify and contain the most critical attacks and speed up incident response.

The heart of the integration is the ARIA PI application and how it provides Juniper’s JSA IPFIX or NetFlow records for each packet seen which are 1/1000th the size of the original packets, making it much more efficient and faster than sending the packets directly to JSA. The ARIA PI approach does this for all network packets, allowing JSA to find threats that get past the firewall as well as potential internal threats from compromised devices or insiders.

Pairing the Palo Alto Cortex XSoar orchestration capabilities with the ARIA SDS Packet Intelligence application enables security resources, to get the right data, whether network traffic metadata or full packet-level network traffic, to the right tools and reduce threat detection, investigation, and containment times from days to minutes. The Cortex XSoar automation features along with the substantial ecosystem of tools and play books makes these capabilities even more powerful. Once a breach is detected, playbook-defined automation can drive investigation, also in a consistent manner by all analysts of varying skill level.

The ARIA Packet Intelligence application deploys transparently inside the network and classifies all network traffic, at line rate, and creates enriched NetFlow metadata, which are ingested by Seceon’s aiSIEM. The aiSIEM’s ability to take in network flow data sourced from the ARIA SDS solution makes it very effective at finding difficult-to-detect network-born threats. Going one step further, the aiSIEM can instruct the ARIA SDS probes to stop only the specific threat conversations – while allowing critical applications and devices to continue to operate. The solution also provides simple, implementable network-based microsegmentation, preventing and containing the threat from infiltrating further into the network. Learn more about aiSIEM at www.seceon.com/solutions/aiSIEM

Using ARIA’s Packet Intelligence application, organizations can improve Splunk’s performance and reduce the number of false positives.

• Generates unsampled NetFlow data vs full packets to Splunk ES and saves up to 1000x on data ingest
• Sends only select data conversations as requested to find specific threats
• Stops east-west network born threats immediately
• Reviews previously recorded network activities to locate impacted devices and identifies exposed records

Splunk assists security teams in achieving enterprise-wide visibility and gathers security intelligence needed for continuous monitoring, incident response, and SOC operations The integration between ARIA™ Packet Intelligence applications helps solve ingestion issues, while significantly improving Splunk ES’s effectiveness at detecting, verifying, and stopping attacks. Essentially, security operations center (SOC) teams using Splunk are provided the visibility and confirming data needed to quickly, but properly, detect and stop internal network threats. All of this drastically improves Splunk’s ability to search, detect, and investigate any threat, whether it appears on networks, in the customer premises, in the data center, in the cloud, or in between.