ARIA SDS Advanced Detection and Response

A powerful integration between ARIA SDS Packet Intelligence and Sumo Logic’s Continuous Intelligence platform delivers a better way to automatically detect internal network threats, including ransomware, malware, and advanced persistent threats. Find and stop the most harmful attacks, early in the kill chain.

With this integration, SOC teams can prioritize intrusion events and alerts, so they can quickly identify and contain the most critical attacks and speed up incident response.

The heart of the integration is the ARIA PI application and how it provides Juniper’s JSA IPFIX or NetFlow records for each packet seen which are 1/1000th the size of the original packets, making it much more efficient and faster than sending the packets directly to JSA. The ARIA PI approach does this for all network packets, allowing JSA to find threats that get past the firewall as well as potential internal threats from compromised devices or insiders.

Pairing the Palo Alto Cortex XSoar orchestration capabilities with the ARIA SDS Packet Intelligence application enables security resources, to get the right data, whether network traffic metadata or full packet-level network traffic, to the right tools and reduce threat detection, investigation, and containment times from days to minutes. The Cortex XSoar automation features along with the substantial ecosystem of tools and play books makes these capabilities even more powerful. Once a breach is detected, playbook-defined automation can drive investigation, also in a consistent manner by all analysts of varying skill level.

The ARIA Packet Intelligence application deploys transparently inside the network and classifies all network traffic, at line rate, and creates enriched NetFlow metadata, which are ingested by Seceon’s aiSIEM. The aiSIEM’s ability to take in network flow data sourced from the ARIA SDS solution makes it very effective at finding difficult-to-detect network-born threats. Going one step further, the aiSIEM can instruct the ARIA SDS probes to stop only the specific threat conversations – while allowing critical applications and devices to continue to operate. The solution also provides simple, implementable network-based microsegmentation, preventing and containing the threat from infiltrating further into the network. Learn more about aiSIEM at www.seceon.com/solutions/aiSIEM

Using ARIA’s Packet Intelligence application, organizations can improve Splunk’s performance and reduce the number of false positives.

• Generates unsampled NetFlow data vs full packets to Splunk ES and saves up to 1000x on data ingest
• Sends only select data conversations as requested to find specific threats
• Stops east-west network born threats immediately
• Reviews previously recorded network activities to locate impacted devices and identifies exposed records

Splunk assists security teams in achieving enterprise-wide visibility and gathers security intelligence needed for continuous monitoring, incident response, and SOC operations The integration between ARIA™ Packet Intelligence applications helps solve ingestion issues, while significantly improving Splunk ES’s effectiveness at detecting, verifying, and stopping attacks. Essentially, security operations center (SOC) teams using Splunk are provided the visibility and confirming data needed to quickly, but properly, detect and stop internal network threats. All of this drastically improves Splunk’s ability to search, detect, and investigate any threat, whether it appears on networks, in the customer premises, in the data center, in the cloud, or in between.