Continuously tracking threats
Ignoring a threat amplifies our vulnerability
In cyberspace, there are more and more attackers. They show ingenuity to deploy sophisticated attacks that often escape conventional defense strategies. Prevention, awareness and the application of computer hygiene rules are no longer enough. Protecting oneself now requires perpetual intelligence around threats in order to follow their technical, tactical and strategic developments as closely as possible.
Detect threats before impact
Within our SOC platform, cyber threat hunting is one of the basic elements of our approach. It takes shape through a feature called “Operations center”. You will find a catalog of more than 560 rules specialized in the detection of cyber threats.
This rules’ catalog is entirely produced and maintained daily by our team of cybersecurity researchers and analysts. Each threat detection rule is always associated with context. This can be emerging threats as well as so-called advanced ones, malware names, groups of attackers, modus operandi or attack techniques (based on the MITRE ATT&CK framework).
Depending on your needs, you can also customize detection rules, apply exclusion cases, restrict their scopes of use, or create new ones tailored to your operational security strategy.
Protect your organization in real time
Unlike traditional approaches that carry out detection intermittently (every 15 minutes, for example), our SOC platform helps you apply detection within your IS in “streaming”, i.e. continuous detection.
This is made possible thanks to the combined presence of our three detection engines:
A correlation detection engine focused on detecting malicious behavior.
Here, it is a question of taking advantage of the SIGMA language to express the expected properties around the collected events. These rules can also be combined using temporal, statistical operators to perform multi-event detection (for example, the detection of five authentication failures on the same user name in five minutes).
A CTI detection engine to detect – thanks to an actionable knowledge base – the presence of malicious activity on your Information System.
An anomaly detection engine capable of identifying sufficiently legitimate techniques, unknown to the CTI knowledge base and which could fly under the radar of the behavioural detection engine.
Improve the analyst experience of your SOC team
The 560 cyber threat detection rules, natively integrated into the SOC platform, are directly actionable, ready to use and customizable in a few clicks. Depending on operational needs, your analysts can readjust them to increase their efficiency or create new rules deemed closer to your realities.
Chat with our team !
Would you like to know more about our solutions?
Do you want to discover our XDR and CTI products?
Do you have a cyber security project in your organization?
Make an appointment and meet us!
