Firewall Traffic Analysis (FTA)

Stellar Cyber’s NDR application helps get the data right and helps drive extended detection and response (XDR) thinking. Collect, analyze and store metadata from network traffic at scale by dramatically reducing the data volume while providing ample evidence for advanced detection and forensic analysis. The integrated and advanced deep-packet inspection (DPI) engine can identify 4,000+ network applications, extract network security metadata from these applications, and reassemble files. The right amount of metadata, including DNS domain names, URLs, SQL queries, etc. are extracted. Stellar Cyber’s NDR can also take network security information from existing devices like logs from NGFW as well as NetFlow or IPFix. Stellar Cyber’s Interflow enriches the metadata with information from a variety of sources including DHCP/DNS traffic, logs for host names and domain names, identity provider (IDP) such as Active Directory, Office365 or Okta for usernames, Threat Intelligence, Geolocations, and vulnerability scan results. Pervasive visibility of lateral malware movement throughout the network is critical part of IT security. In addition to monitoring north/south traffic that crosses the enterprise perimeter, NDR monitors east/west communications and/or cloud-based applications through strategically-placed physical or virtual network sensors or agents/containers on servers << Show Less

As an additional benefit of Stellar Cyber’s Open XDR platform, Internet security is enhanced by having an integrated intrusion detection system (IDS) application processes network traffic before machine learning to predictably produce high-fidelity alerts. Stellar Cyber’s NDR application delivers real-time detection and threat hunting/investigation through a data lake with searchable indexed big data. Stellar Cyber performs real-time and historic network security analysis by leveraging both supervised and unsupervised machine learning as well as deep learning for advanced detection without signatures. Each integrated detection is purpose- built with the right machine learning model for its use case, rather than one model for all detections. Stellar Cyber’s security researchers and data scientists constantly tune the models for more detections and improvement of existing detections.

Stellar Cyber’s user interface improves security analysis by enabling analysts’ to  tune the machine learning model as well, by labeling the event via thumbing up or thumbing down a specific ML-driven detection result. And all integrated applications, including both NDR and machine learning IDS and malware detection, are aligned to the cyber kill chain, driving up productivity and reducing training time. << Show Less

With a built-in Data Streaming app, both data and security detections can be sent to incumbent SIEMs like Splunk. They can also be sent to any custom tools through Restful APIs or ticketing tools through email. Stellar Cyber has a built-in, very powerful reporting and alerting engine with both pre-canned reports for compliance and customizable reports tailored to individual requirements. Thinking proactively, Stellar Cyber has a powerful automated threat hunting application built-in with a large number of pre-built threat hunting libraries. For example, when a login such as SSH/RDP/FTP from an unexpected country and/or unexpected time window is detected, a firewall action response can be automatically triggered. << Show Less