LogRhythm Extends Holistic Threat Analytics Suite With Endpoint Behavioral Anomaly Detection

Caption: Hear Chris Petersen, chief technology officer, senior vice president of products and co-founder of LogRhythm, talks about the Holistic Threat Analytics Suite

BOULDER, Colo.—August 5, 2015— According to the 2015 Verizon Data Breach Investigation Report (DBIR), 60 percent of breached organizations were initially compromised within minutes, but for most breached organizations, it took substantially longer to detect the intruders. LogRhythm, The Security Intelligence Company, is helping organizations reduce the time it takes to detect intruders across potential points of entry with the release of its Endpoint Threat Analytics Module. This latest addition to the company’s Holistic Threat Analytics Suite delivers advanced endpoint behavioral anomaly detection and other machine analytic techniques to identify systems compromised through zero-day attacks and custom malware. The Endpoint Threat Analytics Module, combined with LogRhythm’s User and Network Threat Analytics Modules, gives organizations a holistic view of threats and intrusions across the broad attack surface.

Many intrusions begin with an attacker compromising an endpoint through targeted spear phishing. Once inside, attackers will compromise additional systems and user accounts. In many cases, hundreds of systems and user accounts will be compromised prior to a data breach being realized. Unfortunately, as the DBIR data indicates, even when the intrusion is wide spread, most organizations are ill-equipped to detect quickly the activities of an advanced cyber adversary operating within their environment.

LogRhythm’s Holistic Threat Analytics Suite spots advanced threats by modeling a wide variety of behaviors across the entire IT environment. This approach provides holistic visibility into advanced threat operators when “behavioral shifts” occur as they compromise endpoints, applications and user accounts.

LogRhythm’s Holistic Threat Analytics Suite is comprised of three individual analytics Modules that can be deployed individually or as a whole based on customer’s threat detection needs and overall risk posture:

• The new Endpoint Threat Analytics Module leverages LogRhythm’s System Monitor sensor for real-time forensic data acquisition and extensive visibility into endpoint activity. This Module detects threats such as custom malware compromises, suspicious process and user activity, and local data exfiltration.
• The User Threat Analytics Module provides extensive visibility into user activity and detects compromised accounts and other suspicious user activity, including insider threats.
• The Network Threat Analytics Module leverages LogRhythm’s NetMon sensor for real-time generation of Layer 7 SmartFlow™ data, providing extensive visibility into network communications activity at an application level. This module identifies such threats as remote zero-day attacks, internal scans and probes, suspicious application communications and network based data exfiltration.

These Modules leverage LogRhythm’s patented AI Engine technology that applies machine learning and other machine analytics techniques to highly contextualized log and machine data. When all three modules are deployed, customers can correlate and corroborate advanced threats across the holistic attack surface, realizing additional analytics value and increasing their chance of detection.

“A successful intrusion doesn’t have to equal a successful breach if you can detect the intruder early in the threat lifecycle and limit dwell time,” said Jon Oltsik, senior principal analyst at Enterprise Strategy Group. “LogRhythm’s Holistic Threat Analytics Suite with the new endpoint anomaly detection capability offers a comprehensive approach to detecting and responding to intruders before they can turn system compromises into damaging data breaches.”

“Advanced threat actors will leverage every possible angle to gain a foothold within their target environment, and they will be successful,” said Chris Petersen, chief technology officer, senior vice president of products and co-founder of LogRhythm. “The best way organizations can be assured of detecting initial compromises quickly is by having visibility across all possible vectors of entry and points of further attack. To achieve this, organizations must be looking for behavioral shifts across user accounts, the network and endpoints.”

The LogRhythm Holistic Threat Analytics Suite, including the User Threat Analytics Module, Network Threat Analytics Module and new Endpoint Threat Analytics Module, as well as LogRhythm’s supporting Co-Pilot Services, are available today to LogRhythm customers.