Overview

Enterprise SecOps teams are overwhelmed by alerts from their security tools resulting from an ever-increasing number of increasingly sophisticated attacks. Oftentimes, these tools lack the detailed forensic data, and integration between tools, that analysts need to quickly and accurately investigate and resolve threats.

Packet data is a critical source of evidence for network forensics. The EndaceProbe Analytics Platform combines 100% accurate, network-wide packet capture with the ability to host and integrate with a wide range of security and performance monitoring tools to deliver definitive evidence for troubleshooting issues and responding to cyberthreats.

EndaceProbes provide rapid search and data mining APIs that integrate network history relating to specific security incidents as conclusive forensic evidence to security analysts. When EndaceProbes are used with security tools from our Fusion Partners – including Palo Alto Networks, Cisco, IBM, Splunk, Gigamon, Ixia and many others (a full list is available at endace.com/fusion-partners) – customers can get from an alert in any of their tools directly to the related packet history with a single click, dramatically accelerating investigation and resolution. Analysts can drill down to investigate associated network activity such as lateral movement, data exfiltration or command-and-control traffic and quickly reach accurate conclusions based on definitive evidence.

One of Endace’s channel partners, Paul Giorgi, CTO of DeFY Security says, “There is no greater source of truth in network forensics than what can be found in network packets. That’s why capturing packets is essential. We’ve seen security operations teams struggle to effectively include packet captures as artifacts within their investigations, due to complexities and cost. Automation utilizing the EndaceProbe integration facilitates many new orchestrated actions most teams have not yet been able to tap into yet — providing quicker responses, more thorough investigations, and greater utilization of the existing tools organizations have previously invested in.”