NOMINATION HIGHLIGHTS

Always-on packet capture provides the most reliable source of evidence for incident investigation and response. Recorded packet data delivers definitive forensic evidence of network activity — enabling faster, more accurate, and more conclusive incident response.

EndaceProbes give organizations unified visibility across on-prem and hybrid cloud infrastructure. SOC and NOC teams can accurately record and store weeks to months of network traffic at full line rate, to go further back in time to accurately reconstruct, investigate and resolve security threats or breaches. The ability to share packet-level data with teams and tools means that testing configurations, detecting threats, and resolving incidents is faster and more accurate.

The powerful API integrates with tools such as NDR/XDR, IDS, Firewalls, SIEM, and SOAR tools, allowing teams to quickly search for, automate, and retrieve packet data relating to specific events. This integration capability puts accurate forensic evidence at an analyst’s fingertips, enabling them to go from an alert in their monitoring tools directly to the related packets with a single click. This reduces investigation time from potentially hours or days to just minutes. Recorded packet data can also be replayed to analytics tools to deliver powerful back-in-time “re-investigation” and enable accurate reconstruction of historical network activity to identify the root cause of issues.

EndaceProbes provide centralized data mining and rapid search, centralized management, and workflow integration, to deliver full visibility into all network traffic. EndaceProbes are certified by NIST FIPS 140-3, Common Criterial/NIAP NDcPP v2.2e, and are the only packet capture solution on DISA’s Department of Defense Information Network Approved Products List (DoDIN APL)

Multiple EndaceProbes can be stacked and grouped for almost unlimited storage capacity and can scale to sustained network speeds of 100 Gbps and beyond. Hosted applications on EndaceProbes can access network traffic in real-time or replay recorded traffic for powerful, back-in-time analysis.

John Grady, Principal Analyst at Omdia/Enterprise Strategy Group, said: “Access to detailed network history is crucial for NOC and SOC teams to quickly identify and resolve incidents and threats. But the speed and scale of modern enterprise networks, security concerns in highly regulated environments, and existing investments in security and monitoring tools create specific needs organizations must consider…EndaceProbe appliances address these issues by offering significant storage capacity, density and speed, certifying to defense-grade security hardening standards, and integrating with security and monitoring tools from leading vendors.”