用例

With the cloud architecture 和 intuitive interface in Insight印尼盾, it's easy to centralize 和 analyze your data across logs, 网络, 端点, 更重要的是，要在几个小时内——而不是几个月里——找到结果. 用户和 攻击者行为分析, along with 洞察力s from our threat intel 网络, is automatically applied against all of your data, 帮助您及早发现并响应攻击.

In 2017, 80% of hacking-related breaches used either stolen passwords 和/or weak or guessable passwords. Users are both your greatest asset 和 your greatest risk. 洞察力tidr使用机器学习来 为用户的行为设定基准，自动提醒您使用 偷来的凭证 或者是异常的横向运动.

Between Metasploit, penetration tests, our 24/7 托管检测和响应服务, we're investigating a constant stream of attacker behavior. As part of the investigative process, our analysts directly contribute 攻击者行为分析 (ABA) detections into Insight印尼盾, paired with recommendations 和 adversary context. These detections leverage the real-time user 和 endpoint data collected by Insight印尼盾. The result: the alert fidelity you want, filled with the context you need.

Threat detection 和 response is a critical piece in an ongoing journey to improve your security program, but feeling confident in your coverage can seem challenging with a remote workforce. 当用户处于远程状态时, they may be operating assets like laptops in potentially hostile 网络s outside of IT 和 security’s control. 有效地完成他们的工作, your remote employees still need access to company data 和 key applications.

为了应对这些挑战, we’ve developed a comprehensive approach to detection 和 response, 帮助您实现业务连续性, keep your organization protected (no matter where they are), build a foundation for success across your entire environment.

Incident investigations aren't easy when you're facing a mountain of alerts with log data 和 spreadsheets. Every alert in Insight印尼盾 automatically surfaces important user 和 asset behavior, along with context around any malicious behavior. Easily pivot from a visual timeline to log search, on-dem和 端点审讯, or user profiles to scope the incident 和 take informed action.

Save time 和 lower risk across your entire incident response lifecycle. 在洞察力tidr中调查威胁时, 你不仅得到了重要的背景, but you can take immediate steps to contain a threat. 随附Insight Agent, you can kill malicious processes or quarantine infected 端点 from the 网络. You can also use Insight印尼盾 to take containment actions across Active 导演y, 访问管理, 功能, 防火墙工具. This gives your team the power to directly contain threats on an endpoint, 网络, user level.

虽然合规性并不等于安全性, it’s important to be able to share the health of your 网络 with key third-parties. In addition to automatically analyzing your data for 攻击者的行为 和 anomalous user activity, you’re able to search, visualize, report across your data.

For any type of alert created or managed by Insight印尼盾, you can automatically create a corresponding ticket or case in tools like JIRA 和 ServiceNow. 配合我们的本地案例管理功能, 这确保了对于任何警报, the right team members are notified 和 empowered to take action.

微软Azure是一个强大的, 灵活的, scalable infrastructure platform for hosting applications in the cloud. 但 Azure安全 challenges don’t disappear; enterprises still need to protect themselves against phishing 和 social engineering attacks, 云资产配置错误, 攻击者的横向移动, other causes of data breaches 和 service interruptions.

洞察力tidr - rapid7的云SIEM for modern detection 和 response–offers an ideal solution. It collects data from the major management 和 security tools native to Azure, combines that with information from across the organization’s IT footprint, uses advanced analytics to detect malicious behaviors. 它还 为快速事件响应提供上下文 和 支持云报告和遵从性.

亚马逊网络服务(AWS), Rapid7的首选云提供商, offers a feature-rich environment for hosting 和 managing cloud-based applications on a 灵活的, 高度可扩展的基础设施. 然而, AWS云安全 仍然是一个挑战. Amazon Security Hub 和 Amazon GuardDuty provide some visibility into log data 和 security events in AWS environments, but they lack advanced analytics 和 other features needed to detect 和 respond to threats.

Rapid7 Insight印尼盾 is a fast-to-deploy cloud-based SIEM designed to quickly detect sophisticated attacks. It aggregates data from AWS sources like CloudTrail 和 GuardDuty, together with information from on-premises 网络s, 端点, 以及其他云平台. 它使用 用户行为分析(UBA), 业界领先的威胁情报, 自动化工作流 to help security teams uncover 和 investigate threats in AWS environments 和 across the organization’s entire IT footprint.