{"id":34467,"date":"2019-02-21T15:21:24","date_gmt":"2019-02-21T07:21:24","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=34467"},"modified":"2019-02-21T15:21:27","modified_gmt":"2019-02-21T07:21:27","slug":"new-kaspersky-cybertrace-streamlines-threat-intelligence-flows-for-better-initial-response-to-cyberthreats","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2019\/02\/21\/new-kaspersky-cybertrace-streamlines-threat-intelligence-flows-for-better-initial-response-to-cyberthreats\/","title":{"rendered":"New Kaspersky CyberTrace streamlines threat intelligence flows for better initial response to cyberthreats"},"content":{"rendered":"\n

With the number of available threat intelligence sources continuing to grow, a third of Chief Information Security Officers (CISOs) feel under pressure as they cannot <\/strong>consume cybercrime intelligence easily or effectively<\/strong><\/a>. To help large companies overcome this challenge, Kaspersky Lab has launched Kaspersky CyberTrace –\u2013 a free threat intelligence fusion and analysis tool. It aggregates and evaluates disconnected data feeds to help identify what threats pose a danger to the organization and ensure security teams focus on the right areas.<\/strong>
<\/p>\n\n\n\n

The variety of threat intelligence sources available on the market doesn\u2019t always translate into protection from cyberattacks, as organizations struggle to decide which are relevant and most important for them.  Security information and event management (SIEM) or network security controls get overloaded with a large number of Indicators of Compromise (IoC), and the fact that threat data is provided in different formats only worsens the situation.
<\/p>\n\n\n\n

To make it easier for enterprises to keep up to date with the latest threats, Kaspersky CyberTrace retrieves continuously updated threat data feeds from multiple threat intelligence sources \u2013 including Kaspersky Lab, other vendors, open source intelligence or even custom sources \u2013 and automatically and rapidly matches them with incoming security events, offloading SIEMs from this high-load operation.
<\/p>\n\n\n\n

If IoC from threat intelligence feeds are found in any log source within an organization\u2019s environment, Kaspersky CyberTrace automatically sends alerts to SIEMs for ongoing monitoring and validation to reveal additional contextual evidence for the security incidents. The tool integrates smoothly with a variety of SIEMs, including IBM QRadar, Splunk, ArcSight ESM, LogRhythm, RSA NetWitness, and McAfee ESM, as well as other security controls such as firewalls and gateways.  
<\/p>\n\n\n\n

Kaspersky CyberTrace helps prioritize tasks by giving analysts a set of instruments for conducting alert triage and response through categorization and validation of identified matches. On-demand lookup of indicators or scanning of logs and files enables advanced in-depth threat investigation, which accelerates forensic and threat hunting activities. The tool also provides feed usage statistics to measure the effectiveness of feeds and their relevance for a certain environment. <\/p>\n\n\n\n

\u201cBeing aware of the most relevant zero-days, emerging threats\u00a0and advanced attack vectors is key to an effective cybersecurity strategy. However, manually collecting, analyzing and sharing threat data doesn\u2019t provide the level of responsiveness required by an enterprise. There\u2019s a need for a centralized point for accessible data sources and task automation. Kaspersky CyberTrace helps organizations better understand their risks, increase the productivity of their security teams and ensure a more robust protection against cyberthreats,\u201d said Sergey Martsynkyan, Head of B2B Product Marketing at Kaspersky Lab.<\/p>\n\n\n\n

Kaspersky CyberTrace is available for customers for free globally and can be downloaded <\/em>here<\/em><\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

If IoC from threat intelligence feeds are found in any log source within an organization\u2019s environment, Kaspersky CyberTrace automatically sends alerts to SIEMs for ongoing monitoring and validation to reveal additional contextual evidence for the security incidents.<\/p>\n","protected":false},"author":6,"featured_media":34468,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,25],"tags":[117,54],"class_list":["post-34467","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-headlines","category-software","tag-kaspersky-lab","tag-security"],"_links":{"self":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/34467","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/comments?post=34467"}],"version-history":[{"count":0,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/34467\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media\/34468"}],"wp:attachment":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media?parent=34467"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/categories?post=34467"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/tags?post=34467"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}