{"id":21218,"date":"2023-02-13T05:21:14","date_gmt":"2023-02-13T13:21:14","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2023\/02\/13\/news-14950\/"},"modified":"2023-02-13T05:21:14","modified_gmt":"2023-02-13T13:21:14","slug":"news-14950","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2023\/02\/13\/news-14950\/","title":{"rendered":"Sophos MDR: Full environment detections for faster threat response"},"content":{"rendered":"

Credit to Author: Doug Aamoth| Date: Mon, 13 Feb 2023 12:00:54 +0000<\/strong><\/p>\n

\n

\"\"<\/a>Visibility is key to stopping an advanced cyberthreat before major damage is done: if you can see intrusion attempts, unauthorized network entry, and other suspicious behaviors as they\u2019re happening, it\u2019s much easier to quickly jump in and neutralize them.<\/p>\n

And while advanced technology solutions – including next-gen endpoint protection and firewalls – are critical layers of defense, stopping advanced, human-led attacks requires 24\u00d77 eyes on glass.<\/p>\n

The good news is that most organizations are already gathering much of the raw telemetry needed to see these risks via their existing security investments.<\/p>\n

Endpoint, firewall, identity, email, cloud, and network solutions all provide valuable insights that enable skilled security analysts to detect and respond to sophisticated attacks.<\/p>\n

Combining telemetry for faster, deeper insights<\/h2>\n

Each telemetry source is useful individually. However, the more signals threat analysts can bring together from across the environment, the more they see and the faster they can react. Let\u2019s look at a couple of examples of how we can combine telemetry sources to accelerate threat response.<\/p>\n

\"\"<\/a><\/p>\n

As we can see, the endpoint signal in the first scenario and the email signal in the second scenario are both suspicious on their own. However, together with data from the firewall, identity telemetry, and other insights, analysts can much more confidently identify data exfiltration attempts in the first scenario and Business Email Compromise in the second.<\/p>\n

The defender challenge: telemetry complexity<\/h2>\n

Achieving actionable visibility from security telemetry is a specialist skill. While many technologies generate<\/em> security alerts and insights that are useful to highly trained analysts, leveraging<\/em> the information is very challenging.<\/p>\n

Defenders face:<\/p>\n