Cynet 360 AutoXDR is the first stand-alone cyberthreat protection platform that integrates endpoint, cloud, network and application attack prevention and detection with automated investigation and remediation capabilities. The platform provides security departments with a single point of visibility and multiple incident analysis and investigation options.
Available in the Safetech portfolio, both as an individual product and as a service managed through the Security Operation Center, the Cynet 360 AutoXDR platform is delivered “turnkey”, along with professional services provided by trained and certified specialists within Safetech (Cynet Security Certified Technical Solution Architect), which provides all the necessary support for its commissioning, operation and optimization.
Extended Detection and Response (XDR) defines a category of security solutions that centralize, aggregate and correlate events from multiple sources. This provides extended visibility and facilitates the correct identification of incidents and the rapid application of response measures.
Thus, XDR solutions are specifically designed to help security teams:
• identify sophisticated or hidden threats,
• track threats in several components of the IT infrastructure,
• improve detection speed and accuracy,
• investigate threats and take response measures more quickly and efficiently.
XDR technology emerged as a reaction to specific, isolated security solutions and applications that only perform event correlation without enabling remediation. Basically, an XDR platform has the potential to replace Endpoint Detection and Response (EDR), Next Generation Anti-Virus (NGAV), Network Detection and Response (NDR), Security Information and Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR).
The benefits of XDR platforms
Although the XDR concept is relatively new to the market, the solutions of this type have proven to deliver solid gains:
• Improved prevention and response capabilities – The XDR platforms include Threat Intelligence services and Machine Learning algorithms that provide improved protection against a wide variety of attacks. Also, through continuous monitoring and automatic response capabilities, XDR can block a threat as soon as it is detected, thereby reducing the risk of compromise and related damage.
• Granular visibility – an XDR platform provides comprehensive information about users and terminal equipment (workstations, physical servers, virtual machines from on-premises or cloud infrastructures, IoT devices, etc.), aggregated with data about network communications and applications and services use.
• Effective response – XDR platforms collect data from multiple sources, aggregate and analyze it, allowing attack paths to be identified and attacker actions to be reconstructed. The information delivered makes it easier to locate and block the threat, wherever it is, as well as pinpoint vulnerable areas.
• Improved productivity – centralizing multiple security tools in a single platform reduces the number of alerts and increases the efficiency of investigation and response measures. At the same time, because XDR is a unified platform and not a “combination” of several-point security applications, the solution is easier to maintain and manage.
Cynet 360 AutoXDR, a fully automated platform
Cynet 360 AutoXDR is the first end-to-end automated security threat detection and response platform. Cynet’s XDR platform ensures improved operational efficiency, visibility and protection across the entire organization, regardless of the resources, size and skills of the security team.
Cynet 360 AutoXDR ensures the security of endpoints, users, networks and applications run on-premises or as SaaS, using three key components:
• Protector – prevents and detects threats from across an organization’s IT environment and delivers an expanded range of capabilities out of the box in a single, easy-to-use platform:
o detection of threats through continuous monitoring of terminal equipment, networks and users,
o improving the efficiency of IT and security operations through the native integration of specific functionalities (Sandboxing, vulnerability management, advanced analysis etc.),
o reducing security risks in the cloud by automatically monitoring and correcting configuration errors of applications delivered as-a-Service (SaaS Security Posture Management, SSPM).
• Responder – provides complete automation of the response actions required to reduce the burden on the security team by:
o automated investigation and remediation – Cynet’s XDR platform can automatically determine the root cause and extent of an attack, recommending or applying remedial measures without human intervention,
o playbooks – predefined detection, analysis and response sequences that automate and orchestrate remedial actions across the entire IT environment, covering a wide range of attack scenarios.
o extended visibility – Cynet 360 delivers detailed attack information through intuitive graphical interfaces and security event timelines.
• Correlator – provides advanced SIEM (Security Information and Event Management) capabilities by integrating and correlating alert data, facilitating the rapid detection of threats in the IT environment with the help of the following functionalities:
o centralized Log Management (CLM) – consolidates all logs and makes them accessible to platform users through a single, easy-to-use interface.
o correlation of events by integrating, analyzing, and prioritizing data collected by the Cynet platform.
o advanced Forensics analysis, for detailed investigation of security events.
The strengths of Cynet 360
The Cynet 360 AutoXDR platform has a number of important advantages, listed below:
• Scalability – The possibility of deploying the Cynet solution from hundreds to thousands of endpoints in just a few hours. Cynet 360 can be used immediately to discover advanced threats and apply remedial measures, either automated or manual, to eliminate threats and minimize the damage caused by attacks.
• Simplicity – Cynet 360 AutoXDR – natively automated end-to-end platform – eliminates the complexity of managing multiple distinct security tools.
• Cost reduction – consolidating multiple security products into a single XDR platform provides significant cost savings on the acquisition, in operations, and for technical support and maintenance.
Key technical features of the Cynet platform include:
• Next-Generation Antivirus (NGAV) – provides automatic prevention, detection and blocking of malware, exploits, macros, malicious scripts, fileless attacks, ransomware, etc. with the help of analysis functions based on Machine Learning algorithms.
• User Behavioral Analytics (UBA) – ensures the detection and prevention of attacks that use compromised login data by creating and using behavioral patterns and user profiles. The platform also monitors network traffic to detect and flag lateral movements of attackers who have managed to bypass security measures, as well as attempts to exfiltrate data.
• Dissimulation of security vulnerabilities (“honeypot” type functionalities) – creates and adds fake credentials, files and connections in the computer network to attract attackers to reveal their presence. At the same time, the information about the usage of those elements is used to fix vulnerabilities and improve proactive protection measures.
• The possibility of customizing the Playbooks with scripts created according to the specific requirements of each organization. Delivered playbooks provide a set of predefined remediation tools for each type of file, device, network or user that accelerate and increase the effectiveness of security incident response measures. Playbooks can be combined with scripts created by the customer or the integration partner so that the XDR platform can communicate with other infrastructure security solutions (firewalls, Active Directory, etc.), creating large-scale response orchestration flows.
• Cynet Sensor Fusion Technology – continuously tracks and analyzes all signals from native Cynet sensors to determine the exact risk and context of each activity. Everything that happens is transmitted and analyzed in real time, and the data is aggregated and correlated to provide a big picture. With Cynet Incident Engine, security teams can realize substantial time and effort savings, with the full investigation and remediation of a security incident taking only minutes.
Safetech Innovations professional services
In order for organizations to obtain all the benefits described above, Safetech Innovations, authorized Cynet partner in Romania, provides “turnkey” Cynet systems and provides full support for them. The experts involved in the projects are certified as Cynet Security Certified Technical Solution Architect and have relevant experience in working with the Cynet platform.
The professional services provided by Safetech include:
• implementation and commissioning of the Cynet 360 AutoXDR platform,
• configuration of the XDR platform to reduce false-positive alerts, prioritize the real alerts and ensure their efficient processing in the client’s specific IT environment,
• optional integration with other tools/solutions,
• alert monitoring and handling of security incidents, with 24/7/365 coverage, by the Safetech Computer Emergency Response analyst team.
If you are interested in Cynet 360 or an XDR platform in general, we invite you to schedule a discussion with a Safetech Innovations representative at sales@safetech.ro or by phone at 021 316 05 65.
