ExtraHop, which specialises in analytics for security and performance management, has announced the global availability of ExtraHop Reveal(x). This new network security analytics product harnesses real-time wire data analytics and machine learning to analyse all network interactions for abnormal behaviour and identify critical assets in the environment.
With a 3-in-1 workflow optimised for discovery, correlation, and investigation, Reveal(x) focuses the security analysts’ attention on the most important risks and streamlines response to limit exposure.
Security teams today face a convergence of factors that complicate operations and decrease visibility. Hybrid and multi-cloud architectures increase agility but reduce operational control.
Encryption is vital but disguises both benign and malicious activities. A new source of insight is required for modern architectures, one that provides empirical evidence to help analysts triage and investigate threats with confidence and timeliness.
ExtraHop integrates with your existing security infrastructure and automates response using Splunk, Phantom, Palo Alto, ServiceNow, Cisco, Ansible, and others
Situational intelligence and automated investigation
Reveal(x) delivers situational intelligence and automated investigation that turns the network into the most complete objective source of insight into the threats and vulnerabilities in your environment.
- Unprecedented enterprise visibility: Reveal(x) analyses all network traffic across the entire application payload, identifying in real time all encrypted traffic, rogue nodes, IoT devices, and BYOD systems. It analyses 40+ protocols, decrypting SSL and perfect forward secrecy (PFS) traffic, and auto-discovers and auto-classifies all connected devices, keeping security teams focused on the most critical assets.
- Advanced behavioural analytics: Utilising real-time analytics and advanced machine learning, Reveal(x) identifies abnormal behavioural patterns as they occur and correlates them against continuously monitored critical assets so that security teams can target the most immediate threats.
- Automated investigation: The Reveal(x) analytics-first workflow takes you from issue to associated packets in a matter of clicks. This simplicity replaces hours spent manually collecting and parsing through data, enabling real-time insights and rapid root cause determination. Global search and indexing provide immediate access to security insights. And ExtraHop integrates with your existing security infrastructure and automates response using Splunk, Phantom, Palo Alto, ServiceNow, Cisco, Ansible, and others.
Smart data security
“Attack surfaces are expanding and the sophistication of attackers is increasing. There simply aren’t enough talented security professionals to keep up,” said Jesse Rothstein, CTO and co-founder, ExtraHop.
“Reveal(x) provides security teams with increased scrutiny of critical assets, detection of suspicious and anomalous behaviours, and workflows for both automated and streamlined investigation.”
“With the global availability of Reveal(x), we now enable practitioners across the world’s largest enterprises to do more with less by getting smarter about the data they already have.”
Anomalies are directly correlated with the attack chain and highlight hard-to-detect activities
High-fidelity insights
Reveal(x) addresses the gaps in security programmes by harnessing wire data, which encompasses all information contained in application transactions.
It auto-discovers, classifies, and prioritises all devices, clients, and applications on the network and employs machine learning to deliver high-fidelity insights immediately.
Anomalies are directly correlated with the attack chain and highlight hard-to-detect activities, including internal reconnaissance, lateral movement, command and control traffic, and exfiltration.
Extra layer of security
“When you work in a business dealing with the nation’s leading insurance companies, there is a lot of pressure to get it right. We rely on ExtraHop to provide us with the visibility needed to investigate performance and security issues,” said Chris Wenger, Senior Manager of Network & Telecommunication Systems at Mitchell International.
“With ExtraHop in our IT environment, we can more easily monitor all of the communications coming into our network, including use of insecure protocols. These insights enable my team to better secure our environment. ExtraHop has been that extra layer of security for us.”
Leading security programmes require the broadest visibility, with real-time accuracy, to be able to identify and address threats"
Preventing critical damage
“A complete data source is the starting point for successful security analytics programmes,” said Rob Bamforth, Independent Analyst. “Prioritising critical assets with insights from smart, machine learning-based network traffic analytics is a way to deliver comprehensive visibility that ultimately enables security teams to sort through the noise of threat alerts in order to detect and investigate what matters most, before critical damage is done.”
“As the demand for superior IT analytics grows, our customers are searching for solutions that automatically uncover opportunities and threats across the entire IT landscape.”
“Leading security programs require the broadest visibility, with real-time accuracy, to be able to identify and address threats before any damage is done,” said Graeme Allcock, CEO of CorrServe.