DATA SECURITY, NETWORK THREAT DETECTION, PLATFORM SECURITY

Exabeam Introduces New-Scale SIEM™

Exabeam | October 17, 2022 | Read time : 03:00 min

Exabeam
Exabeam, a global cybersecurity leader and creator of New-Scale SIEM for advancing security operations, today announced a groundbreaking cloud-native portfolio of products that enables security teams everywhere to Detect the Undetectable™. New-Scale SIEM is a powerful combination of cloud-scale security log management, industry-leading behavioral analytics, and an automated investigation experience. Built on the cloud-native Exabeam Security Operations Platform, the New-Scale SIEM product portfolio gives worldwide security teams the greatest fighting chance at defeating adversaries with advanced threat detection, investigation, and response (TDIR). The new product portfolio is generally available (GA) today.

“Security operations teams have faced difficulty defending against complex threats and evolving adversarial behavior because technology innovation has not kept up in the realm where big data meets cybersecurity. “Exabeam is known for having the best behavioral analytics product on the market — it’s why so many of the world’s largest organizations count on Exabeam every day to help stop adversaries, including the majority now utilizing valid credentials. We are marrying behavior analytics with the world's most modern, hyperscale, cloud-native data lake to ingest, parse, store, and search data in real time from anywhere. The SIEM industry has been ripe for evolution for some time and New-Scale SIEM represents that evolution.”

Michael DeCesare, CEO and President Exabeam

Unmatched Performance

Significantly more affordable than competitive offerings, the new Exabeam cloud-native product portfolio is built on an open platform that integrates with more than 500 different third-party products and includes nearly 8,000 pre-built parsers, greatly reducing onboarding, deployment, and run times. An industry-first, security teams can now search query responses across petabytes of hot, warm, and cold data in seconds. Organizations can now also process logs at sustained speeds of over one million events per second.

“The Exabeam Security Operations Platform and portfolio of products are designed like no other on the market. We deliver the single solution security operations analysts can count on to conduct accelerated, thorough threat detection, investigation, and response (TDIR) with the most consistent and successful outcomes,” said Adam Geller, Chief Product Officer, Exabeam. “We provide security teams with a holistic picture of their environment –– data from core security products, IT infrastructure, and business applications joined with critical user and device context and timely threat intelligence data –– to detect what competitive SIEMs simply can’t. In addition to our industry-leading behavioral analytics, we’re proud to deliver world-class security log management and new modular SIEM solutions for organizations at all stages of their data growth and security journey.”

Understanding Normal Behavior to Detect and Prioritize Anomalies

Organizations can use Exabeam to defend against the rising threat of external and internal attacks that in today’s world are more often than not leveraging compromised credentials.

More than 750 behavioral models power 1,200 anomaly detection rules in Exabeam to baseline normal behavior for every user and device. This is beyond anything a legacy SIEM can possibly create with correlation rules. For example, for an organization with basic logging, 20,000 users, and 50,000 assets, Exabeam can dynamically build and update 50 million unique detection rules.

According to the 2022 Verizon DBIR, over 90% of breaches are rooted in compromised credentials. Whether it’s phishing, ransomware, malware, or other external threats, valid credentials have emerged as the adversaries’ primary target. This combined with explosive amounts of data demands a shift in investment from legacy on-premises, rule-based detections to cloud-native SIEM platforms that uniquely understand normal behavior, even as normal keeps changing.

“It’s all about the credentials. Today’s announcement takes Exabeam, our customers, partners, and the SIEM market into an entirely new stratosphere,” said Ralph Pisani, President, Exabeam. “Detecting stolen or misused credentials –– and the abnormal behavior that follows –– is not possible without understanding normal behavior. If you don’t know normal behavior for every single user and device in your environment, understanding abnormal behavior in your organization is a near impossible undertaking –– this is a fundamental capability that only Exabeam can deliver on at scale.”

Whether replacing a legacy product with New-Scale SIEM, or complementing an ineffective third-party SIEM solution by adding the industry’s most powerful behavioral analytics and automation to it, Exabeam can help organizations achieve security operations success.

Exabeam customers are moving to and experiencing the benefits of New-Scale SIEM.

“Exabeam is our holistic security operations platform that provides and coordinates automated visibility, detection, analytics, investigation, and response across our key operating environments,” said Jerry Larsen, IT Security Manager, Patrick Industries. “We have several ERP systems that all need to be protected and Exabeam does the job better than any legacy SIEM we looked at –– we’re excited to be an Exabeam customer and part of their innovation machine.”

“At NEC Australia, securing our data, users, devices and infrastructure are paramount to how we operate as a technology company. Having broad and accurate visibility of our IT environment as well as the ability to recognise what’s normal behavior for our users and entities is key,” said Peter Fröchtenicht, National Service Manager – Security and Compliance, NEC Australia. “Deploying Exabeam’s SIEM has enabled our team to effectively prioritize security alerts, which has freed up time for our analysts to focus on other security tasks, whilst also having a greater understanding of our attack surface and how all our employees interact with our resources.”

New Exabeam products include:

  • Exabeam Security Log Management - Cloud-scale security log management to ingest, parse, store, and search log data with powerful dashboarding and correlation.
  • Exabeam SIEM - Cloud-native SIEM at hyperscale with fast, modern search, and powerful correlation, reporting, dashboarding, and case management.
  • Exabeam Fusion - New-Scale SIEM™, powered by modern, scalable security log management, powerful behavioral analytics, and automated TDIR.
  • Exabeam Security Analytics - Automated threat detection powered by user and entity behavior analytics with correlation and threat intelligence.
  • Exabeam Security Investigation - TDIR powered by user and entity behavior analytics, correlation rules, and threat intelligence, supported by alerting, incident management, automated triage, and response workflows.

Exabeam architected its new security operations platform and New-Scale SIEM product portfolio on Google Cloud (NASDAQ: GOOGL).

“We are delighted that Exabeam has built its platform and portfolio of products on Google Cloud to help more companies securely leverage their data at cloud scale,” said Gerrit Kazmaier, Vice President and General Manager, Data Analytics and Business Intelligence at Google Cloud. “The combination of Exabeam cybersecurity products with Google's Data Cloud capabilities removes limits on security team productivity, storage, and speed to fully optimize security operations.”

About Exabeam
Exabeam is a global cybersecurity leader that created New-Scale SIEMTM for advancing security operations. Built for security people by security people, we reduce business risk and elevate human performance. The powerful combination of our cloud-scale security log management, behavioral analytics, and automated investigation experience gives security operations an unprecedented advantage over adversaries including insider threats, nation states, and other cyber criminals. We Detect the UndetectableTM by understanding normal behavior, even as normal keeps changing – giving security operations teams a holistic view of incidents for faster, more complete response.

Spotlight

Welcome to IBM Tech Now, a bi-weekly series bringing you the latest and greatest IBM technology news and announcements.

Spotlight

Welcome to IBM Tech Now, a bi-weekly series bringing you the latest and greatest IBM technology news and announcements.

Related News

PLATFORM SECURITY,SOFTWARE SECURITY,WEB SECURITY TOOLS

Skyhigh Security Announces Achieving Amazon Web Services Security

Skyhigh Security | December 28, 2022

Skyhigh security, a leading data security solutions provider, recently announced receiving Amazon Web Services (AWS) Security Competency accreditation in the infrastructure security industry. This distinction recognizes Skyhigh Security's extensive technical expertise in AWS and proven success in its ability to assist customers in achieving their cloud security objectives. Achieving AWS Security Competency distinguishes Skyhigh Security as a member of the AWS Partner Network (APN) that offers specialized software to assist organizations in adopting, developing, and deploying complex security projects on AWS. To achieve the distinction, APN Partners must have in-depth knowledge of AWS and provide solutions on AWS effortlessly. AWS delivers scalable, versatile, and cost-effective solutions to startups and large-sized organizations. To enable the seamless integration and implementation of these solutions, AWS launched the AWS Competency Program to assist customers in identifying consulting and technology APN Partners with extensive industry knowledge and expertise. AWS users can buy the entire Security Service Edge (SSE) portfolio of Skyhigh Security through the AWS Marketplace, which enhances the efficiency of the procurement process and provides flexible licensing options. The company's SSE portfolio is cloud-native, designed from the bottom up with Zero Trust principles, and includes a unified data loss prevention and policy engine. Skyhigh SSE contains, Skyhigh Cloud Access Security Broker, Skyhigh Secure Web Gateway, and Skyhigh Private Access, among other products, offering one of the most extensive portfolios in the market. About Skyhigh Security Based in California, U.S., Skyhigh Security, a provider of a complete, market-leading data security platform built on a modern cloud stack, focuses on helping customers protect the world's data. It protects businesses with data-aware and user-friendly cloud-native security solutions. Its industry-leading Security Service Edge (SSE) portfolio extends beyond data access and focuses on data use, enabling enterprises to communicate from any device and location without compromising security.

Read More

DATA SECURITY,PLATFORM SECURITY,SOFTWARE SECURITY

Sevco Security Introduces First Cybersecurity Asset Attack Surface Dashboards

Sevco Security | December 14, 2022

Sevco Security, the cloud-native security asset intelligence platform for enterprises that want an accurate IT inventory, today introduced the industry’s first cybersecurity asset attack surface analytics dashboards. The new dashboards extend the Sevco platform to give CISO and IT leaders deep insights into the security coverage and state of their IT assets, enabling security teams to identify and eliminate security gaps in the enterprise cyberattack surface. Enterprise environments increasingly include a wide range of hardware, software, mobile devices, cloud infrastructure, and other IT assets as the fundamental backbone for operating the business and engaging with customers. However, with management of assets often spread across departments and geographies, it has become increasingly difficult for executive leadership to understand the security state of all their assets and to maintain accuracy in a dynamic environment. Equally challenging is the inability to gain insights into abandoned or stale IT assets to effectively mitigate the security risks that they introduce. Complex enterprise environments are increasingly experiencing incomplete security coverage with upwards of 19% of assets that have missing or stale security controls like endpoint protection and patch management. The new Sevco Security dashboards fill a critical gap in cybersecurity attack surface management by providing context-based analysis of enterprise-wide assets that surfaces risks associated with IT hygiene, compliance, and policy enforcement. “As organizations innovate and expand their asset footprint, they must have seamless visibility into the security state of their assets because they cannot manage what they cannot measure. “Sevco Security delivers the critical data for CISOs to thoroughly understand their cybersecurity asset attack surface and confidently report their defensive security posture to the board.” J.J. Guy, co-founder and CEO of Sevco Security With the new expansion to its platform, Sevco Security provides customers with data rich and customizable dashboard reports, including: Security coverage: Provides critical insights on asset security controls, allowing customers to identify gaps in coverage and proactively protect the previously unknown attack surface. This also empowers companies to manage internal governance and regulatory compliance requirements to monitor and validate that their security investments are fully deployed. Asset snapshots: Captures the detailed attributes of the assets across the infrastructure, such as IP address, user, and operating system so customers can quickly see the state of any device at any point of time. With asset snapshots, incident response and IT team members can quickly identify when an asset change occurred and manage decisions on restoring an asset to a previous state. Timeline trending: Enterprise assets are tracked on a daily trendline empowering IT and security leaders to gain context of what’s typical for their environment and to readily view spikes and outlier activity. Out-of-the-box trending data is automatically captured for total devices, new devices, inactive devices in the last 15 days, total users, and new users. Custom, interactive dashboards: In addition to the pre-built dashboards, users can create and save unlimited queries on their asset telemetry to produce customized insights dashboards. This puts asset data analysis at users’ fingertips, providing an easy way to obtain tailored insights in a top-level dashboard. All dashboards are interactive, allowing users to ‘click’ and drill deeper into the data for pinpoint clarity on a particular area of interest. Complex asset environments are a normal operating fabric for businesses. Sevco Security is dedicated to helping organizations capture a comprehensive view of their asset ecosystem and readily identify and address any security risks they pose. The new cybersecurity asset attack surface dashboards are now available to customers. About Sevco Sevco Security is the cloud-native security asset management platform for enterprises that require an accurate IT inventory. Its patented telemetry technology creates a unified inventory that is updated continuously to deliver real-time asset intelligence and help security and IT teams identify and close their previously unknown security gaps. Founded in 2020 and based in Austin, Texas, Sevco is backed by SYN Ventures, .406 Ventures, Accomplice and Bill Wood Ventures.

Read More

PLATFORM SECURITY,SOFTWARE SECURITY,END POINT PROTECTION

Wallarm Announces the Early Release of Its Enhanced API Security Technology

Wallarm | January 23, 2023

Wallarm, a leading end-to-end API security provider, has recently announced the early release of the Wallarm API leak management solution, an improved API security technology designed to assist organizations in identifying and remediating attacks exploiting leaked API keys and secrets while also providing ongoing protection against hacks in the event of a leak. Given the recent increase in hacks involving leaked API keys and other API secrets, Wallarm developed the API leak management solution in order to give a comprehensive solution for this issue by automatically detecting leaked API keys and secrets, implementing controls to prevent their use, and protecting against any follow-on attacks. As a result, it prohibits unwanted access to sensitive data within enterprises while also protecting their internal operations and customers from unauthorized use of that data. With the average cost of an API leak incident being $1.2 million per year, protecting API keys is a security and financial need. However, as locating and revoking API keys is both time-consuming and resource-intensive, Wallarm's proactive API leak management solution focuses on automated detection, remediation, and control using a three-pronged approach: Detect - Wallarm automatically searches public sources for leaked API secrets, which hackers can discover and exploit in under a minute. Remediate - Regardless of protocol, Wallarm immediately blocks requests that use compromised API secrets across the entire API portfolio. Control - Wallarm also continuously monitors and prevents the use of leaked API secrets. The Wallarm API leak management solution is the first of its kind in the API security space and is coupled with other Wallarm capabilities such as API threat prevention, API discovery and cloud-native WAAP. Wallarm’s API security platform provides customers with full-spectrum visibility, detection, and security for their entire web application and API portfolio, regardless of protocol or environment. This minimizes tool sprawl and costs while also increasing risk management and fostering innovation. About Wallarm Wallarm, founded in 2016, provides End-to-End API Security solutions to safeguard web applications, APIs, microservices, and serverless workloads in cloud-native environments. With its commitment to developing the cybersecurity industry, it has designed a new security platform to defend tech firms and Global 2000 enterprises throughout their journey from their legacy apps to APIs in cloud-native infrastructures. Hundreds of Security and DevOps teams use Wallarm to discover all of their web apps and API endpoints, traffic flows, and sensitive data consumption for total visibility, secure their whole API portfolio against emerging risks, and respond to incidents automatically for better risk management.

Read More