Blueshift_Cybersecurity

Network Detection & Response

Extend packet layer detection and response to any device connected to the network. Ideal for detecting advanced threats that bypass EDR or the Firewall and for protecting devices that cannot support an agent.

Request Info >

Cyber Threat Edge Node

The Cyber Threat Edge Node inspects and logs every data packet moving into and out of your network and applies advanced threat intelligence, intrusion detection, deception technology, and network security monitoring to detect and block threats.

Learn More >

Threat Intelligence

Threat Intelligence data is gathered via automaton in our SOC. These lists are composed of de-duplicated, filtered and enhanced lists from public, private, internal and government sources. Our end result threat intelligence list contains 500 million plus indicators of compromised infrastructure, botnets, command and control servers, etc.

Learn More >

Intrusion Detection & Prevention

As packets are ingested into the system, they are inspected by an Intrusion Detection System (IDS) looking for threats, anomalies, misconfigurations, protocol mismatches, data exfiltration and other indicators of compromise.

Learn More >

External Deception

The Cyber Threat Node has the ability to provide deception nodes, both externally and internally. Deception is a very high quality, low false positive (zero or close to zero) indicator of nefarious activity on the network.

Learn More >

Internal Deception

In addition to external deception, we can also run deception internal to the network. We have several deception models as shown below that can run internally. Internal deception events trigger an immediate alert to the SOC.

Learn More >

Network Security Monitoring

Since every packet is inspected, the metadata and flow data of every packet and conversation is stored in the storage/ search engine. This allows the system to run non-signature based anomaly detections, such as Domain Generation Algorithm detection, and Malware Beacon analysis using machine learning and Fast Fourier Transforms (FFTs).

Learn More >

TESTIMONIALS

Blueshift simplifies compliance initiatives and extends security visibility and management across an entire organization. It integrates with all existing devices, data and systems across the network. That includes cloud, IoT, endpoint, server, remote workers and more.

ChannelFutures.com

Adding Zero-Trust data protection to the Blueshift XDR platform means that files remain encrypted and only accessible by trusted users, wherever they go: endpoints, cloud, NAS, anywhere. Cigent’s integrated controls defend sensitive data from zero-day ransomware, advanced malware, fileless malware, living-off-the-land, zero-day, supply chain, firmware, unpatched software, and social engineering attacks.

IndustryToday.com

Another Blueshift innovation has been to integrate zero-trust data protection with its XDR platform. Zero-trust data protection can force the protection of files during a security incident so that only authorized users with proper multi-factor authentication can access them. This helps reduce the risk that the data is exfiltrated or encrypted during an incident.

VentureBeat.com

EBOOK DOWNLOAD

THE CASE FOR

BLUESHIFT XDR

Learn how Blueshift’s Comprehensive Cybersecurity Operations protect all devices and data across your entire IT infrastructure, including in-depth information Blueshift’s:

  • Cyber Threat Edge Node
  • Unlimited On-Prem Security Log Retention
  • Threat Intelligence
  • Intrusion Detection & Prevention
  • External Deception
  • Internal Deception
  • Network Security Monitoring

CYBER THREAT

EDGE NODE

The Cyber Threat Edge Node inspects and logs every data packet moving into and out of your network and applies advanced threat intelligence, intrusion detection, deception technology, and network security monitoring to detect and block threats. Automation reduces alerts to the SOC.  

THREAT

INTELLIGENCE

Threat Intelligence data is gathered via automaton in our SOC. These lists are composed of de-duplicated, filtered and enhanced lists from public, private, internal and government sources. Our end result threat intelligence list contains 500 million plus indicators of compromised infrastructure, botnets, command and control servers, etc. 

This list is updated in our SOC every hour and the nodes pull this threat intelligence data every hour. Attempts to communicate to the infrastructure on this list will be blocked by our detection algorithms. Aggregated attempts from the same endpoint(s) to communicate with infrastructure on this list will result in an alert being sent to the SOC for investigation.

INTRUSTION DETECTION

AND PREVENTION

As packets are ingested into the system, they are inspected by an Intrusion Detection System (IDS) looking for threats, anomalies, misconfigurations, protocol mismatches, data exfiltration and other indicators of compromise. The IDS does NOT break or inspect SSL/TLS encrypted traffic, but the system does fingerprint SSL/TLS/encrypted traffic in order to detect anomalies in encrypted traffic. Signatures for the IDS are managed in our SOC, updated every hour. 

Signatures are a combination of public, private, and Blueshift-specific signatures and classifications. Signatures and classifications are pulled from the SOC by the node every hour. Blocking on IDS results are done via a proprietary algorithm that runs every 60 seconds. Aggregated IDS alerts for network devices are sent to the SOC for analysis and investigation. 

EXTERNAL

DECEPTION

The Cyber Threat Node has the ability to provide deception nodes, both externally and internally. Deception is a very high quality, low false positive (zero or close to zero) indicator of nefarious activity on the network.  External Deception For customers who want to utilize this feature, we ask that they take a few commonly attacked services, like Remote Desktop Protocol (RDP), Telnet, FTP, and SIP (ports 3389, 21, 23, and 5060 respectively) and port forward those services from their firewall to our Cyber Threat Node. The Deception services are low-interaction, meaning that we are not trying to attribute behaviors or collect malware samples, we are simply looking for a complete TCP three-way handshake, and collecting the source IP addresses and destination port. Since there is no production or advertised use of these services, any connection to these services is malicious in nature (attack or reconnaissance). 

 

Once an attack is detected, the egress communication to that IP address is blocked, and the indicator is sent to our SOC via API, and this is added to our Threat Intelligence list—if an adversary attacks one customer, all of our customers are protected. In addition, the harder an adversary attacks with the detected indicators, the longer they stay blocked in our feeds. As adversaries move onto newly compromised infrastructure, the unused indicators decay off of our lists. Utilizing this method of deception also protects our customers from Open Source Intelligence (OSINT) such as shodan.io, since these are always caught and blocked by our deception services.

INTERNAL

DECEPTION

In addition to external deception, we can also run deception internal to the network. 

Internal deception events trigger an immediate alert to the SOC. The system can also be configured to block all egress (Internet) traffic from the offending internal device as an automated response should the customer require such a response. Internal deception is again a very low false positive, high quality, non-signature based indicator of nefarious activity on the network.

NETWORK SECURITY

MONITORING

 Since every packet is inspected, the metadata and flow data of every packet and conversaton is stored in the storage/ search engine. This allows the system to run non-signature based anomaly detectons, such as Domain Generaton Algorithm detecton, and Malware Beacon analysis using machine learning and Fast Fourier Transforms (FFTs). In additon, the NSM aspect of the system combined with the storage/search engine enables our SOC to perform network forensics and threat huntng when investgatng alerts and anomalies.

 

Since every packet is inspected, the metadata and flow data of every packet and conversation is stored in the storage/ search engine. This allows the system to run non-signature based anomaly detections, such as Domain Generation Algorithm detection, and Malware Beacon analysis using machine learning and Fast Fourier Transforms (FFTs). In addition, the NSM aspect of the system combined with the storage/search engine enables our SOC to perform network forensics and threat hunting when investigating alerts and anomalies.

Types of Network events that are monitored by the SOC include, but are not limited to:

  • Threat Intelligence Events
  • Intrusion Detection Events
  • Deception Events
  • Network Behavior Change Events
  • Anomaly Events (network and protocol)
  • Scanning Events
  • DNS Anomaly Events
  • TLS Anomaly Events
  • Plain Text Credential Transmission
  • Cloud services usage

REQUEST INFORMATION

Blueshift_Cybersecurity
Blueshift_Cybersecurity

XDR Suite

Compliance

Partners

Resources

About

Contact

Linkedin

© Blueshift Cybersecurity 2024