Early Access introduces additional annotations for customers using AMP for Endpoints
Customers using AMP for Endpoints and sending proxy logs to Cognitive Intelligence now have the option to enable Early Access!
Enabling Early Access unlocks a new view in Cognitive Intelligence for both Detected and Confirmed threats. This provides additional descriptions for anomalies that elaborate not only on the machine learning outcomes, but also the several layers of inference that are used to reach that verdict.
This additional information provides context about the capabilities and potential risks of the attack, information obtained by passive DNS, user statistics, details on the attack technique used, specific triggers or IoCs that have raised the alarm, components of the Global Risk Map, and others.
The Cognitive Intelligence research team enabled annotations for a subset of threats that are more critical and can benefit from additional context. Approximately 60% of all incidents are showing additional annotations, and we’ll continue to steadily increase this percentage.
New annotations are provided with these anomalies for customers using AMP for Endpoints with Early Access enabled:
- Known malicious hostnames
- Known malicious domains
- Known malicious IP addresses
- Typosquatted hostnames
- Punycode‐substituted hostnames
- Combosquatted hostnames
Stealthwatch customers can see annotations for more threats
Additional annotations have been added for Stealthwatch customers with Early Access enabled:
- Stratum protocol communication
- Known stratum protocol services
- Known Sality URL pattern
- RESP communication
- Uncommon executable download
- ICMP communication
- Large data transfers will be explained with the IP address the endpoint is connecting to and the amount of traffic exchanged.
- Typosquatted hostnames
- Punycode‐substituted hostnames
- Combosquatted hostnames
Leveraging Cognitive Intelligence
Cognitive Intelligence capabilities are available to AMP customers with a compatible web proxy such as the Cisco Web Security Appliance, and all Stealthwatch Enterprise customers. Reach out to your account executive to learn how to turbocharge your existing cybersecurity investment with Cognitive.
2 Comments
