#MicroFocusCyberSummit
Global Protection and Awareness through Data Analytics, Threat Detection and Pattern Recognition Charles Clawson, ArcSight Marketing Manager Steven Riley, ArcSight Technical Marketing Manager #MicroFocusCyberSummit
Visual Agenda Intelligent Security Security Operations Analytics Real time alerting & Data Analysis monitoring Log Management Discover Micro Focus Security strategy Intelligent SecOps use case & Maturity roadmap ArcSight Marketplace ArcSight ESM Security Analytics ArcSight Investigate 3rd party Activate Use case Threat Intel ArcSight Data Platform
Company Discover the New
The New Combined Company: Micro Focus Built on stability, acquisition and innovation Network Management/ COBOL Data Protector Years Years
Combined Micro Focus: An Industry Shaper Microsoft Oracle SAP $7.1 Salesforce $5.1 $4.9 $4.4 $4.0 $3.4 $3.3 Adobe Symantec #7 HPE SW / MF HPE SW / MF CA Gemalto Citrix Dassault $3.2 $3.1 $2.5 $2.5 $2.4 $2.3 $2.1 $2.1 $2.0 $2.0 $1.9 $1.9 $1.8 $1.7 $1.7 $1.4 $1.3 $1.2 $1.1 SAS #12 HPE SW HPE SW Infor Veritas Autodesk Synopsys CDK Global Red Hat Asseco BMC Nuance Constellation Open Text Cadence Check Point #26 Microfocus Micro Focus Workday ServiceNow Informatica
4 Focus Areas Four Focus Areas Security & Data Hybrid IT Predictive DevOps Management Analytics Management
Protecting Data Apps What Security Analytics Matters Most Users
One of the Worlds Most Powerful Security Portfolios
ArcSight Empowers Intelligent Security Operations
What Are the Top CISO Priorities Click icon to add picture Reduce business Decrease impacts of Detect and stop downtime and security events security threats non-compliance
Challenges to the Security Operations Center Limited detection Complex and slow Increasing rate and investigation of data response tools capabilities
Intelligent Security Operations Increase Speed, Simplicity and Effectiveness Across Entire Workflow Visibility Without Comprehensive Intuitive Boundaries Detection Investigation
ArcSight Drives Business Profits Open Comprehensive Intuitive architecture detection investigation Reduce data Reduce time Minimize risk and licensing and human and data loss costs struggle
All Departments Benefit Security & Risk IT operations Compliance & Legal Line of Business management
Proven, Accurate and Fast ArcSight Investigate ArcSight ESM ArcSight ADP
Open, Relevant and Intuitive ArcSight Investigate Investigation | Security Analytics ArcSight ESM Real-time correlation | Alerting | Workflow ArcSight Data Platform Connectors | Event Broker | Management | Logger
Security Operations Use Cases & Maturity Roadmap
Intelligent Security Operations – Use case Roadmap Intelligent Security Operations Security Analytics • Integrated monitoring • People & Process & • Behavior Profiling Technology • Threat detection Real time alerting • Efficiency & Resilience • Know the unknown & monitoring Data Analysis • Detect & identify • Respond in time • Forensics • Build workflow • Rapid Search Log Management • Reporting • Centralize Logs • Retain data • Compliance
Intelligent Security Operations – Capability Roadmap Analytics & SIOC ArcSight Investigate Intelligent Security ArcSight ESM Operations Security Analytics • Integrated monitoring • People & Process & • Behavior Profiling ArcSight Data Platform Technology • Threat detection Real time alerting • Efficiency & Resilience • Know the unknown & monitoring Data Analysis • Detect & identify • Respond in time • Forensics • Build workflow • Rapid Search Log Management • Reporting • Centralize Logs • Retain data • Compliance
ArcSight Data Platform Expand the visibility of your data
Visibility Without Boundaries Open architecture Integrate data lakes to maximize usage with security apps Scalability through Keep up with growing variety and velocity environments Faster detection with Real-time security business optics context
ArcSight Security Technology Partners DDoS Technology Partners Threat Application GRC Intelligence Security SIEM
ArcSight Data Platform in Nutshell Arcsight Management Console Event Broker Logger Connector Collect Enrich Distribute Retain Search Report
Data Retention (Logger) Cost-effective universal log management Unifies searching, reporting and analysis Scale 1M EPS in a 100 peers architecture 100 Concurrent search Performance Search speed improvements by 50-200% 10:1 compression ration to store up to 1200 TB Security Data at rest encryption on ADP appliances
Management Console – End to End Monitoring Topology view for consolidated overview Display device information on hover Sort devices by region / groups
Instant Connector Deployment ArcMC 2.70, Connectors 7.70 Benefit: Improve security administrator productivity by providing a quick and easy deployment option so that they onboard new data sources or readjust connectors deployment layout quickly with ease. Capability: Connector deployment on remote hosts through • ArcSight UI In-context deployment View UI • Re-usable deployment templates with • configuration values for source and destination Many Connectors to a single host • • Centralized management of long running deployment jobs 45
Enhanced Topology View ArcMC 2.70, Event Broker 2.10 Benefit: Improve analyst productivity by giving them a centralized monitoring tool so that they can optimize their time and do more with ease. Capability: View Event Broker topics in Topology view on • ArcMC Get visibility into consumer connectivity through • ArcMC 47
Logger 6.5 Updates Benefit: Easy to use Logger reporting tools with an enhanced UI help optimize analyst time and generate comprehensive reports and dashboards for compliance and other use cases Capability: Create Reports from Logger Queries • • Archives will include Indexes ADP Logger standalone mode: both for • appliances and software Complete support for SHA-2: receivers and • forwarders, archiving, SSL signatures • Complete support for TLS 1.2: peer communications, on-board connector • Dark Theme for Logger 48
Data De-identification for Privacy (GDPR, health..) Format Preserving Encryption by Voltage embedded john.doe@arcsight.com uwol.clu@qnmpdsaa.kle De-identify sensitive data Logger Source ArcSight Event data ESM Connector 3rd party
ArcSight ESM Comprehensive Detection
ArcSight ESM in Nutshell Detection Investigation Active 3rd party Case Enrichment Rules Engine Context Channel action Management • Asset Model • Real-time rules • Rich news feeds • Enrichment • Integration • Annotations Commands • Network Model • Data Monitors • Drill down • Baselines/ trends • Stages and • Action impact • Vulnerability • Prioritization • Visuals • Lists Connectors • Integration • Search • Partners 54
250 Ready Made, Tested and Documented Use Cases Activate use case configurator
Value for Everyone Openness • Detailed data • Increase TTV via source Marketplace content configuration • SOC Workflow SOC information Efficiency Engineer • Categorization + • Content Maintainability Manager Product Packages • Reduced Training Cost Content Analyst Author • Community • Actionable Output • Components & • Structured event Solutions handling • Methodology
4x more with same headcount ESM & Activate adoption increased SOC efficiency 4x
Activate Content Layers
ArcSight ESM with Fresh & Relevant Content Market-leading Real-time Activate example: Wanna Cry Dashboard released in few hours Correlation Threat Lifecycle Tailored use cases Central integration point for the SOC process Integrated SOC platform
Secure the New Voltage Fortify ArcSight Data Security App Security Security Operations NetIQ Identity 70
ArcSight Enterprise Security Manager (ESM) Summary Enriched Data Powerful Correlation Quick Detection Multi-tenancy
Threat Intelligence
Threat Intel context is the king! Who is behind this? Where is it comming from? How bad is it? Do we know them? Is it related to ..?
But what Threat Intel? 75
ArcSight Threat Intelligence Program Reputation Security Monitor Activate Threat Intelligence Currated list of malicious IPs and domains Open TI program for Activate use case
Activate TI Data Fusion Model 3 Track 2 Context 1 Populate 0 Ingest
Threat Intel Activity Dashboard 78
ArcSight Investigate
What Do We Need to Address These Challenges? Intelligent Threat Investigation Solution Act faster Work smarter Reach further
ArcSight Investigate Analytics optimized and robust engine Guided natural language search box Modern and intuitive data manipulations Powerful built-in analytics modules
Recommend
More recommend
