Threat Detection and Data Loss Prevention (DLP)

Never Miss an Attack or Data Leaving Your Network

1. Patented Deep Session Inspection® and  Deep Packet Inspection give you unique visibility across all ports and protocols into content and context in real-time
2. By collecting and storing all metadata traffic for months, you have retrospective analysis for automated security analytics on frequency and sequencing, machine learning anomaly detection, investigations, and improved threat hunting
3. Automatically discover and classify data, tag content and understand behavior anomalies to prevent unauthorized transfers out of your network, email and web traffic

Deep Visibility Across Your Security Stack

1. Gain visibility of all ports and protocols via DPI, DSI (Layer7), and PCAPs bi-directional analysis with full session reassembly in real-time
2. Protocol, application, and deep content decoding with recursive extraction
3. Place sensors across direct, internal, email, web and cloud traffic for wide visibility
4. Automatically profile assets and your cyber terrain
5. Benefit from structured and enhanced metadata for over 300 attributes, indexed for fast queries
6. Tag content with custom tags
7. Store metadata on-premises or in the cloud for 360+ days for retrospective analysis

Multiple defenses in one platform

1. Threat Prevention using static signatures, multi-dimensional behavior rules, threat intelligence feeds, plus emulation and heuristics
2. Threat intelligence open feeds (Fidelis Insight, Reputation, STIX/TAXII, YARA, Suricata) plus internal threat intel including custom rules and indicators
3. Threat hunting with real-time content analysis or retrospective indexed metadata supporting fast iterative and interactive queries to test hunting hypotheses
4. Data Leakage/Theft where direct and internal sensors drop sessions, email sensors quarantine, drop, re-route, or remove attachments, and web sensors redirect web pages or drop sessions
5. Profiling TLS encrypted traffic based on metadata and certificates, determining human browsing versus machine traffic, plus evolving data science models to detect hidden threats

See everything leaving the network

1. DLP using data profiling and classification with pre-built policies for known compliance regulations across network, email and web sensors to alert on policy violations
2. Email security including internal email spray attacks for cloud SaaS email or on-premises with pre-click URL analysis, attachment analysis, and OCR image to text analysis for data leakage
3. Security analytics based on high and low frequencies, plus sequencing analysis
4. Threat Detection using cloud-based sandboxing, network behavior analysis, new threat intelligence automatically applied to retrospective metadata, plus machine learning anomaly detection

Focus on what matters

1. Derive conclusions within one solution with aggregated alerts, context, and evidence
2. Expose misuse of assets and encryption, plus discover proxy and security circumvention
3. Zone in on what matters with risk scoring, behavioral and historical analytics, and policy and alert management
4. Integrate with your enterprise security stack with an open policy interface, and the ability to send alerts and data to your SIEM or SOAR

Work seamlessly to classify, prevent, detect, investigate and respond in one platform

1. With deception you can automatically profile your assets and deploy accurate deception decoys and breadcrumbs
2. Understand TLS encrypted traffic anomalies based on metadata and certificates, plus human versus machine traffic profiles to detect malware and C2 communications
3. Quickly search and query rich metadata stored on-premises or cloud from network sensors and endpoint agents, plus build and save advanced queries using Boolean logic, a step beyond faceted search
4. Automate detection, investigations and response with pre-built scripts and playbooks
5. Leverage open source threat intelligence and apply it across network sensors and endpoints