Cysiv

24/7 SOC-as-a-Service with Managed Threat Detection & Response

SOLUTIONS

24/7 SOC-as-a-Service enables you to detect, investigate and respond to ransomware, malware, data theft, insider threats, spear-phishing attacks, advanced persistent threats, business email compromise (BEC), and more.

The Platform: 

• Connector – Most telemetry can be pulled from APIs or sent securely to Cysiv Command over the internet. For older sources, such as logs over Syslog UDP, Cysiv Connector provides an encrypted conduit for passing all required telemetry from your environment to the Cysiv platform. Learn More >

• SIEM / Data Lake – Our SIEM complements—or for some, can replace—an existing SIEM, providing core functionality:

  • Collects and normalizes events in real time from a broad range of security and infrastructure sources

  • Massively scalable, purpose-built, indexed data lake with tiered data storage (hot, warm, and cold) and rapid full-text search.

  • Provides historical analysis, visualizations and tiered data storage that optimizes performance and cost

  • Normalizes all formats to a common information model

• Threat Detection Engine – Cysiv’s threat detection engine applies a blend of detection techniques that leverage signatures, threat intelligence, user behavior, statistics, and machine learning to automatically identify potential threats and ensures analysts focus on the most critical detections first. Learn More >

• Security Orchestration, Automation & Response (SOAR) – Orchestrates the SOC process from detection through investigation and response with built-in case management, notifications and workflows. Provides security automation through multiple enrichment sources, including IP geolocation, user and asset information, and correlation to multiple intelligence sources.

• User and Entity Behavior Analytics (UEBA) – Behavior-based analytics are used to detect significant changes to behavior or anomalous activity for an entity. Standard profiles and behaviors are built for users and hosts across time, and any activity that is anomalous to these standard baselines is triggered as suspicious.

• Threat Intelligence – IOCs from dozens of high-quality sources worldwide are classified, corroborated, and scored to provide finished intelligence that is leveraged across the threat detection, hunting, and investigation process. Community threat exchange: Anonymized IOC data can also be shared amongst opt-in community members.

• Case Management – Provides workflow capabilities, tight integration, transparency, and seamless communication and collaboration during detection handling and incident management. Based on the NIST Incident Response Life Cycle, it supports integrations with third-party products including ServiceNow and RSA Archer.

• Dashboards & Compliance – Pre-configured and customizable dashboards provide key performance indicators relevant to a variety of roles, including analysts/IR, engineers, executives, SOC managers, and compliance/risk managers. Telemetry retention satisfies compliance requirements.

• Modern, next-gen SIEM platform – Cysiv has developed its own cloud-native, co-managed platform that is the foundation for its service. It is massively scalable and combines a number of essential technologies into a single SaaS. And because it supports multi-tenancy, it is uniquely well-suited to MSPs/MSSPs that need to deliver MDR, co-managed SIEM and other advanced managed security services to customers.
• Vendor-agnostic telemetry – The platform is vendor-agnostic and can ingest security telemetry from virtually any source, along with other important contextual and infrastructure data. This improves the quality of, and confidence in, the threats detected, and dramatically shortens the dwell time and mean time to detect (MTTD) threats, and investigate and respond to them.
• Detection Automation through Data Science – The Cysiv platform rigorously applies a comprehensive and blended set of advanced data science techniques to this telemetry and data to automate and accelerate the time-consuming, complex but critical tasks for truly effective threat detection, hunting, investigation, and response.
• Deep, collaborative expertise – Cysiv provides direct access to the critical skills, knowledge and expertise needed to complement an enterprise security team. Cysiv experts include security analysts and engineers, threat hunters and researchers, data scientists and engineers, and incident response specialists that work alongside your team, collaborating and sharing knowledge, to better protect your organization.
• Consumption-based billing – All of this is delivered with consumption-based, monthly billing. There is no CapEx or long-term fixed contracts. Customers pay in arrears for the services and licenses consumed and can quickly scale up, or down, to support phased deployment and changing business requirements.