Real-Time IoB Threat Hunting

The Problem
Modern threat detection requires data – lots of data – typically from multiple sources. This brings with it a number of interesting data engineering challenges, especially when we want to materialize that data into a single view and execute analysis in a timely and cost-effective manner. Finding indicators of behavior (IoBs) in real time amplifies already significant challenges: processing enough of the right kind of data from multiple sources in a timely fashion is beyond the capability of most systems.
The Solution
Quine + Novelty Detector together cover all aspects of real-time, automated, behavior-based threat hunting: Quine is used to detect known patterns (STIX) and emit scripted playbook responses (CACAO), while Novelty Detector uses patented categorical anomaly detection techniques to identify emerging threat patterns that are eventually fed back into Quine as new IoB patterns. Quine Enterprise provides commercial support and licensing for both clustered Quine and Novelty Detector, meaning you can easily add real-time, behavior-based threat hunting to your stack easily.

Key Value Delivered

Quine + Novelty Detector detect both known and emerging behavioral patterns in a single workflow.
STIX Compliant, real-time detection of Indicators of Behavior (IoBs) and generation of STIX message events
Joins multiple data sets to enable real-time identification of IoBs across domains
Automate STIX indicator additions via API, as well as CACAO Playbook event triggers for remediation
Native support for categorical data simplifies operations and provides human-readable alerts for analysts

What people are saying

thatDot Platform’s advanced Novelty Scoring for categorical data feature is the future of anomaly detection. Its speed powers our new real-time services while also significantly reducing false-positive findings for our customers.

Gery Szlobodnyik

CEO

The security industry is headed towards leveraging knowledge graphs of all the relevant evidence provided by threat groups, network indicators and endpoint artifacts to quickly identify and mitigate threats. The security companies that can most confidently extract relevant context from these graph and then immediately action on findings to mitigate threats will be the winners. This is exactly the problem Quine aims to address.

Evan Wright

Staff Data Scientist

See for yourself

If you think Streaming Graph or Novelty might be for you, contact us to see them in action.

Real-Time IoB Threat Hunting

The Problem

The Solution

Key Value Delivered

Recent posts

Microservice Hell: The State of the Art in Streaming Services

4 Advantages to Streaming Analytics in Graph Form

Start building

Read the docs

View the demos

Join our community

What people are saying

See for yourself