Endace Packet Forensic Files: Episode #2

Original Entry by : Michael Morris

Michael talks to Doug Hurd, Senior Business Development Manager at Cisco Systems Security Solutions

By Michael Morris, Director of Global Business Development, Endace


Michael Morris, Director of Global Business Development, Endace

Tune for the latest episode of Endace Packet Forensic Files vidcast series with this week’s guest Doug Hurd, Senior Business Development Manager at Cisco Systems Security Solutions.

Doug shares experience and insights on some of the most robust security stacks by best in class companies.  He talks about some of the techniques companies are implementing to handle the sheer volume of threat alarms and efficiently work through them.

Finally, Doug shares his insights into where companies – and vendors – are heading to help security teams stay in front of the latest cybersecurity threats.


Endace Packet Forensics Files: Episode #1

Original Entry by : Michael Morris

Michael talks to Justin Fier, Director of Cyber Intelligence at Darktrace

By Michael Morris, Director of Global Business Development, Endace


Michael Morris, Director of Global Business Development, Endace

Join the new Endace Packet Forensics Files vidcast for an informative session with guest, Justin Fier, Director of Cyber Intelligence at Darktrace.

Justin shares his experience with the challenges SecOps teams are facing from the Covid-19 Pandemic and the massive shift to a remote workforce. Hear how cyber AI, anomalous network detection, and packet forensics can help you stay ahead of the latest threats.

Justin’s insights into industry verticals like Finance, Healthcare, and Government reveal the unique changes and challenges these environments are facing, and some of the best practices he is seeing to address those challenges.


Endace + XSOAR = Nirvana for the SoC

Original Entry by : Cary Wright

Integrating Palo Alto Cortex XSOAR with the EndaceProbe Analytics Platform

By Cary Wright, VP Product Management, Endace


Cary Wright, VP Product Management, EndaceThis week we are announcing an exciting integration with Palo Alto Networks Cortex XSOAR, formerly Demisto. This integration provides XSOAR customers with automated playbooks that easily pull in packet-level evidence for fast, conclusive, and repeatable response to security incidents. This integration complements our existing partnership with Palo Alto Networks NGFW and Panorama so now you can access packet-level data across multiple Palo Alto solutions.

So what is this “Nirvana for the SoC” we are all striving for?

The most effective SoC teams I’ve seen are well-oiled machines, reviewing and resolving many potentially dangerous security incidents each day and neutralizing threats quickly and confidently. What makes these teams successful is a repeatable and well-understood process, based on evidence, backed by automation, with integrated workflows across a suite of best in class security tools.

These teams have a wide range of experience–from new recruits to seasoned experts–all highly motivated and working collaboratively to solve complex issues. This exceptional environment not only provides high levels of productivity and security, but it also is great for team morale, staff retention, and hiring. Adding new staff is streamlined because all the processes are documented and/or automated, workflows are simple, and less experienced hires can contribute quickly. I am sure you would agree this is the SoC team Nirvana that we are all striving for?

SoC teams are flying blind without network packet history at their fingertips. Sophisticated attackers do their best to cover their tracks by modifying server logs or deleting evidence. However,   packets don’t lie and can’t be tampered with. That’s why many SoC teams deploy EndaceProbe alongside their firewalls so they can turn to the packets to investigate their most challenging security incidents. It’s the evidence needed to know without a doubt what happened at 2pm last Tuesday afternoon when a security alert indicated a potential attack.

We integrated with Cortex XSOAR because we realized that many teams were missing the essential packet-level evidence required for fast and conclusive security investigations. XSOAR playbooks now automate the collection of packet evidence from any EndaceProbe in the deployment. Packet evidence is then archived and attached to a “case” or “war room” allowing multiple team members to contribute to the investigation at any time in the future.

The complete workflow can be integrated with the entire security tool suite including endpoint, network, SIEM, NGFW, and other security elements. And finally, these playbooks can be customized to suit the specific needs of the organization.

Check out the demo video on Palo Alto Network’s Fusion partner page to see this integration in action, and reach out if you’d like more information.

I am very proud of what our team has achieved with this integration to Cortex XSOAR. Our customers can now manage alerts across all sources using a standard process, take action on threat intel, and automate response for any security use case – resulting in significantly faster responses that require less manual review. I’m really looking forward to seeing our customers take advantage of this new capability to create their own SoC team Nirvana.

Happy hunting,

Cary