ABA brings together machine learning and human expertise

Rapid7 has introduced a new capability, Attacker Behaviour Analytics (ABA), in its InsightIDR solution. Attacker Behaviour Analytics are detections that reveal unknown variants of successful attacker techniques, and are continually crafted by Rapid7’s global security analysts and threat intelligence teams. With ABA, InsightIDR customers directly benefit from this stream of intelligence from Rapid7 SOCs, resulting in earlier attack chain detection and faster possible response to evolving attacks.

  • 6 years ago Posted in

In order for a modern SIEM to be trusted as the heart of an incident detection program, it needs to collect and centralize the right data, apply the right analytics, and explain why the output is meaningful,” says Rebekah Brown, Threat Intelligence Leader at Rapid7.  “Technology is a great start, but security still requires a persistent focus on human adversaries. Attacker Behaviour Analytics allows our security analysts and threat intel teams to share what we are seeing on the frontlines automatically with all of our InsightIDR customers. Organisational blue teams don’t just want defence-in-depth, but expect agile detection engineering and guidance around adversary intent, capability, and opportunity. Now that our SOCs can directly contribute to InsightIDR, if we identify a novel attacker technique, we can push out a new detection to be automatically matched against customer data in hours.”

 

With the addition of ABA, all InsightIDR customers will automatically receive high-fidelity alerts on evolving attacker behaviours built from thousands of incident investigations, including the use of fileless malware, cryptojacking, and spear phishing. When these malicious techniques are identified, alerts highlight notable behaviour from the affected user and asset, making it significantly easier for security teams to respond quickly and with confidence.

Research shows ‘game needs to be changed,’ with security innovation years behind that of the...
73% of organizations lack automated patch management, and 62% experienced incidents involving...
Quest Software has signed a definitive agreement with Clearlake Capital Group, L.P. (together with...
Dell EMC PowerProtect Cyber Recovery for AWS provides a fast, easy-to-deploy public cloud vault to...
Aqua’s cloud native application protection platform becomes the only solution that protects cloud...
54% of organisations working on a security transformation project now or in the next 12 months.
Node4 has released its Mid-Market IT Priorities Report 2021. The independent report reveals that...
Zscaler Zero Trust exchange cloud-based architecture enables superior green security capabilities...