ESET is expanding its Threat Intelligence portfolio with Investigation Lab. The service lets security analysts check indicators and suspicious files against ESET telemetry and threat intelligence. It combines IOC searches with sandbox analysis and is aimed at SOCs, CERTs and MSSPs. Access is provided through the ESET TI portal and an API.
ESET is positioning Threat Intelligence Investigation Lab as a second opinion for analysts who need to assess suspicious activity. The service builds on telemetry and threat intelligence that the company gathers itself. ESET says it will help analysts make better-informed decisions and determine more quickly which incidents require immediate attention.
Roman Kováč, Chief Research Officer at ESET, says security teams encounter suspicious files and indicators of potential attacks every day. In his view, they need to establish quickly what is going on, while taking privacy into account. Kováč says Investigation Lab focuses on three questions: is something dangerous, where has the threat been seen before, and what is the next step. According to Kováč, the service makes ESET’s telemetry data more accessible to customers and adds information about the behaviour of potential threats. On that basis, teams can decide whether to block a threat, investigate further, escalate or close an alert.
Components from existing products
Investigation Lab combines technology from various parts of ESET. The service uses insights from ESET LiveGuard Advanced, the behaviour monitoring module within ESET PROTECT. According to the company, it also draws on the expertise of ESET Research and its own Threat Intelligence and MDR teams.
IOC Search and Sample Submission
The service consists of two functions that come together in a single workflow. IOC Search lets you check IP addresses, URLs, file hashes and domains. ESET compares this data against its own curated telemetry and threat intelligence.
Sample Submission lets you submit suspicious files for analysis. ESET runs these files in a sandbox, an isolated environment, and analyses the behaviour they exhibit there. The results are presented in reports that, according to the company, analysts can act on immediately.
By combining the two functions, ESET aims to shorten the path from an initial check to a follow-up action. Possible next steps cited by the company include gathering additional information, blocking threats, isolating affected systems, further investigation or closing an incident.
Target audience and integration
ESET is aiming Investigation Lab at Security Operations Centres (SOCs) of large organisations, government bodies, Computer Emergency Response Teams (CERTs) and Managed Security Service Providers (MSSPs). The company says the service integrates with existing Cyber Threat Intelligence solutions without requiring major changes to existing SOC processes.
The service is available as a separate component within the ESET Threat Intelligence portfolio. It can be used through the ESET TI portal or through an API, which allows other systems to exchange information with the service automatically. The company’s announcement says nothing about pricing or licensing models.
This article was originally published in Dutch on MSP Business. Read the original →
