threat-intelligence - Metrix Intelligent Solutions

Threat Intelligence

Detect emerging OT and IoT threats and vulnerabilities

Nozomi Networks Threat Intelligence continuously updates Guardian sensors with rich data and analysis so you can detect and respond to emerging threats faster.

Guardian correlates Threat Intelligence information with broader environmental behavior to deliver maximum security and operational insight.

Threat Intelligence provides continuously updated and detailed threat information.

Detect

Intelligence that Reduces the Mean-Time-to-Detect (MTTD)

Rapidly Detect Threats and Identify Vulnerabilities

Up-to-Date Threat Intelligence

Delivers continuously updated OT and IoT threat and vulnerability intelligence
Detects early stage and late stage advanced threats and cyber risks
Identifies assets at risk of attack with OT and IoT vulnerability assessment

Extensive Threat Risk Indicators

Provides detailed threat information:

Yara rules
Packet rules
STIX indicators
Threat definitions
Threat knowledgebase
Vulnerability signatures

Significantly Strengthen Your Security Posture

OT and IoT Threat Insights

Provides an accurate assessment of your security posture through full network visibility with integrated threat intelligence
Provides the information you need to effectively manage OT and IoT risks

High Performance for Fast MTTD

Conducts analysis on local Guardian physical and virtual appliances for accelerated threat detection
Delivers immediate, accurate alerts grouped into incidents for fast response

Respond

Detailed Alerts and Forensic Tools for Fast Response

Quickly Respond Using Detailed, Accurate Information

Accurate Asset Intelligence

Ensures up-to-date asset profiles through the expertise of Nozomi Networks Labs, a team of specialized security researchers
Delivers accurate profiles based on analysis of millions of devices in use at sites around the world and in Nozomi Networks test lab

Detailed, Helpful Alerts

Provides detailed alerts that pinpoint significant security and reliability anomalies
Groups alerts into incidents, providing security and operations staff with a simple, clear, consolidated view of what’s happening on their network

Swiftly Analyze Incidents and Simplify IT/OT Processes

Simplified IT/OT Security Processes

Reduces costs with a single, comprehensive OT and IoT anomaly detection solution
Integrates with IT security infrastructure for streamlined security processes.
Harmonizes security data across enterprise tools for cohesive response

Fast Forensic Analysis

Focuses effort with Smart Incidents™ that:
- Correlate and consolidate alerts
- Provide operational and security context
- Supply automatic packet captures
Decodes incidents with Time Machine™ before and after system snapshots
Provides answers fast with a powerful ad hoc query tool

Continuous threat research reduces response the time to detect active threats and vulnerabilities.

Threat Intelligence Feed is broken into several data sources and formats for a range of OT, IoT and ICS threats, source information and IOCs.

New Threat Intelligence Feed

Now available for third-party security platforms such as firewalls and orchestration products

Leverage Threat Intelligence Across Your Whole Environment

Open and Interoperable
Our Threat Intelligence Feed can be used outside our Guardian and Vantage platforms, with other third-party security products. This data feed can be used by any security platform that handles industry-compliant Structured Threat Intelligence eXpression (STIX) and Trusted Automated eXchange of Intelligence Information (TAXII) threat data, both of which are open data formats for threat details.

More Flexibility to Detect Emerging Threats
The feed delivers a single, unified source of data, including malicious IP addresses or URLs, new indicators of compromise (IOC) signatures, threat sources, malware hashes, and methods and tactics to gain system access. All these serve to accelerate incident response and enhance security operations.

One example use case involves feeding the Nozomi Networks threat data into Azure Sentinel SIEM to identify new IOCs. Then, a Security Orchestration, Automation and Response (SOAR) platform updates a Palo Alto Networks firewalls with new isolation rules based on the IOCs.

Let's get started

Discover how easy it is to anticipate, diagnose and respond to cyber threats and process issues before they impact your operations.