CASE STUDY

Deeptree Delivers Comprehensive
Security Services with Stellar Cyber
Open XDRWith Stellar Cyber, Deeptree Can “See More, Know More, Act Faster”
Headquartered in Alaska with offices in Montana and Puerto Rico, Deeptree is a managed
detection and response (MDR) provider that offers cyber defense, recovery and resilience
services to customers across the United States. Deeptree prides itself on offering holistic,
tailored security services to companies in finance, healthcare, education, manufacturing
and other sectors, combining the expertise of an enterprise-class security player withthe service dedication and agility to make white-glove services available to companiesof all sizes. Central to its security package, Deeptree uses the Stellar Cyber Open XDR(extended Detection and Response) platform to deliver world-class cybersecurity services
to its clients with a focused team of analysts.

“We know that cyberattacks are twice as likely to occur inAmerica as anywhere else and customers need a security
partner with the expertise to protect their entire attack surface
and who can dispatch to their location, no matter where it is”

B E F O R E

Scattered
Securitysiloed tools hinderedcorrelating detections

Restrictive
difficult to integrate
new capabilities

High Cost
cobbled together
solutions were expensive

W I T HS T E L L A R

C Y B E R

Scalablescales easily from small
to large customer accounts

MachineLearning
automatically correlate incidents tospot and evaluate potential threats

Streamlined
see everything and react quickly
with single pane of glass

Responsive
act faster than the competition“Because we have Open XDR, we now feel confident we can build extended
tools and integrate them into Stellar Cyber to meet new needs...”www.stellarcyber.ai | sales@stellarcyber.ai

Challenge: Delivering TailoredServices to Everyone
During the COVID-19 pandemic, companies have turnedmore to remote workforces to get the job done. And asexpected, this has broadened companies’ cyber attack
surfaces. With staff members predominantly using thecorporate VPN, network access control and user/entity
behavior analytics, in addition to standard defenses, areessential to defense. Workers aren’t protected solely by
the corporate systems anymore and the level of security athome is highly variable. Achieving a comprehensive view ofthe network is instrumental in defending the organization’s
assets and value streams during the pandemic. This is true
no matter how large or small one’s office is.
“We know that cyberattacks are twice as likely to occur in
America as anywhere else and customers need a security
partner with the expertise to protect their entire attack
surface and who can dispatch to their location, no matter
where it is,” said Peter House, CEO of Deeptree. “We offer
tailored, enterprise-class security services to everyone.
That’s the advantage of partnering with Stellar – scalability
means scaling up or down. And offering enterprise classsecurity to enterprises and their smaller partners alikemeans total coverage. When designing our offering, acriticism leveled at one operator was that some clientsfelt too small to matter. For our clients, we operate as
white glove is white glove as long as you’re a client.
The difference is in quantity not quality.”

Choosing a Solution
The selection process for a central tool for its Security
Operations Center meant that it needed to bypass the vicesof current solutions. According to House, “We knew thatjust acquiring a bunch of siloed security tools would leave“We knew that just acquiring a bunchof siloed security tools would leave
us with the problem of correlating
detections across tools...”us with the problem of correlating detections across tools.
That drives up operating costs and slows down process– leading to delayed response times. So we needed acomprehensive, best-in-class security platform that
integrated all of the important tools and allowed us tointegrate others as needed to meet the needs of specificcustomers. Healthcare and finance are two very different
industries, so they need different tool sets. Stellar gives us
the ability to meet those varying needs and still have asingle pane of glass.”
After evaluating major SOC vendors and finding themlacking features or being too restrictive when it came
to integrating new capabilities, the Deeptree team foundStellar Cyber. The Stellar Cyber Open XDR platform wasan ideal fit for Deeptree because it integrates key security
capabilities under one interface – including UEBA, EDR,NDR and SIEM – and it has open APIs that allow it toeasily integrate with third-party firewall, IDS, SIEM andother systems.
In addition, the Stellar Cyber platform leverages AI andmachine learning technologies to automatically correlate
incidents to spot and evaluate potential threats. It delivers
far fewer false positives, allowing Deeptree’s team ofanalysts to be far faster and more productive at finding andremediating complex attacks. With Stellar, Deeptree is able
to operate at the top levels of the Pyramid of Pain, whichhave proven very difficult to address.

www.stellarcyber.ai | sales@stellarcyber.ai

Open XDR: A Virtual Bouncer“We proudly use Volatility at Deeptree. And all operational“The Internet is porous,” says House. “With a firewall, it’s notlike you’re not behind a castle wall. It’s more like operating abar with a thousand doors. There’s a team of bouncers andthey gotta check everybody and their entourage. This isespecially so with COVID and remote workers. You need avirtual bouncer that sees everything and can react quickly.
To catch malware in a lie – you need to look at it throughviewpoints. That’s the Stellar difference – multiple
viewpoints. Single pane of glass.”

training. In one case, Stellar alerted us to a series of Event

UEBA is a cornerstone for this type of threat detection,and it’s tied to NDR because network traffic reveals attacks
other systems miss. Stellar Cyber’s NDR and UEBA
capabilities deliver insights that analysts can’t see with
a SIEM that simply analyzes logs. In one spear-phishingattack, for example, the malefactor knew a teacher andher students’ names, and sent an email supposedly fromanother teacher. Using Stellar Cyber, Deeptree detected
this ruse and responded immediately.
“Because we have a low footprint in terms of detection,
we can be much faster and better at responding,” says
House. “Ira Winkler said it best, ‘Protection will eventually
fail, no matter what’ – so one’s ability to respond is crucial.
It’s what separates amateurs from professionals.”
With Stellar machine learning driving the heavy lift of log
processing, Deeptree professionals are able to focus on
differentiating value. One such example is memory forensics.

“staff, including Tier I technicians, receive memory forensics
ID 4656 being a generated on a client host. As you know,
this is one of the EIDs in the cluster that Mimikatz will
generate. In under an hour, we were able to move fromalert to clearing the running process as legitimate.”

Looking Ahead
Thanks to Stellar Cyber’s Open XDR platform and its openAPIs, House feels he can use it as a central core aroundwhich he can build tailored security services for specifictypes of customers. This also expands Deeptree’s marketbecause it can identify new segments and add value forthem by cost- effectively integrating new tool sets.
“Because we have Open XDR, we now feel confident wecan build extended tools and integrate them into Stellar
Cyber to meet new needs. This gives us forward looking
confidence both from the perspective of the ever-evolving
space that is cybersecurity but also to changing market
needs,” says House.
House sees Stellar Cyber as a key to his growth and successbecause of its ability to integrate new tools and to spot andthwart attacks that other systems don’t see. “I forecast
Stellar Cyber’s Open XDR will be the major competitive
differentiator for us because it allows us to see more, know
more, and act faster than our competition.”

I forecast Stellar Cyber’s Open XDR will be the major competitive
differentiator for us because it allows us to see more, know more,and act faster than our competition.”

www.stellarcyber.ai | sales@stellarcyber.ai