™

DATASHEET

Build Effective
CywareThreat DefenseIntelligence
AgainsteXchangeThreats
Using(CTIX)
Zscaler

An Any-to-Any
Accessclear insights
ThreataboutIntelligencesuspicious
Analysisdomains,and Sharing
URLs, andPlatform
Hashes to block threats,
associated with your digital assets, using Zscaler enrichment.

Cyware Threat Intelligence eXchange (CTIX) can
automatically ingest threat data from a multitude of sourcesin different formats and allows analysts to get a holistic
view of the threats relevant to the organization from acentralized point. Zscaler brings in threat intelligence feedenrichment and equips organizations with the protection
they need to proactively detect, prioritize, and block
emerging threats before they turn into attacks that disrupt
business operations, compromise networks, and damage
brand reputation.

The integration
and analyze vast amounts of external interactions and suspicious
threat indicators targeting your organizations.

for the early detection and proactive
mitigation of targeted attacks in yourorganization.
Automatically update Zscaler withblacklisted and whitelisted URLs andallow securityteams to perform real-time
actioning to enable proactive blockingof threats.

intelligence received from Zscaler sources, both manually andautomatically, to add better context and allow analysts to makeinformed decisions.
Investigates threats with better context by querying Zscaler for
URL categories to identify the malicious nature of domains.

whitelisted URLs using CTIX rules.
Continuously evaluates confidence score for threat indicators
and automates threat blocking by enriching and pushing IOCs
organizations.
Cyware Labs | CTIX | Zscaler Datasheet

domains,andhashes

data lookup.

tocontext to the threat data available inCTIX by correlating them with Zscaler toidentify malicious URLs and investigate
confidently.
Security teams can perform contextual
analysis with the help of high-quality
indicator feeds and identify, prioritize,

Automatically updates the Zscaler database with blacklisted andURLs,

help of URL, Domain, and Hash threat

Security teams can add additional

Enhances and enriches internal intelligence and threatsuspicious

Tailored threat intelligence feeds allow

Real-time threat investigation with theAllows analysts to correlate threat data with additional insightsandCapabilities and Benefits

peer

and mitigate risks that target theirorganization’s network.
Attribute confidence score to indicatorsand enable analysts to make informed
decisions before executing actions todefend against threats.

Architecture

Enrichment

REQUEST

Incoming Intel

Incoming Intel

Incoming Intel

MD5APIURL

MD5, URLRESPONSE

Blacklist
URL

Highly Malicious URL

Update API

Whitelist
URL

Well Known URL

Update API

Orchestrate Intel with CSOL
Security teams can leverage Cyware Security Orchestration Layer (CSOL) as an end-to-end security orchestration layer andexpand CTIX-Zscaler integration capabilities to create specialized threat intelligence workflows. These workflows can becreated with the easy-to-use playbook builders or by modifying Cyware’s existing pre-built playbooks. CSOL offers
orchestration across deployment environments (cloud and on-premise) with automated playbooks, flexible APIs, and fullcustomization capabilities.
The Zscaler connector app in CSOL allows your security team to communicate with the Zscaler application to perform a
multitude of tasks and gain organization-wide visibility over malware threats.

About Zscaler
Zscaler is revolutionizing internet security with the industry’s first security-as-a-service platform, used by more than 5,000
leading organizations, including 50 of the Fortune 500. Zscaler is a Gartner Magic Quadrant leader for Secure Web Gateways and delivers a safe and productive internet experience for every user, from any device, and any location — 100% in thecloud. Zscaler delivers unified, carrier-grade internet security, next-generation firewall, web security, sandboxing/advanced
persistent threat (APT) protection, data loss prevention, SSL inspection, traffic shaping, policy management, and threat
intelligence — all without the need for on-premises hardware, appliances, or software.

™

Cyware®
1460 Broadway New York NY 10036
cyware.com | sales@cyware.com
Cyware Labs | CTIX | Zscaler Datasheet

855-MY-CYWARE
Cyware Labs |CTIX |

Cyware Threat Intelligence eXchange