Datasheet

Integrated Security Operations: Arista NDRwith Zscaler
Shared Intelligence to Lower Time to Detection and Response

Detecting and responding to an attacker’s tactics, techniques, and procedures (TTPs) benefits from a holistic view of everything that ishappening in your environment–starting with the network, which reveals the entire attack surface, like IoT devices, insider threats, lateral
movement, and privilege escalation to the edge and cloud often act as the initial entry point for attacks. The integration of Arista NDR withZscaler Internet Access (ZIA) enables effective defense-in-depth against even the most advanced cyber threats.
The Arista NDR platform, named a leader in the Network Detection and Response market by Forrester, integrates easily with Zscaler
Internet Access to provide comprehensive threat detection, rapid and effective response as well as containment and forensic analysis
capabilities. This combination delivers visibility for threats across both north-south and east-west attack paths and helps customers
strengthen their security posture across the enterprise. The integration of network detection and response (NDR) with the security serviceedge (SSE) also drives zero trust maturity, ensuring organizational security policies are enforced whether users and devices are on or offpremises.

Better Together: The Benefits•

Visibility & detection irrespective of where the users or devices are located•Threat intelligence sharing ensures rapid enterprise-wide risk mitigation•

Automated blocking of command and control and data exfiltration helps lower the impact of threats like ransomware

The Strengths of Each Platform

The Arista NDR platform provides broad context beyond
managed endpoints to the 50+% of unmanagedinfrastructure. Arista NDR thus provides a complete viewof the potential attack surface and the business assets thatare part of it. By observing and analyzing every behavior on
the network, Arista NDR tracks assets as they move acrossyour network. It autonomously builds an understanding of
the relationships and similarities between entities and thus
detects threats, reacting within seconds if necessary.

arista.com

Zscaler Internet Access (ZIA) includes a comprehensive suiteof AI-powered security and data protection services to helporganizations stop cyberattacks and data loss. ZIA
dynamically computes a risk score and then inspects traffic
inline to secure users as well as workloads and IoT/OTdevices as they access the internet or SaaS destinations.

Datasheet

How They Complement Each OtherWith this integration, alert categorization and domain intelligence data from Zscaler are factored into Arista NDR’s risk analysisof north-south traffic. This enables Arista NDR to quickly detect attacker command and control infrastructure as well as data
exfiltration. Similarly, intelligence about domains identified as malicious within the customer’s network is shared by Arista NDR
with ZIA, enabling the blocking of malicious inbound and outbound access not just for the initial victim but across the rest of theorganization’s digital assets.
Arista NDR’s network visibility picks up east-west behaviors like lateral
movement, credential abuse, and privilege escalation that stay purely within
the organization’s internal network. For example, in a recent attack, Arista
NDR discovered a compromised device performing credential brute force
on the internal network as part of a larger ransomware threat. By working in
conjunction with Zscaler, Arista NDR prevented the device from engaging incommand and control as well as any potential data exfiltration. Moreover, thisalso allowed the attacker infrastructure to be blocked at the perimeter from all
corporate devices and users.

The Devil in the Details: An Integration Case Study
Automatically view a timeline of the breach.
Arista NDR automatically constructs a forensic timeline showing the series ofactivities flagged for the device in question as well as the broader attack map thatidentifies the entire kill chain along with other devices, destinations, and activitiesrelevant to the investigation.
Ingest global classification and custom category data from ZIA.
Domain intelligence data from ZIA is ingested into Arista NDR and is factored into therisk analysis as well as to identify stages in the attack lifecycle such as command andcontrol and data exfiltration.

arista.com

Datasheet

Mitigate risk enterprise-wide
The integration also enables one-click risk mitigation to block access to any other domains identified as malicious. This extends
protection to the entire enterprise, not just for the initially compromised device.

Get Started — Set Up the Integration to Get a Holistic View of Your Environment
Setup the integration in two quick steps:

1. Obtain an API key, URL, Username andpassword for your ZIA deployment.

Santa Clara—Corporate Headquarters
5453 Great America Parkway,
Santa Clara, CA 95054
Phone: +1-408-547-5500
Fax: +1-408-538-8920
Email: info@arista.com

2. Arista NDR’s customer success handles
the rest to turn on the integration.

Ireland—International Headquarters
3130 Atlantic Avenue
Westpark Business Campus
Shannon, Co. Clare
Ireland

India—R&D Office
Global Tech Park, Tower A, 11th Floor
Marathahalli Outer Ring Road
Devarabeesanahalli Village, Varthur Hobli
Bangalore, India 560103

Vancouver—R&D Office
9200 Glenlyon Pkwy, Unit 300
Burnaby, British Columbia
Canada V5J 5J8Singapore—APAC Administrative Office
9 Temasek Boulevard#29-01, Suntec Tower Two
Singapore 038989

San Francisco—R&D and Sales Office 1390
Market Street, Suite 800
San Francisco, CA 94102

Nashua—R&D Office
10 Tara Boulevard
Nashua, NH 03062

Copyright © 2023 Arista Networks, Inc. All rights reserved. CloudVision, and EOS are registered trademarks and Arista Networks
is a trademark of Arista Networks, Inc. All other company names are trademarks of their respective holders. Information in thisdocument is subject to change without notice. Certain features may not yet be available. Arista Networks, Inc. assumes noresponsibility for any errors that may appear in this document. 10/23

arista.com