SOLUTIONS

Deploy an Integrated Zero
Trust Architecture AcrossYour EnterpriseKEY BENEFITSCHALLENGE	Prevent ransomware
and common initialattack vectors

Protecting a distributed workforce that is pressed to innovate requires an efficientand effective approach. Today’s defenders face attacks across workspace, identity,and endpoints. Teams must balance managing a strategy that includes prevention,
modern threat detection, and guided or managed response.	Reduce alert fatigue
and increase visibility
across IT/Security
systems

SOLUTION	Identify if an attacker
pivots from identity toendpoint to network

The combination of Cybereason and Zscaler provides a multi-layer block & detectapproach against drive-by-compromise, command-and-control, unknown network
connections, account takeover, and ransomware.
Telemetry and critical events from Zscaler Internet Access are streamed toCybereason XDR, where suspicious events across your environment are correlated
into MalOps (Malicious Operations), a visual timeline of any high-severity incident.

CORE USE CASESMULTI-LAYER RANSOMWAREPROTECTIONINVESTIGATE ATTACKSTORIES, NOT ALERTS

FIND AND RESPOND TO
CRITICAL THREATS

From initial deployment,
Cybereason and Zscaler
block ransomware
execution, drive-bycompromise, andcommon phishingattempts.

Prioritize thousands ofalerts across existing IT
and security solutions, andtranslate them into visual
timelines of detected
malicious activity.

A growing library of outof-the-box detections
identify key junctures inthe attack chain. Take
guided response actions
or augment your teamwith Managed Detection
and Response services.

LEARN MORE AT CYBEREASON.COM1

SOLUTIONS BRIEF
DEPLOY AN INTEGRATED ZERO TRUST ARCHITECTURE ACROSS YOUR ENTERPRISE

HOW THECYBEREASON& ZSCALERINTEGRATION WORKS

The standard XDR deployment includes installing the Cybereason sensor acrossendpoints and connecting Microsoft 365 or Google Workspace. The Zscaler Zero Trust
Exchange, a leading Security Service Edge (SSE) solution, provides deep user andinternet visibility, while enforcing proactive security policy across endpoint, network, andclouds. Zscaler Internet Access automatically blocks drive-by-compromise, commandand-control, and ransomware attacks. Cybereason ingests Zscaler telemetry andapplies threat detections across streaming firewall, web proxy, and user activity data.
In XDR, Suspicious Events are correlated across workspace, identity, and endpoints.
Important threats are presented in visual attack timelines known as MalOps.

INTERNETSAAS

IAAS

ANOMALOUS ANDSUSPICIOUS ACTIVITY

USER, GROUP AND
APPLICATION VISIBILITYTELEMETRY AND
KEY EVENTSCYBEREASONXDRMALICIOUS ACTIVITYACROSS ENDPOINTSIoTMOBILE

HQ

BRANCH

Architecture Diagram detailing how the two platforms connect.

THE CYBEREASON
MALOPCybereason helps you understand malicious operations (MalOps) that cross between
your identity, endpoint, and workspace planes in a novel and engaging way. MalOps focus
on identifying root cause, the correlated chain of events, affected hosts and identities,
known attack tools, and most importantly, Response Recommendations. XDR supports
Kill Process, Quarantine Host, Remote Shell, and includes Workspace and Identity
responses. Cybereason's Global SOCs fully manage the XDR experience and outcomes.

LEARN MORE AT CYBEREASON.COM2

SOLUTIONS BRIEF
DEPLOY AN INTEGRATED ZERO TRUST ARCHITECTURE ACROSS YOUR ENTERPRISEINTEGRATINGZSCALER ZIA WITHCYBEREASON XDR

To forward logs from your Zscaler Internet Access (ZIA) platform toCybereason XDR, you must set up a NSS feed that enables you to send theselogs automatically.

STEP 1

STEP 2

STEP 3

STEP 4In the Cybereason
Connect screen,
select Zscaler
Internet Access(ZIA).

In the right sideof the Connect
screen, providea Name for theintegration.

In the On-Site
Collector details, inthe Site name field,
select the same site
you used when you
downloaded theon-site collector.

Below the Sitename field, enter
the Protocol andPort for the on-sitecollector. ClickConnect.

LEARN MORE
READ INDUSTRYRESEARCH

VIEW CYBEREASONZSCALER INTEGRATION

Gartner Endpoint
Protection Platforms
Magic Quadrant

3-Minute VideoQuadrant

EXPLORE XDRRequest a Free Trial

ABOUT ZSCALERABOUT CYBEREASON

Zscaler (Nasdaq: ZS) accelerates digitaltransformation so customers can be more agile,efficient, resilient, and secure. The Zscaler Zero Trust
Exchange protects thousands of customers fromcyberattacks and data loss by securely connecting
users, devices, and applications in any location.
Distributed across more than 150 data centers globally,
the SSE-based Zero Trust Exchange is the world’s
largest in-line cloud security platform. Learn more atzscaler.com or follow us on Twitter @zscaler.

Cybereason is the XDR company, partnering withDefenders to end attacks at the endpoint, in the cloud,and across the entire enterprise ecosystem. Only the AIdriven Cybereason Defense Platform provides predictive
prevention, detection, and response that is undefeatedagainst modern ransomware and advanced attack
techniques. The Cybereason MalOp™ instantly delivers
context-rich attack intelligence across every affecteddevice, user, and system with unparalleled speed andaccuracy. Cybereason turns threat data into actionabledecisions at the speed of business. Cybereason is a privately
held international company headquartered in Boston withcustomers in more than 40 countries.

LEARN MORE AT CYBEREASON.COM3