FLOWMON DDOS DEFENDER

Maximizing
Investment
into SIEM withFlowmon NDR
Even though SIEMs can usually utilize flow data as a source, doing thisconsumes license limits and duplicates the functionality of NDR tools.
However, you can use an NDR tool to ingest flow data, process it using
advanced algorithms and techniques, and detect events, which you
can then feed to the SIEM. This approach can significantly reduce thebudget and ongoing costs needed for the SIEM while still providing
actionable threat information with comprehensive details.

50%

Clients report up to 50% savings
on SIEM licenses“Thanks to Flowmon we are able to reveal threats andmalicious behavior within the internal network. And whatis the most important experience - we have significantly
reduced incident resolution times.”

FLOWMON

Vittorio Cimin, CIO of Bricofer

FLOWMON DDOS DEFENDER

BENEFITS

Maximizing SIEM ROI

Threat hunting time reduction

Instead of feeding the SIEM with a bulk of data, you

Events are presented in context to support real-time

can preprocess it using a specialized tool and only

threat-hunting. Their circumstances are recorded insend what is relevant, thus saving on license costs.

full for convenient post-compromise analysis.

Layered security

Fast time to value

Cover the blindspots of your security solutions by

Streamlined deployment and integration, user

deploying them in a complementary matrix. Let

enablement, predefined views, dashboards,

them make up for each other’s shortcomings andand reports. From deployment to data on thereduce the likelihood of a successful attack.

dashboard in just 30 minutes.

NDR tools convert the torrent of network telemetry data to a low number of events which are then exported to the SIEM, thus reducing the number of network logs the SIEM has to process and ultimately bringing significant savings, as SIEM pricing is typically based on the number of processed logs.

Flowmon is compatible with a wide range of SIEM systems. Integration and event delivery is based on standard syslog protocol or SNMP traps. Flowmon implements theindustrial standard Common Event Format (CEF) to minimize deployment efforts.
Furthermore, Flowmon supports REST API, custom-scripts, and other integration

FLOWMONmethods.

FLOWMON DDOS DEFENDER

How does it work?
The detection of unknown threats requires layered security consisting of several approaches that can pick up various anomalies and recognize them as indicators of compromise. Flowmon co-creates these layers alongside antivirus and firewall to monitor

Exploitation

Privileges& AccessDiscovery

LateralMovementCollection

Command& Control

Exfiltration

Perimeter

Endpoint

Network

CoveredContributes

Flowmon does not use just one detection mechanism, but several, all working at thesame time. They cover a wide number of scenarios by examining the network fromseveral points of view. Because the solution uses network traffic metadata, it delivers
the same level of detection in encrypted traffic.

Data Source

Detection

Proprietary Enriched
Network Telemetry

Machine Learning

3rd-Party NetFlow/IPFIXand Compatible Standards

Adaptive Baselining

Raw Packet Data

Heuristics
Threat and Anomaly
AlertsUser Identity

Behavior Patterns

IDS Signatures

Reputation

Built-in and Custom ThreatIntelligence

The SOC Visibility Triad is a concept created by Anton Chuvakin of Gartner, which
postulates that deploying complementary security tools that make up for each other’s shortcomings will significantly reduce the chances that an attacker will be able
to achieve their goals. The Triad consists of three pillars; endpoint security (EDR),FLOWMON

event logging and management (SIEM), and network detection and response (NDR).

www.flowmon.com

Impact