Service Flyer

ArcSight Intelligence with
Microsoft Defender for Endpoint
Swiftly reveal hidden and unknown threats, including insiders and advanced
persistent threats (APTs) when pairing ArcSight Intelligence’s advanced
behavioral analytics with rich Microsoft Defender for Endpoint telemetry.
ArcSight Intelligence with
Microsoft Defender for Endpoint
at a Glance• A dvanced insider threat, novel attack,and APT detection• Detection that evolves with yourconstantly changing attack surface• Distill billions of events into a handful ofactionable leads• Risk aggregation enabling low and slowattack detection• Do more with your Microsoft Defender for
Endpoint data

The Power of Behavioral Analytics

Defending an organization from attacks isexpensive, time consuming, and exhausting.
While the attacker need only be right once,
defenders need to be right 24/7. Because ofthis, defenders must have the right tools inplace to catch threats before damage can bedone. User Entity Behavior Analytics (UEBA)
is one of these tools.
ArcSight Intelligence by OpenText™, a UEBA
solution, uses machine learning to identify“normal” behavior for entities (users, servers,endpoints, etc.) in an organization, finding
and alerting threat hunters when anomalies
are detected. Where rules, thresholds, andpattern matching techniques of traditional
security tools are adept at catching known
threats, Intelligence is adept at catching
unknown threats.
Intelligence provides context rich leads
allowing threat hunters to focus less on
hypotheses-based hunting and more on
detecting and preventing attacks in progress.
Not only does ArcSight Intelligence improveyour threat hunters’ effectiveness, it also
improves your overall SOC efficiency.
Unlike other tools that require frequent
updating of rules and thresholds to remain
relevant and reduce false positives,Intelligence continually adapts and evolves
with your changing organization, automatically.
Improving Effectiveness
During the COVID-19 pandemic many security
teams were inundated with false positives

as companies adopted work-from-homepolicies. While Intelligence did show higher
than normal risk scores during the transition,
Intelligence automatically adjusted to the newnormal within days without any intervention.
This allowed overworked security teams toremain focused on current threats rather
than updating their detection tools.

Essential to Advancing
Defender’s Security

ArcSight Intelligence effectively detects
insider threats, novel attacks, and APTs byrepurposing the rich telemetry that is alreadybeing produced by the Microsoft Defender
endpoints in your enterprise.
Microsoft Defender for Endpoint telemetry is
especially powerful when used for behavioral
analytics since it records events that takeplace on individual endpoints and across all
endpoints in an organization. With Microsoft
Defender telemetry, ArcSight Intelligence candetect attack scenarios such as:• Data staging/exfiltration• Unusual uploads/downloads• Account compromise and misuse• High risk IP/data access• Unusual traffic and connections• And moreWith just the Microsoft Defender data,
Intelligence is not only able to detect these
attack scenarios but provide contextual andrelevant insights to threat hunters to quickly
determine the best way to stop a threat frombecoming a major security incident.

Despite a change in attack vectors
and an attempt to hide their real intent,
ArcSight Intelligence was able to detect
the employee’s anomalous behavior, raise
their risk score, and provide the contextualevidence needed to prevent further damage.

Intelligence with EDR solutions like Microsoft
Defender has detected and helped stop real
attacks including:

Microsoft Defender +Microsoft Entra ID with Intelligence• 3rd party supply chain attacks• Nation state attacks• Advanced reconnaissance• Sensitive file accesses/exfiltration• Password guessing on C-Suite accounts(and more)
Preventing Layoff Data Exfiltration
During a round of layoffs an ArcSight
Intelligence customer wanted to ensure
outgoing employees were not walking off
with company secrets. Using Intelligencewith EDR data, the customer detected anemployee logging in outside of their normal
working hours and attempting to transfer
4,000 plus files to a removable device.
When confronted about the files, the employee
assured the security team that he wasn’t
doing anything shady and promised not totransfer files again. Less than a week later
the employee increased their risk scoreby running an application that had neverbeen run by anyone in the company andthen attempting to move over 800 GBof data to a removeable drive in a single
transfer prompting the security team totake further action.

While ArcSight Intelligence is effective atusing Microsoft Defender for Endpoint data
to detect threats originating from companycontrolled endpoints, an organization’s
digital footprint and attack surface extends
beyond physical hardware and devices.
Microsoft Entra ID (Formerly Azure ActiveDirectory) data is an excellent source of
telemetry for Intelligence that gives security
teams powerful insights into unusual user
authentication attempts, cloud, or web
application access, and more.

Connect with Us
www.opentext.com

When paired together, Microsoft Defendertelemetry and Microsoft Entra data
complement each other and expand yourvisibility of relationships between endpointand cloud entities. Combining endpoint,
active directory, and cloud application(Office365 and SharePoint) data, Intelligencecan follow threats as they move between
endpoint and cloud, highlighting potentiallyrisky entities faster than with endpoint
data alone.
Learn more atwww.arcsight.com/intelligence

OpenText Cybersecurity provides comprehensive security solutions for companies and partners of all sizes. From prevention, detection and response to recovery, investigation and compliance,
our unified end-to-end platform helps customers build cyber resilience via a holistic security portfolio. Powered by actionable insights from our real-time and contextual threat intelligence,
OpenText Cybersecurity customers benefit from high efficacy products, a compliant experience and simplified security to help manage business risk.
761-000115-002 | O | 10/23 | © 2023 Open Text