SOLUTION BRIEF

Intelligent Next Gen Security
Operations Platform
Powered by Open XDRAutomatically piecing complex attacks together across cloud,endpoint, network, user, applications and SaaSTODAY’S CYBERSECURITY CHALLENGE
Detection Tools Timeline
1998

2005

2007

2008

INTRUSION
DETECTIONSYSTEMSSIEM

FLOWANALYZERSANDBOX

2013

DECEPTION

2015

MACHINELEARNING

2018

UNIFIED
SECURITY ANALYTICS
PLATFORM

FutureCyberattacks and breaches are soaring andsecurity budgets are growing in response.
Until now it has been necessary to juggle amultitude of expensive tools from multiple
vendors. The industry doesn’t need anotherpoint solution to cobble together. It needs ascalable, intelligent central platform that isfed with the right data and armed with theability to automatically respond to threats.

WHY EXISTINGAPPROACHES FAIL
So why are organizations still getting
breached? At Stellar Cyber, we believe it
is because of complex environments withblind spots, disparate tools and alert noise.
Today’s environments consist of physical,
virtualized, containerized workloads in public,
private and hybrid clouds that create hugecoverage challenges and an unmanageable
amount of unactionable alerts. In this state,LWLVH[WUHPHO\GLIĆFXOWIRUVHFXULW\WHDPVWRHIĆFLHQWO\UHVSRQGWRWKUHDWVDQGLGHQWLI\WKH
critical ones before data is stolen or damage
is done. A better early warning detection
system is needed.

Stellar Cyber delivers the only intelligent next gen security operations
SODWIRUPZKLFKLVWKHĆUVWWREHSRZHUHGE\RSHQH[WHQGHGGHIHFWLRQ
and response (Open XDR). The platform combines the functions ofSHUYDVLYHGDWDFROOHFWLRQELJGDWDSURFHVVLQJDQGDUWLĆFLDOLQWHOOLJHQFH
through machine learning.
We believe the solution to today’s security problem is to deploy
a single technology that can be deployed across all environments
to provide pervasive visibility. The technology should capture andFRUUHODWHDOOW\SHVRIGDWDVXFKDVQHWZRUNWUDIĆFORJVVHUYHUFRPPDQGVSURFHVVHVDSSOLFDWLRQVXVHULQIRUPDWLRQĆOHVHWF7KHVROXWLRQ
should be full stack, yet open, extensible, scalable, intelligent, andSURYLGHDXWRPDWLRQVRWKHVHFXULW\VWDIIFDQRSHUDWHPRUHHIĆFLHQWO\Lastly and most importantly, at Stellar Cyber, we believe that cybersecurity solutions should reduce the industry average of 200 days todetect a breach down to minutes to detect a breach while mitigating
WKHULVNRIGDWDH[ĆOWUDWLRQRUDQ\RWKHUGDPDJHThe Stellar solution works by deploying sensors and log forwarders
on the network, servers, containers, physical and virtual hosts. The
VHQVRUVWUDQVIRUPUDZGDWDLQWR,QWHUćRZUHFRUGVDQGVHQGLWWRD
centralized data processor and data lake that deduplicates, correlates,enriches, indexes and stores the data that it receives. Once this data
is received, it then runs complex analytics on the dataset to identify
KLJKĆGHOLW\EUHDFKHYHQWVThe platform also has tightly-integrated security capabilities thatshare data on one platform and features built-in analytics thatleverage machine learning to eliminate alert noise and improve theaccuracy of detecting critical security events. With this methodology,
RUJDQL]DWLRQVFDQJDLQKXPDQZRUNIRUFHHIĆFLHQFLHVE\DXJPHQWLQJVHFXULW\RSHUDWLRQVWHDPVZLWKELJGDWDDQDO\WLFVDQGDUWLĆFLDOintelligence. The use cases of the solution are limitless in the areasof threat investigation, detection and response.

COLLECT THE RIGHT DATA“Open XDR delivers
WKHNH\EHQHĆWVRIWKH
HOLPLQDWLRQRIEOLQGVSRWVUHGXFHGWLPH
WRGHWHFWEUHDFKHVDQGLPSURYHGKXPDQFDSLWDOHIĆFLHQFLHVWith comprehensive
7-|-1oѴѴ;1ঞom-m7
-|ol-|;77;|;1ঞomķbm;vঞ]-ঞom-m7
responseLWèVD
VHFXULW\RSHUDWRUèVGUHDPFRPHWUXH“THE SOLUTION– Albert Li,Chief Scientist,Stellar Cyber

The Open XDR platform has data collection andprocessing at the core of its capabilities and at Stellar&\EHUZHEHOLHYHWKDWVROYLQJWKHGDWDSUREOHPĆUVWis key. This is because security analysts struggle withhaving too much data, not enough data or no context
for data. If the data collection problem isn’t solved
properly, tools will experience the age-old problemof garbage in / garbage out. Stellar Cyber’s data
FROOHFWLRQWHFKQRORJ\LVFDOOHG,QWHUćRZ,QWHUćRZLVD-621IRUPDWWHGGDWDUHFRUGWKDW
is normalized, reduced and enriched with othertelemetry to give context to what is actuallyoccurring. Stellar Cyber’s family of sensors capture
network application data, server process, command
DQGĆOHGDWDDVZHOODVWKUHDWLQWHOOLJHQFHDQGJHR
location data. After collected, this data gets fused
together to form one record.

OPEN XDR SECURITY PLATFORMDETECT THE REAL THREATS

Stellar Cyber’s Open XDR enables customized security
workbenches to analysts get the tools they want. There
are over 50,000 detections for known and unknown
behaviors and these detections are mapped to thecybersecurity kill chain to act as an early warning
detection system. Starlight, unlike other solutions in themarket, has complete kill chain detection because of
the its rich data collection.
For example, detections at the delivery stage of thekill chain require a malware sandbox, and detections
at the exploitation stage require IOS technology.
Stellar Cyber delivers the tools to detect and respondthroughout the kill chain. The solution also combines
legacy technologies such as IOS with machine learning
LQRUGHUWRLQFUHDVHĆGHOLW\DQGORZHUIDOVHSRVLWLYHVMachine learning effectively creates a baseline ofsignatures that normally trigger often and eliminates
WKHPIURPEHLQJFRQVLGHUHGDKLJKĆGHOLW\DOHUW0DFKLQHOHDUQLQJDOVRGHWHFWVDQRPDORXVWUDIĆFpatterns and server behavior.

INVESTIGATE PROBLEMS

Threat Hunting has quickly become a popular strategyin cyber security operations, and the search for theunknown is as important as the detection of theunknown. With Open XDR, organizations can search
its rich dataset for malicious activity by creating
VLPSOHRUFRPSOH[TXHULHVRQWKHć\,WèVOLNHKDYLQJ
a Google search engine on your data. For example,
an operator can investigate for the execution ofWindows Powershell commands on a server initiatedfrom public IP addresses that has a pre-existing badreputation. Another example is an operator wanting
WRVHDUFKIRUDVSHFLĆFĆOH 026KDVK XSORDGHGWRDVHUYHURQWKH,QWHUQHWE\DVSHFLĆFXVHUAfter these search queries are created, the operator
can then save them and turn them into custom
visualizations for future use and have them
automatically executed to generate alerts and reports.

RESPOND AUTOMATICALLY'HWHFWLRQDQGLQYHVWLJDWLRQIRUKLJKĆGHOLW\HYHQWVDUH
a must-have for any security platform, however theplatform would not be complete if it didn’t have theability to also take action. Open XDR has built-in eventresponse capabilities. Operators can respond to an
event by creating a trouble ticket with its built-in casemanagement system, trigger email, Slack and restful API
alerts, automatically send out POF reports and signal
ĆUHZDOOVWRWDNHDSSURSULDWHDFWLRQAlong with these built-in response capabilities, theplatform also has orchestration plugins for SIEMs
as well as SOARs such as Demisto, Phantom Cyber,
Swimlane and Siemplify. The SIEM plugin streams
events and the SOAR plugins allows the platforms
detections to automatically trigger playbooks that
reside in orchestration products to perform a varietyof instructions that could include executing scripts or
integrating with adjacent tools.

OPEN XDR SECURITY PLATFORM

OPEN XDR SECURITY OPERATIONS PLATFORM DEPLOYMENTThe solution is delivered as software that can be installed on your own physical or virtual x86 servers in cloud providers
such as AWS, Azure or Google, or purchased as pre-installed hardware appliances.

There are multiple componentsthat create the total solution:•1HWZRUNVHQVRUVFROOHFWQHWZRUNWUDIĆFfrom ethernet switches.

•Server sensors are installed on Linux and:LQGRZVRQVHUYHUVWRFROOHFWWUDIĆF
FRPPDQGSURFHVVDQGĆOHGDWD

•&RQWDLQHUVHQVRUVFROOHFWWUDIĆFLQVLGH
container environments.

•Deception sensors act as honeypots
within your environment.

•Virtual appliance sensors can be
deployed inside KVM, VMWare andHyperV environments.

•Data Processor nodes are deployed
and can be clustered together to createa scalable big data platform for data
storage and analytics.

GLOBALPARTNER NETWORKThe Stellar Cyber solution is madeavailable to customers through ourglobal partner network. We haveselected some of the best distributors
and value added resellers around theglobe that have a deep understanding
RIF\EHUVHFXULW\2XUSDUWQHUĆUVWapproach assures that we are able todeliver our products around the world
as well as bring localized technicalsupport and training.

PolandSwitzerland
South Korea

North America

Bangladesh
India
ThailandCentral America

Japan

TaiwanHong Kong
Vietnam

Malaysia
Indonesia

South America

ABOUT STELLAR CYBER
Stellar Cyber is the only cohesive Open-XDR platform providing maximum protection by piecing attacks together acrossIT infrastructure Stellar Cyber’s industry-leading security infrastructure correlates detections from across the entire killchain and improves productivity by empowering security analysts to kill threats in minutes instead of days or weeks. By
accepting data inputs from a variety of existing cybersecurity solutions as well as its own tools, correlating them, andpresenting actionable results under one intuitive interface, Stellar Cyber’s platform helps eliminate the tool fatigue anddata overload often cited by security analysts while slashing operational costs.

OPEN XDR SECURITY PLATFORM