With deep visibility into your network and security infrastructure—and the ability to provide reports and analytics in real-time — NitroView ESM offers a whole new way to think about incident response and forensics. In the past, "forensics" meant "slow" or "historical" ... yet the end result of any forensic investigation is directly relevant to incident response. Incident Response, by definition, requires fast intervention (see our whitepaper, "The Fundamental Requirements of SIEM"). Why the disconnect? Because traditional SIEMs aren't capable of real-time forensics.
The ability to detect a threat, notify a security professional, perform a detailed investigation of that threat, and take appropriate actions is perhaps the most necessary function of SIEM. The United States government defines the requirement for incident response as needing to be "timely" and "rapid"—with good reasons. Every minute between the detection and notification of an incident, and the successful exploitation or theft of a protected asset, costs a company money, exposure, and liability.
If your SIEM can't access current and "historical" data, analyze it for root cause, vector, and risk analysis, and provide actionable intelligence in a matter of minutes, it provides little to no value as response tool.
Real-time, operational forensics allows a security professional to perform ad-hoc correlation of data to detect, track, and remediate complex attacks as they occur—the ability to provide zero-day response to complex threats. That means the ability to use NitroView ESM to see threats that haven't yet been defined within event correlation rules (of course, pre-defined rules exist as well, for automation of well-known attacks). [Read more]
NitroView ESM is able to detect, prevent, mitigate and remediate threats. Remediation occurs in two primary ways:
Role based access to NitroView can even limit remediation capabilities to specific users or groups, allowing NitroView's remediation capabilities to benefit both Security- and Network- operations teams.
Watch the above demonstration to see CTO Michael Leland creating a custom report to determine attack vector and propagation. Looking for something more interactive? Kick the tires yourself with a online test-drive, or register for an engineer-led webinar to see for yourself the power of real-time, operational forensics.
