Slide 1: CylanceOPTICS 2.4: Extended Visibility and Unparalleled Prevention
CylanceOPTICS 2.4 Extended Visibility and Unparalleled Prevention Matthiew Morin Senior Product Manager
Slide 2: Agenda
Agenda ▪ CylanceOPTICS Overview ▪ What are the key components of CylanceOPTICS? ▪ What is new in CylanceOPTICS v2.4? ▪ What are experts saying about CylanceOPTICS?
Slide 3: What is CylanceOPTICS?
CylanceOPTICS CylanceGUARD™ ML-Powered Endpoint Proactive Managed Detection and Response Detection and Response CylanceThreatZERO™ Cylance Consulting Solution Implementation World Class IR, Forensics, What is CylanceOPTICS? and Human Expertise ICS and Red Team Services CylanceOPTICS is the endpoint
Slide 4: CylanceOPTICS: AI-Driven Endpoint Prevention
CylanceOPTICS: AI-Driven Endpoint Prevention CONSTANTLY AUTOMATED SMART THREAT TAP INTO PREVENT MONITOR DECISIVE HUNTING WITH CONTEXTUAL INFO ATTACKS ENDPOINTS ACTION INSTAQUERY WITH FOCUS VIEW Source: https://www.gartner.com/reviews/market/endpoint-detection-and-response-solutions
Slide 5: How Do Analysts Define EDR?
How Do Analysts Define EDR? CylanceOPTICS + Services DETECTION I N V E S T I G AT I O N C O N TAI N M E N T R E M E D I AT I O N ▪ Block malicious activity. ▪ Provide contextual ▪ Use various data analytics ▪ Provide remediation information. techniques to detect suggestions to restore ▪ Use various
Slide 6: CylanceOPTICS Does What Others Can't, Prevention-First EDR
CylanceOPTICS Does What Others Can’t, Prevention-First EDR ▪ Focus is on preventing the “unknown unknowns” ▪ Detection is an extension of our prevention-based security ▪ Adding detection improves our ability to prevent future attacks ▪ Preventing attacks creates more time for proactive security prac
Slide 7: CylanceOPTICS Features and Benefits
CylanceOPTICS Features and Benefits
Slide 8: Context Analysis Engine
Context Analysis Engine ▪ ML-powered detection on endpoints ▪ Constantly evolving detection logic provided by Cylance’s Threat Research team ▪ MITRE ATT&CK ▪ Novel attacks and actors seen in the field ▪ Highly extensible custom logic exposed to Users and Partners.
Slide 9: InstaQuery
InstaQuery ▪ “Has this been seen in my environment?” ▪ InstaQuery is a lightweight analyst query with instant access to the results ▪ Lets analysts quickly determine if an endpoint is at risk USE CASE: Hunt for the prevalence of ransomware IOCs throughout a global environment
Slide 10: Focus View
Focus View ▪ “How did this Threat get on a Device?” ▪ Conduct root cause analysis ▪ Automatically gather contextual evidence on: ▪ Threats ▪ Incidents ▪ Artifacts USE CASES: 1. See command line arguments used to decrypt initial ransomware payloads 2. Observe support files being introduced by malware
Slide 11: Packages & Playbooks
Packages & Playbooks ▪ Package Deploy allows complex actions to be taken on endpoints at scale on demand. ▪ Execute applications ▪ Collect artifacts ▪ Playbooks allow the same complex actions to be taken automatically when suspicious activity is detected. ▪ Collect additional critical forensic infor
Slide 12: Enhanced Visibility in CylanceOPTICS 2.4
Enhanced Visibility in CylanceOPTICS 2.4
Slide 13: What's New in CylanceOPTICS 2.4?
What’s New in CylanceOPTICS 2.4? 1. 2x Visibility into Endpoints 2. 5x Addressable Space with Context Analysis Engine 3. New InstaQuery Artifacts and Facets 4. New Focus View Data Points
Slide 14: What's New in CylanceOPTICS 2.4?
What’s New in CylanceOPTICS 2.4? Enhanced visibility across several key events and focus points: Private Address Powershell Portable Executable (RFC 1918 / RFC Windows Logon DNS WMI Introspection Introspection Parsing 4193) Space Event Visibility Visibility See which Processes See activity occurring
Slide 15: InstaQuery – DNS Request
InstaQuery – DNS Request ▪ Question Name ▪ “Has mydomain.net been seen?” ▪ Record Value ▪ “Has a domain ever resolved to this?”
Slide 16: InstaQuery – Powershell Trace
InstaQuery – Powershell Trace ▪ Event ID ▪ “Show me all matches for Event ID 4101.” ▪ Script Block Text ▪ “Has a script executed with this text in it?” ▪ Payload ▪ “Has a payload or module executed with this text in it?”
Slide 17: InstaQuery – WMI Trace
InstaQuery – WMI Trace ▪ Event ID ▪ “Show me all matches for Event ID 5861.” ▪ Consumer Text ▪ “Has a WMI consumer been created with this text in it?” ▪ Namespace ▪ “Has a WMI action been taken in this Namespace?” ▪ Operation ▪ ”Has a WMI operation executed with this text in it?”
Slide 18: InstaQuery – WMI Trace
InstaQuery – WMI Trace ▪ Event ID ▪ “Show me all matches for Event ID 5861.” ▪ Consumer Text ▪ “Has a WMI consumer been created with this text in it?” ▪ Namespace ▪ “Has a WMI action been taken in this Namespace?” ▪ Operation ▪ ”Has a WMI operation executed with this text in it?”
Slide 19: InstaQuery – Windows Event
InstaQuery – Windows Event ▪ Event ID ▪ “Show me all matches for Event ID 4624.” ▪ Provider ID ▪ “Show me all events from the SecurityAudit provider” ▪ Class ▪ “Show me all ‘LogonLogoff events.”
Slide 20: What Are Experts Saying About CylanceOPTICS?
What Are Experts Saying About CylanceOPTICS? Gartner Peer Insights and Forrester: Total Economic Impact™ Study
Slide 21: Gartner Peer Insights testimonial
“Cylance is the best of breed in threat detection and prevention. Since installing CylancePROTECT and OPTICS, we can sleep at night.” — Gartner Peer Insights, April 2019.
Slide 22: Forrester Total Economic Impact study results
In a study by Forrester, CylanceOPTICS ▪ Improved the security team’s productivity by 10% ▪ Reduced lost time by 95% ▪ Reduced the expected cost of a major security breach by 25% — Forrester: The Total Economic Impact™ study of CylancePROTECT® and CylanceOPTICS™ May 2019
Slide 23: Questions Answers
Questions — + —— Answers
Slide 24: ©2019 Cylance Inc. All Rights Reserved.
©2019 Cylance Inc. All Rights Reserved.