- Overview
- Overview
- Benefits
- Features
- Resources
- Related Pages
Deterministically Accurate, Actionable Threat Intelligence at a Global Scale
As cyber threats continue to increase in frequency and sophistication, mature security teams will not only rely upon the latest cyber security technology but also highly curated threat intelligence that arms these products. NETSCOUT’s unmatched collection and monitoring of 50% of all internet traffic, our AI & ML powered analysis processes and the expertise of NETSCOUT’s ASERT Team, have enabled NETSCOUT to produce more deterministically accurate and actionable intelligence in real-time. This valuable intelligence is published via the ATLAS Intelligence Feed and automatically arms all NETSCOUT Arbor DDoS attack protection products with the latest DDoS attack tactics and methodologies, known sources of DDoS attacks and Indicators of Compromise so organizations can automatically protect themselves from DDoS attacks and other cyber threats and adapt protections as those attacks change vectors.
Benefits
Automated Threat Intelligence to Enhance Inbound DDoS Attack Mitigation
Protect the availability of networks and services by updating AED with the highly curated threat intelligence that enables it to block inbound DDoS attacks automatically and with accuracy.
Automated Threat Intelligence to Enhance Blocking of Inbound Scanning or Brute Force Attacks
Reduce load on firewalls by offloading detection and blocking of inbound scanning activity and brute force password attacks (e.g. SSH, telnet, SMB, etc.) to AED.
Automated Threat Intelligence to Enhance Blocking of Outbound IoCs Missed by Security Stack
AED’s deployment outside the firewall and continuous update of IoCs enable it to be a last line of defense by blocking outbound traffic from compromised internal devices to external malicious command and control infrastructure that have been missed by the security stack.
Automated Threat Intelligence Improves Adaptive DDoS Protection
Adaptive DDoS Protection or ADP is an added layer of protection that employs a repeating AI & ML analysis process that detects evolving attacks that are not blocked by current countermeasures within Arbor Edge Defense (AED). It then creates recommendations within Arbor Enterprise Manager (AEM) for changes in countermeasures and configurations to block these newly detected attacks. This repeating process is driven by the unmatched Threat Intelligence provided by the ATLAS Intelligence Feed.
Unmatched, AI & ML-Powered Threat Intelligence is the Backbone of AIF
One of the secret ingredients in NETSCOUT's DDOS Protection solutions is our unique Threat Intelligence and superior mitigation techniques and capacities. From our alternative threat intelligence feed
Features
(All Products) - Block known, active sources of DDoS attack traffic (e.g. specific IP addresses, botnet hosts) based on real-time global ATLAS intelligence.
- Adds IP Filter Lists in TMS Mitigations and Templates
- Augments inbound DDoS blocking in AED
By identifying current active attackers from our unique worldwide ATLAS DDoS attack data, and identifying current active hosts that are part of DDoS botnets, AIF is designed to enable our products to detect and block inbound DDoS attacks quickly, automatically, and accurately, without the risk of false positives that can come from non-human curated automation operating in software alone.
(All Products) - Blocks inbound scanning, brute force attempts, and other bulk inbound cyber threats at your network perimeter. Our botnet intelligence feed uses our Honeypot network to understand when known botnet hosts are trying to infect other hosts on the network. This becomes actionable intelligence because we correlate the scan results with actual attack data from our worldwide collection to identify the which botnet hosts are launching attacks in real time.
- Augments inbound Cyber Threat blocking
AIF identifies known active sources of Internet vulnerability scanning and brute force exploit attempts, as well as other bulk commodity threats. This is designed to enable our products to detect and block commodity threats before they enter the network, and help reduce the load on other security devices that may be struggling to keep up during active attacks.
Threat Detection (Sentinel and AED) and Blocking (AED only) - Malware IoCs enable NETSCOUT solutions to detect malware communication with a special focus on known botnet Command and Control infrastructure. NETSCOUT solutions detect infected hosts and threats resident inside the network, including APTs, and in the case of AED disrupts kill chain blocks and their outbound communication to prevent downloading additional malware payloads or communicating with command and control servers that are part of the kill chain.
- In Sightline this enables threat Indicators in MO configuration
- In AED malware coverage is expanded to Nation-State APTs, Malware Downloaders & Expanded Malware Distribution and Exploitation
Using the breadth of our global attack intelligence, we will detect, analyze and identify malware that may beinvolved in probing activities currently operating on your network and identify other advanced persistent threats.
- Provides traffic analysis reports for OTT traffic
Identify and report on Over The Top (OTT) traffic from Content Providers using scalable flow data.
Resources
Related Pages
Arbor Threat Mitigation System for DDoS Attacks
Arbor Sightline DDoS Attack Detection Solution
