Sqrrl Threat Hunting Solution for ArcSight

2124

Sqrrl Community

App Support Tiers

OpenText SUPPORTED

Support via OpenText Software Support, with a ticket filed against the associated product.

PARTNER

OpenText offers a content partnership program for select partners. Support for Partner Content offerings is provided by the partner and not by OpenText of the OpenText community.

OpenText COMMUNITY

OpenText Community Content is provided by OpenText for the benefit of customers, support for it is not available via OpenText Software Support but through specific community content forums.

COMMUNITY

Community Contributed Content is provided by OpenText customers and supported by them.

EARLY ACCESS

Show less ...Show more

The downloads referenced under the "Cybersecurity Early Access" category are made available to subscribers to mitigate time-critical issues but have not undergone formal quality and performance testing associated with official OpenText/Cybersecurity product releases. OpenText has a multi-stage Quality Assurance process. During Stage 1 we conduct a resource analysis, field mapping, ensure content level 1 functionality and analysis in our sandbox environment. Stage 2 is a complete validation including production validation. This package has cleared Stage 1 validation and therefore should be deployed with the appropriate pre-production validation. OpenText strongly recommends that any downloaded content is first checked and tested thoroughly in a non-production environment before committing to production. We welcome feedback and, should any content be shown to be faulty, detrimental or carry an incorrect claim of authorship, we shall endeavor to remove or correct such content as promptly as reasonably possible once notified and validated.

Sqrrl | Community

Sqrrl delivers the power of analytics-driven threat hunting to HPE ArcSight. Sqrrl's Threat Hunting solution extends ArcSight's threat detection capabilities with adversarial behavior analytics, user and entity risk scoring and unique Behavior Graph.

180 downloads

Description

Sqrrl is an advanced detection and response platform that enables security analysts to uncover advanced threats and anomalies within enterprise networks. The Sqrrl platform enables security analysts to reduce attacker dwell time by discovering and assessing adversarial behavior faster and with fewer resources. The Sqrrl platform fuses HPE’s native ArcSight Data Platform data sources with other contextual data to generates an enterprise behavior graph, a unique visual environment for analyzing advanced adversarial behaviors across petabytes of data. Arcsight users will also benefit from Sqrrl’s kill chain-focused User and Entity Behavior Analytics (UEBA) which automatically uncover adversarial TTPs. Sqrrl’s machine learning-powered analytics provides greater context and focus to hunts, and combines with linked data techniques to present analysts with intuitive summaries and visualizations of threat actor behavior along the cyber kill chain. Features of the Sqrrl Threat Hunter Solution for HPE Arcsight include: Direct integration with the ArcSight Data Platform simplifies data sourcing Visual modeling of adversarial behaviors enriched with ESM user, asset, and event context Arcsight integration commands for launching Sqrrl hunts Native Arcsight content for consuming CEF-transported Sqrrl analytics Sqrrl's Threat Hunting Solution is the ideal tool for ArcSight analysts and hunters defending against today's advanced threats.