-
Mobile Security Probe
-
CyberMap
-
Early warning and malware analysis system (Sandbox Solution)
Mobile Security Probe
Mobile Security Probe is a device used to perform monitoring, intrusion detection and host enumeration in an infrastructure. The device comes in 5U RACK case, which can be conveniently transported by a security incident response team and plugged in to a SPAN or TAP port in a datacenter in order to perform quick check of the network. Mobile Security Probe integrates many commonly used tools and aggregates their reports in order to present a clear view of network status – health and security level. Probe can be also used over the longer span of time in order to learn the regular network usage level and report any anomalies taking place in the infrastructure.
CyberMap
CyberMap is system that provides cyber security situational picture on map. People say that „one picture is worth millions of words”. Such picture brings great added value for cyber security domain. CyberMap provides overview of geographically located infrastructure assets and reported security events. Therefore, it allows SOC operators to quickly track which assets (locations) are being attacked or have reported events. Additionally, for attack event types it displays a “power blast” starting from source (external geographical location) to destination location (infrastructure assets). Such graphical view allows operators working in Security Operations Centre to efficiently respond to cyber security threats and decreases overall reaction time. The system works in near real time which means that once events are reported and collected by SIEM (or any other reporting – collecting mechanism) they are very quickly available on map.
Early warning and malware analysis system (Snadbox Solution)
Sandbox is a software used to perform thorough analysis of files in order to check if they have any malicious features. Sandbox provides many deep analysis functions, including static and dynamic analysis in order to check the behaviour of registered files. It is possible to analyse not only regular, commonly used files, but also RAM dump files and also Windows crash dump files. Sandbox system allows users to upload files via Web GUI or through REST API. Both accesses require authentication to provide full accounting of actions in the system. All files need to be uploaded as encrypted archive file to avoid storing or executing potentially malicious software on management level of the system.
