Bitdefender Network Traffic Security Analytics
Real-time breach detection and complete threat visibility

Overview:

Bitdefender Network Traffic Security Analytics is the enterprise security solution that accurately detects advanced attacks in real-time and automates alert triage to provide context and facilitate incident response. It enables organizations quickly detect and fight sophisticated threats by complementing pre-existing security architecture – network and endpoint – with specialized network-based defense.

By using network traffic as a source of reliable information, NTSA detects breaches immediately as endpoint behavior changes once infected. Detection is effective against both generic or advanced persistent threats, known or never seen before. Incident alerts are automatically correlated and triaged for higher security operations effi cacy and improved incident investigation and response time.

NTSA is a plug-and-play, out-of-band solution, with flexible deployment options, that focuses on traffic meta-data and enables analysis over longer periods of time to accurately detect the most sophisticated malware and Advanced Persistent Threats (APTs) with high fidelity. Combined with Bitdefender GravityZone, organizations can quickly remediate security incidents.

Leading Cyber Threat Intelligence and Artificial Intelligence

NTSA leverages superior Bitdefender’s Cyber Threat Intelligence – collected from 500 million endpoints globally – and combines it with advanced Machine Learning (ML) and heuristics to analyze the network meta-data in real time and to accurately reveal threat activity and suspicious traffi c patterns. With automatic security analytics and a focus on outbound network traffi c, it reduces noise and provides actionable alerts for security operations.

Intellitriage

Security Operations Centers should not suffer of alerts fatigue!

IntelliTriage, the newest NTSA component, automates the process of security incidents triage to dramatically improve incident investigation time and reduce organizational risk with high-fidelity alerts. IntelliTriage also provides recommended remediation guidance on steps to take based on the security incident.

It enables complex scenario-based learning to detect advanced attacks with high accuracy and corelates thousands of security alerts in order to create a clear picture of each incident. IntelliTriage provides detailed explanations for the incident severity score. Recommended remediation actions are also provided to facilitate faster incident response.

Protection for the Things (IoT) and BYOD in your environment

Enterprise environments are increasingly shared between human operated devices and smart things. While traditional endpoints are typically under scrutiny and well protected, smart things operate in a grey area with limited or no protection. More and more, devices in the network are targeted and used as beach heads during advanced attacks.

NTSA breach detection capabilities extend also to the smart things in the enterprise network. By focusing on the network behavior of endpoints, it can protect devices with limited or no built-in security capabilities and no endpoint security agent running on top (like most IoT devices).

As employees use personal laptops, mobile phones and other devices in business environments, attackers take advantage of them to take corporate information. Securing BYOD increases employee productivity and reduces the risk of exposure of corporate information. NTSA technology helps safeguard organizations from information theft by constantly monitoring and tracking all user and device behavior in real-time and deploying superior threat intelligence. It’s agentless, non-intrusive and independent of the operating system.

Compliance support

Many regulations, GDPR included, require organizations to quickly provide detailed information about malicious activities in the event of breaches. NTSA helps organizations meet compliance requirements by recording information about network data traffic for up to 12 months. The recording contains only meta-data, with no actual payload, and access to recordings is restricted to the Data Privacy Officer role only, eliminating the risk of sensitive information exposure.