Many activities were executed to get to the crown jewels in your cloud. Skyhawk Synthesis correlates these events, or Malicious Behavior Indicators, into an Attack Sequence. Once a specific risk threshold is reached, the attack sequence is raised to a alert, or Realert.
Malicious behavior indicators (MBIs) are activities that Skyhawk has identified as risky behaviors that require an investigation and may pose a threat to your business based on our own AI and ML modeling of what is normal for your cloud.
MBIs correlate multiple activities into a single threat. Other solutions will alert on every activity – like an API call. The security team would then have to correlate each of these activities to understand how these are activities are malicious, the relationship between them, and how they are impacting the environment.
Understand the slow, “under the radar” activities that attackers are using over days, weeks, or months, to compromise your organization’s cloud. Sequences show each step and the time between steps, so the SOC can better understand how attackers are behaving – right now – in their environment. Remove the teams’ frustration and avoid chasing every little issue (that turns out to be a non-issue 99% of the time).
There are three levels of granularity for ML models:
Skyhawk Ecosystem: These models are applied across the entire cloud environment. For example, risk scoring is done at this level. Aggregating data from all customers improves the accuracy of the product.
Customer Cloud: These models are to measure deviations from the normal behavior for things like network traffic, asset usage, etc.
Within the customer cloud: These models are more specific and granular. For example, models that monitor what APIs users are leveraging on a regular basis.
Skyhawk Security’s Cloud threat Detection and Response (CDR) platform contextualizes and correlates all of your specific attack vectors in real time – to reduce alerts and focus only on actual attacks as they unfold. It provides scored and validated realerts, and insights on what you can do to address them.
