HAWK.io MDR
Industry’s First Real-Time, Automated MDR Platform-as-a-Service
Built on HAWK’s Patented Technology Stack Featuring:
Embedded AI
Patented Telemetry Enrichment
Enterprise Service-based Mesh Architecture (CSMA)
CISOs and SOC Teams Must Defend Against Active Growing Threats With Shrinking Resources
EFFICIENCY
AUTOMATE L1 /L2 ANALYSTS
Assigning SOC Level-1 and Level-2 resources to find needles (vulnerabilities) is not a sustainable strategy
Bring HAWK’s AI-driven automation into your SOC to accurately identify live exploits (the new needle) as they occur
EFFECTIVENESS
EMPOWER L3 ANALYSTS
Time is the enemy of incident responders. Level-3 SOC analysts rush to fill gaps in information critical to IR decision-making
HAWK.io’s IR Platform provides incident response teams evidence of material exploit details (the right needle) faster and provides automation options to accelerate DFIR and risk mitigation actions
HAWK.io is built on an enterprise service-based mesh architecture (CSMA), featuring patented data-enrichment, and embedded AI
CISOs must present information that shows alignment of incident response efforts with the company's goals
Business Impact Reporting
The incident was serious and required quick action from everyone involved.
“Detected in 5 seconds, escalated in 30 seconds, and contained within 10 minutes.
There was no evidence of material loss of operations, data exfiltration, or brand damage.”
Actual Customer Experience
Incident Response Metrics Include:
Time to Detection
Time to Escalation
Time to Containment
Business Impact
The business does not care about the possibility of impact.
The business cares about the containment of realized material impact to business processes.
Steve Zelewski, Former CISO of Levi Strauss
Not All Telemetry Data Is the Same
HAWK.io + vTTAC™
-
Automatically collects real-time machine data and raw logs from Windows and Unix servers, including important details and context far beyond what typical Windows and Unix system logs contain.
-
Gathers artifacts in support of Digital Forensics/Incident Response (DFIR) efforts
-
EventX enriches key/value pairs of each event based on process and user information into each event record to improve the accuracy of analytics. See what parent process called each event, command line, etc., beyond what Windows logs provide.
-
Easy-to-deploy real-time monitoring in virtual environments (Cloud Agnostic)
-
Automates the installation and configuration management of Sysmon to ensure proper enhanced logging is maintained
-
File Integrity Monitoring, Command Normalization, Command Obfuscation Detection
-
Automatically maintains all required logging settings through a device outage or software upgrade.
-
HAWK’s patented data normalization process protects against costly, bloated data lakes. vTTAC™ controls what records and even what fields within records are captured in real-time. No need for 3rd-party data management tools.
Effective incident response requires you to have the entire picture before making a crucial decision that could impact your business. HAWK vTTACᵀᴹ complements existing end-point detection controls by enriching every event with additional information related to the active incident.
HAWK.io automates the artifact collection and digital forensics and incident response (DFIR) so that customers have all of the associated incident information organized in one place and ready for incident containment and response.
Contain Exploits Before Impact to Operations
HAWK.io MDR Combines the Advanced Science of Streaming Analytics With AI/ML to Automate Investigations
-
• Behavioral-based Anomaly Detection
• Signature-based (known exploits)
• Dark Web Monitoring
• Leverages Threat Intel data:
o HAWK proprietary feeds
o Third-party feeds
o Custom feeds
• Uses MITRE ATT&CKᵀᴹ Matrix for tactics, techniques, and procedures to support:
o Detection and classification of incidents
o Threat mitigation/protection
o Recovery
-
• Detect non-signature-oriented low-level cyber-attacks such as:
o Living Off the Land
o Beacon Detection
o Domain Generated Algorithms (ransomware)
• Malicious Web Requests
• Incorporates intrusion detection data feeds
• Leverages Threat Intel data:
o HAWK proprietary feeds, Third-party feeds, Customer-developed feeds
HAWK.io is built entirely on HAWK technology and features patented data enrichment (vTTACᵀᴹ) and streaming analytics (vStreamᵀᴹ) technologies
HAWK.io MDR eliminates the need for SOC analysts by automating manual inspection and diagnosis cycles
HAWK.io’s advanced incident response capabilities focus on containing live exploits to mitigate the material damages