Intrusion Detection System (IDS) Software

Daily Malware Analysis

Using advanced sandboxing techniques to quarantine malware 
samples while we conduct static and dynamic analysis, we analyze over 500,000 unique malware samples every day. This analysis provides key insights into the latest attacker tools and techniques.

Honeypot Deployment and Analysis

Our global honeypots are essentially “virtual venus fly traps” set up to detect, capture, and analyze the latest attacker techniques and tools. Leveraging honeypots placed in high traffic networks, our threat intelligence subscribers are armed with the latest defensive strategies in the form of updated event correlation rules, IDS and vulnerability signatures, and more.

Attacker Profile Analysis

We’re constantly monitoring hacker forums and underground networks for in-depth profiling of the common traits of cyber criminals. This information gives us unparalleled access for understanding the “attack horizon” and has resulted in major discoveries such as the evolution of Sykipot, Red October, and other malware outbreaks.

Threat Intelligence Collaboration

We’ve been able to establish strong connections with state agencies around the world, academic researchers and other security vendors. These relationships enable us access to pre-published vulnerability and malware updates as well as enhanced verification of our own research.

Faster Deployment Time

Go from install to insights in less than an hour with USM. All of the built-in security controls are pre-integrated and optimized to work together out of the box.

Low Administrative Overhead

Deploy and manage your IDS, HIDS, SIEM, and more from the same console.

Tuned Event Correlation

With the core data sources are already built-in, our 1600 event correlation rules are already "fine tuned" and optimized, right out of the box.

Full Packet Capture

Any packet that triggers an IDS signature is automatically captured and displayed with the IDS event. Session monitoring and full packet capture can then be invoked for more extensive forensic investigation.

Reduced False Positives

IDS are notorious for "false positives" where events seem to indicate an intrusion, but are actually harmless. AlienVault USM helps reduce false positives by cross-correlating multiple security tools, including asset inventory, IDS, vulnerability scanning, behavioral analysis and visibility to netflow data.

Full Threat Context

All you need to know about an incident is captured in each alarm, including asset information (such as OS, software, identity), vulnerability data, visibility to netflow data, raw log data, and more.

Actionable Alarms

AlienVault USM includes many security monitoring methods to gather information from a variety of threat vectors. Because you have access to asset information, you can get to root cause faster than ever.

Continually Updated Signatures and Rules

Receive continuous and coordinated updates to catch the latest threats.

Integrate with IDS Technologies

Already have an IDS on your gateway or DMZ? Simply forward your IDS and IPS event logs to our USM Sensor, and we'll correlate this data with our built-in IDS and other monitoring tools for full multi-layered threat detection.

Detect Sophisticated Threats

By deploying IDS throughout your network and installing HIDS on critical servers, you'll be able to catch sophisticated threats like "low and slow" attacks and other stealthy malicious activity that a single perimeter-based IDS on its own wouldn't catch.

Get Integrated Event Correlation

Benefit from our built-in IDS tools as well as our log analysis and event correlation engine. For example, USM's multi-layered threat detection and built-in SIEM event correlation will identify events such as:

• Insider threats and other suspicious behavior
• Privileged user activity - authorized and unauthorized
• Policy violations such as use of unauthorized software or services
• Data exfiltration attempts