Analytics Engines: Mastering Your Mounds of Data for Greater Cybersecurity

Keeping your critical business systems secure can be a challenge when they produce terabytes of data daily.

How do you process that data to ensure the best security outcomes? One of the core technologies leading this crucial effort are analytics engines, as they bring order to chaos and drive appropriate outcomes for effective cybersecurity.  

To make sense out of your mound of information, you first need to ingest and absorb the most essential data from various sources: 

• Network Devices 
• Logs (Operating Systems, Third-party Products, Cloud, Authentication, etc.) 
• File Integrity Monitoring 
• Endpoints   

Comprehensively storing the data and acting on it is imperative. To obtain the desired outcomes, you need a trained intelligence team that possess a range of experiences and skills. But as security resources are sparse at many companies, employing a scalable analytics engine can help ensure you best meet all various needs.  

Sub-Engines at Alert Logic

Beneath the overall Alert Logic analytics engine, there are four different sub-engines that each fit into different buckets: 

1. SQL-like syntax
   This powerful sub-engine is typically used for aggregates and to write analytics looking at certain relationships within the same data. Advanced writing skills are not required, which makes this sub-engine easy to use for those starting on their security journey and working through various data sets for the first time.
2. Simple pattern recognition
   The second sub-engine has been around for 20+ years in the security industry and searches for string and regular expression matches. For instance, sometimes hackers will embed their own names into their programs. By searching for a hacker’s name, the sub-engine raises a red flag when it observes it coming across the network or logs.  
3. Complex analytics support
   The third sub-engine is used for creating advanced analytics, including state-keeping analytics by writing code to generate security observations from the data. Python continues to be the choice of language for security professionals. 
4. Machine learning
   More advanced security threats require an inherent baselining or characterization of certain data, and alerts when the data does not conform to baseline or characterization. For example, it’s not uncommon to see ransomware deploy new Windows services with random names. To detect a random service name, one of the approaches is to train an ML algorithm for an environment with known and valid service names, and flag a new service name that does not conform to the environment standards. ML based algorithms have become a necessary toolset for the modern threat landscape. 

Alert Logic Security Analytics

Alert Logic brings all the features and functionality above together in one solution to power everything. We deliver the robust analytics piece that powers raw data into something which is actionable for security: 

• Interesting security outcomes to track
  Also known as security observations, these are outputs of the Alert Logic analytics engine. Observations may be promoted into incidents or remain only observations — continuously monitored in the chance they become a threat. 
• Our people
  We deliver more than just a tool. As a leading MDR provider, our staff of security experts bring their diverse backgrounds in security and coding to your team.  
• Incidents
  A group of observations or a single observation from the analytics engine that pose significant risk to a customer environment is elevated as an incident via Alert Logic SOC experts.  

The Alert Logic Difference

Analytics engines are not unique in the cybersecurity landscape — many providers offer them. Alert Logic’s engine stands out because of these unique features:   

• Infinite degree of correlations support
  As logs are processed to produce security observations, they may be grouped together by analytics engines to produce higher-level observations. This is a unique capability of the Alert Logic analytics engine designed for higher degrees of correlation. 
• High capacity
  With logs coming in from various places, such as anti-virus, EDRt, and email security, it can manage them all in terms of volume, velocity, and veracity. 
• Robust and unrivaled functionality
  Composed of all four of the sub-engines listed above: simple string matching, regular expression matching, SQL based syntax, programmatic analytics, and machine learning.  
• Threat prioritization
  Determines the difference between a low-level security threat that can be addressed during normal business hours and a high-level threat that requires immediate intervention, even in the middle of the night. Only imperative incidents are escalated.  
• Monitors all suspicious activity
  Even if an activity doesn’t immediately set off an alert, it may still be suspicious. The Alert Logic analytics engine continues to monitor it — ready to act if it grows into a threat. 

Learn More

Analytics engines are a critical part of your total cybersecurity solution. For more information please explore these valuable resources: 

1. On-demand webinar: A Guide to Threat Detection and Response: XDR, EDR, MDR and More 

1. Guide: Critical Detection Capabilities