FireEye Investigation Analysis System - IA Series
Minimize impact of network attacks with high-performance packet capture and analysis

Overview:

As recent cyber security breach headlines reveal, the key to minimizing the impact of a security incident is early detection and swift investigation, which requires fast, powerful forensics capabilities.

The FireEye Investigation Analysis System reveals hidden threats and accelerates incident response by adding a centralized workbench with an easy-to-use analytical interface to FireEye Network Forensics, the industry’s fastest, lossless network data capture and retrieval solution. The combination of high-performance packet capture and in-depth analytics provides a powerful complement to comprehensive FireEye threat prevention and detection capabilities.

Analysts can review specific network packets and sessions before, during and after an attack. Being able to reconstruct and visualize the events triggering malware download or callback enables your security team to respond effectively and swiftly to prevent recurrence. They can expand visibility into attacker activity by decoding protocols typically used to laterally spread attacks in a network.

The FireEye Investigation Analysis System supports a number of configurations for single node and distributed architectures to optimize bandwidth and performance of metadata aggregation, queries and analytics.

Highlights:

• Visualization: View and share network metadata and activity through easy-tocreate custom dashboards
• Fast Answers: Conduct centralized application-level wildcard queries and investigation across packet capture nodes
• Powerful Search: Accelerate search with indexed metadata from protocols such as HTTP, SMTP, POP3, IMAP, SSL, TLS, DNS and FTP
• Workflow Efficiency: Archive and share PCAP files with other analysts during an investigation through integrated case management
• SIEM integration: Connect to SIEM flow and metadata indices via RESTful APIs
• IOC Aggregation and Pivoting: Consolidate FireEye Network Security, Email Security and Endpoint Security product alerts in a single workbench and uncover potential correlations between IOCs to conduct deeper investigations.
• Scheduled Reporting: Automatically schedule and run reports based on time intervals or event count thresholds.
• 1-Click File Reconstruction: Reconstruct suspect files, web pages and emails quickly and safely for further analysis and send suspect payloads to a FireEye Malware Analysis (AX series) appliance for analysis.
• Scale for Growth: Cluster the Investigation Analysis System appliances for greater meta data storage capacity to retain data and use a single management console to increase search capabilities across distributed Network Forensics Platform appliances and Investigation Analysis System appliances from a single management console.