FireEye Network Forensics Platform - PX Series
Accelerate actionable intelligence and facilitate rapid incident response

Overview:

Accelerate actionable intelligence and facilitate rapid incident response

Well-maintained perimeter defenses are a key part of any security strategy. Organizations increasingly recognize that they must also complement their perimeter defenses with strong forensics capabilities to investigate and analyze attacks. When attacked, an enterprise needs to be able to rapidly investigate and determine the scope and impact of the incident so they can effectively contain the threat and secure their network.

The FireEye Network Forensics Platform allows you to identify and resolve security incidents faster by capturing and indexing full packets at extremely rapid speeds. With the Network Forensics Platform, you can detect a broad array of security incidents, improve the quality of your response, and precisely quantify the impact of each incident.

The Network Forensics Platform provides a powerful complement to the FireEye comprehensive threat prevention capabilities. In addition to receiving precise alerts and correlated threat information, analysts can also get a fine-grained view of the specific packets and sessions before, during, and after the attack to confirm what may have triggered a malware download or callback, to respond rapidly and effectively, and to apply this information to enhancing future protective strategies.

Highlights:

• Continuous, lossless packet capture with nanosecond time stamping at recording speeds up to 20 Gbps
• Real-time indexing of all captured packets using time stamp and connection attributes. Export of flow index in NetFlow v5, v9, and IPFIX formats for use with other flow analysis tools
• Ultrafast search and retrieval of target connections and packets using patentpending indexing architecture
• Web-based, drill-down GUI for search and inspection of packets, connections, and sessions
• Session decoder support for viewing and searching Web, email, FTP, DNS, chat, SSL connection details, and file attachments
• Packet payload search using regular expressions
• Industry-standard data storage and export in PCAP format, which can be stored with flexible storage options: on the appliance, SAS-attached, or SAN-attached storage
• Accelerate the investigative process by using Event Based Capture to identify suspicious sessions that should be the focus for deeper investigations.

Accelerate kill chain reconstruction and impact quantification

By allowing FireEye users to quickly locate and decode traffic and sessions before, during, and after a security event, the Network Forensics Platform provides greater visibility into activity around the event, further enhancing visibility that can be crucial for rapid incident response investigations.

Ultrafast access to historical network data is a necessity for security personnel in reducing mean time to resolution, as well as answering the key questions: how long has the breach been present, what data may have already left the network, and how many other hosts may already have been compromised?

Ultrafast packet capture, indexing, and search

The Network Forensics Platform ensures continuous, lossless packet capture with nanosecond time stamping at recording speeds up to 20 Gbps. Real-time indexing of all captured packets with nanosecond time stamps and connection attributes provides data for immediate forensics.

Industry-standard data storage and export

All packets are stored in standard PCAP format to enable flexibility to an analytics platform of choice.

Integrated workflow with Fireeye threat prevention platform

he integration with the FireEye platforms provides deeper insight into network traffic and activities through simple drill-down access to captured, indexed, and stored connection and packet information on the largest and busiest networks. By allowing FireEye users to quickly locate and decode traffic and sessions before, during, and after a security event, the Network Forensics Platform provides greater visibility into activity around the event, further enhancing visibility that can be crucial for rapid incident response investigations.

Highlight suspicious sessions

Accelerate the investigative process and correlate events that have occurred over time by creating customizable rules to flag suspicious session data, enabling a starting point for deeper investigations and to ensure longstanding retention. Investigations tied to a given event can be managed as a single case.