New ThreatSync correlation and scoring engine automates malware detection and remediation with real-time data from networks, endpoints and cloud intelligence
24 January 2017 – WatchGuard® Technologies today announced Threat Detection and Response (TDR), a new cloud-based service that gives small and midsize businesses (SMBs), distributed enterprises and managed security service providers (MSSPs) the ability to detect advanced threats on endpoints, correlate this with data collected from the network and respond immediately. Now available with the WatchGuard Total Security Suite (TSS), TDR pairs detection and response capabilities on the endpoint with a comprehensive set of Unified Threat Management (UTM) network security services.
“As cyber criminals continue to leverage increasingly varied and sophisticated threat vectors, many companies’ endpoints represent under-secured, unnecessary risks for customers, partners and internal users,” said Andrew Young, SVP of product management at WatchGuard. “By correlating our enterprise-grade network security services with data collected from each individual device, WatchGuard can now provide actionable intelligence that enables comprehensive security from the network to the endpoint.”
TDR allows organisations to protect themselves from cyber threats by correlating events from their UTM appliances and their endpoints. This pinpoints malicious behaviour by using heuristics and threat intelligence and scores them by risk and severity.
TDR also enables MSSPs and Value-added Resellers (VARs) to increase the value of their product and service offerings with the ability to provide detection, correlation and response services from the network to the endpoint; manage countless subscriber accounts with ease; and offer a single, comprehensive security solution through the Total Security Suite.
“Threat Detection and Response tightly and easily integrates with network defences to add powerful correlation capabilities,” said Dave Ashton, Sales Director at WatchGuard channel partner Sec-1 Limited. “The correlated detection and automated response features add a missing layer to the security stack which will enable our customers to immediately detect infections, such as Ransomware, APTs, Trojans and keyloggers, automatically preventing them from spreading within the network."
The new service includes the following features and benefits:
- ThreatSync – provides real-time threat detection and policy-based automated response through cloud-based correlation and scoring. It consumes event data from Firebox appliances, Host Sensors on endpoints and cloud threat intelligence feeds, correlates the data to generate comprehensive threat scores and initiates automatic malware response tactics. This intelligent prioritisation of each individual threat based on its overall level of risk ultimately allows organisations to decrease time to detection and remediation.
- Lightweight Host Sensors – extends organisations’ visibility and management to the endpoint by continuously scanning and monitoring security events on devices and sending them back to ThreatSync for analysis, scoring and remediation. Previously a frustrating security blind spot for most organisations, this constant flow of data from devices beyond the traditional network perimeter allows users to visualise and address endpoint threats.
- UTM Network Security Services – adds yet another layer of intelligence into the correlation and scoring process. WatchGuard Firebox M Series, T Series and XTMv appliances, as well as existing TSS services like APT Blocker, WebBlocker, Reputation Enabled Defense and Gateway AntiVirus, also pass threat data through ThreatSync.
- Host Ransomware Prevention (HRP) module – enables industry-leading prevention against ransomware attacks. HRP, along with the advanced malware protection provided through APT Blocker, blocks the execution of ransomware before file encryption takes place on the endpoint, mitigating the ransomware attack before any damage is done.
- Additional Security Layer to Existing Antivirus (AV) – means that users or MSSPs don’t need to replace existing AV solutions already deployed. TDR works in tandem with existing AV, bringing an additional, powerful layer of threat detection and event correlation to catch anything that AV might miss or be unable to remediate.
Threat Detection and Response Service is now available as part of the WatchGuard Total Security Suite. For more information, visit www.watchguard.com/TDR.
- TDR Brochure
- TDR Tech Brief
- Host Sensor Feature Brief
- ThreatSync Feature Brief
- eBook: Achieving Security Bliss through Correlation
About WatchGuard Technologies
WatchGuard® Technologies, Inc. is a global leader in network security, providing best-in-class Unified Threat Management, Next Generation Firewall, secure Wi-Fi, and network intelligence products and services to more than 75,000 customers worldwide. The company’s mission is to make enterprise-grade security accessible to companies of all types and sizes through simplicity, making WatchGuard an ideal solution for Distributed Enterprises and SMBs. WatchGuard is headquartered in Seattle, Washington, with offices throughout North America, Europe, Asia Pacific, and Latin America. To learn more, visit WatchGuard.com.
For additional information, promotions and updates, follow WatchGuard on Twitter, @WatchGuard on Facebook, or on the LinkedIn Company page. Also, visit our InfoSec blog, Secplicity, for real-time information about the latest threats and how to cope with them at www.secplicity.org.
Rowena Case, WatchGuard Technologies
0203 608 9070, firstname.lastname@example.org
Peter Rennison, PRPR
01442 245030, email@example.com