Endpoint security vendor Carbon Black has introduced Cb ThreatHunter, which delivers advanced threat hunting and IR capabilities on the company’s security cloud.
Generally available in November, it will be the fourth service delivered on Carbon Black’s Predictive Security Cloud (PSC) this year.
Patrick Morley, Carbon Black’s Chief Executive Officer, said: “With the addition of Cb ThreatHunter, this platform will have five offerings and delivers customers the ability to prevent, detect, respond to, predict, and now hunt threats in the cloud using a single agent, single console and single platform.”
PSC, Carbon Black’s powerful endpoint protection platform, consolidates multiple critical endpoint security capabilities supporting both IT and security operations, including: next-generation antivirus (NGAV) plus endpoint detection and response (EDR); advanced threat hunting and IR; virtualised data centre security; real-time endpoint query and remediation; and managed threat hunting and triage.
According to Carbon Black, most EDR and IR tools on the market collect only a limited set of historical data. As a result, SOCs and IR teams struggle to get their hands on the information they need to investigate, proactively hunt and remediate.
Cb ThreatHunter solves this problem by continuously collecting unfiltered data, giving security teams all the information they need to: proactively hunt threats, uncover suspicious behaviour, disrupt active attacks, repair damage quickly and address gaps in defences. Investigations that often take days or weeks can be completed in just minutes with Cb ThreatHunter.
PSC offers security teams advanced threat hunting and IR capabilities, including:
More powerful search fields: Cb ThreatHunter equips security teams with the ability to flexibly hunt threats, even if an endpoint is offline. With this level of visibility, researchers can see what happened at every stage of an attack with intuitive attack-chain visualisations, and uncover advanced threats, while minimising attacker dwell time.
This insight provides immediate answers with comprehensive behavioural context to stop attacks as quickly as possible.
Enhanced threat intel matching: Cb ThreatHunter’s sophisticated detection combines custom and cloud-delivered threat intel, automated watchlists and integrations with the rest of the security stack to efficiently scale hunting across the enterprise. This advanced level of detection allows security teams to proactively explore environments for abnormal activity, leverage cloud-delivered threat intelligence and automate repeat hunts.
Additionally, the PSC’s platform extensibility allows developers to create custom watchlists to power real-time detection and correlate data across the security stack.
Elastic cloud scalability: Cb ThreatHunter is natively built on the PSC, allowing security teams to rapidly deploy and scale the solution across their enterprise without investing in (or maintaining) on-premise infrastructure. By eliminating these costs and processes, Cb ThreatHunter enables teams to simplify their operations and focus their energy on hunting and responding to threats.