Cybersecurity giant Palo Alto Networks is launching its new Identity Threat Detection and Response module for its autonomous security operations center (SOC) solution Cortex XSIAM.
The Santa Clara, Calif.-based firm says the new solution enables customers to ingest user identity and behavior data and deploy AI technology to help detect identity-driven attacks within seconds, strengthening XSIAM’s ability to consolidate multiple security operations tools into a unified, AI-driven SOC platform.
The Identity Threat Detection and Response (ITDR) module comes in the wake of several high-profile identity-driven attacks that target user credentials to access systems. In a news release, Palo Alto highlights the actions of Lapsus$, a hacking group that targets privileged user credentials to gain access to victim systems.
The group’s victims have included Okta, Nvidia, Samsung, Microsoft, Uber and others.
According to Palo Alto Networks, the ITDR module ingests and integrates user behavior data such as when employees work, and which data and applications they access. The module processes data from a variety of sources, including authentication services, endpoint logs, cloud identity data, email and HR data, network, OS and custom sources.
The built-in AI Models can be trained to flag suspicious activity based on irregular user behavior to help IT and security teams get ahead of insider risks like configuration manipulation, file manipulation and modification of permissions, the company says.
In addition, the ITDR module reduces complexity by integrating identity analytics into a unified SOC platform, the company says.
Cortex XSIAM already natively integrates security information and event management (SIEM), endpoint detection and response (EDR), network detection and response (NDR), security, orchestration and response (SOAR), Threat Intelligence Management (TIM) and Attack Surface management (ASM) capabilities, replacing the need for multiple point solutions, according to Palto Alto Networks.
In a statement, Gonen Fink, senior vice president of Cortex products at Palo Alto Networks, says customers who want to detect identity-related attacks must deploy multiple tools, with each providing a partial view into user activities.
“Such disjointed approaches result in poor security outcomes, alert overload, and time wasted on triage,” Fink says. “With the addition of ITDR, the XSIAM platform now integrates all identity data sources into a single security data foundation spanning endpoints, networks and cloud. This allows our customers to run comprehensive AI-driven threat detection to protect against stealthy identity-driven attacks.”
