Threat Management

Aujas Threat Management Services can help you manage threats through vulnerability management frameworks and proactively identify known and unknown threats to predict, detect, and neutralize them in advance.

We also have innovated an automated threat hunting platform to gather context aware intelligence from external and internal sources to bolster your security defenses. The platform has Hadoop, Big Data & R as analytics tools to identify frauds, thefts, and data misuse.

Aujas Threat Management team can help you with:

• IoC Management
• Hunt Mission Searches
• Threat Intelligence analysis and actionable reporting
• Observable Threat lookups
• Reporting
• Incident/Event enrichment

A. Threat Intelligence

Threat Intelligence Analysis

• Subscribe to specific strategic and tactical threat intelligence feeds.
• Identify threat intelligence feeds from multiple sources, including open sources.
• Perform vulnerability research, reverse malware analysis, IoC details and map to critical assets for applicability and identify actionable Threat Intelligence application – Usable and Actionable
• Normalization of feeds into a common taxonomy.
• De-duplication across feeds to remove false positives.
• Enrich data with actor, campaign, Tactics, Techniques, and Procedures (TTP).
• Associate related threat indicators.
• STIX, TAXII, and SDK base integrations.

B. Exchange & Automation

Threat Intelligence Ingestion

• Open source sites & 3rd party vendors.
• STIX/TAXII feeds.
• Unstructured intelligence (PDFs, CSVs, emails).
• ISAC/ISAO shared threat intelligence.

Threat Intelligence Exchange

• STIX/TAXII for export out of the platform.
• Deep integration with SIEM, FW, IPS, endpoint.
• Scalable based on the number of indicators.
• Risk ranks threats via machine learning.
• Includes threat bulletins from Anomali Labs.
• Secure two-way collaboration.

C. Hunt Missions

Hypothesis Building

• Build hypotheses like high risk users, frequent travelers, critical system connections, and transactions, including identification of patterns and anomalies.

Hypothesis Testing

• Perform host scanning and assessments (To determine the existence of a previously undetected compromise or malware and conducted using authentication logs, packets, and endpoint data).
• Run hypothesis and obtain anomalies.
• Identify patterns using machine learning and hunt for anomalies.

Actionable Preparation

• Provide actionable for mitigation of threats/anomalies.
• Verify and incorporate learnings.

D. Proactive Threat Discovery

Actionable Threat & Vulnerability Intelligence

• Multiple threat & vulnerability intelligence feed ingestion & analysis.
• Actionable T&V intelligence for clients.
• Strategic feed analysis for IOC, threat actors, and vulnerabilities.
• Mapping with customer assets for actionable recommendations.

Threat Hunting

• Proactive threat hunting with strategic feeds, vulnerability, threat intelligence, and hypothesis management strategy.
• Reporting and auto remediation with SIEM integration.

Managed Deception

• Decoy strategy – File, Network, Users, and End Points.
• Monitoring & Notification.
• Integration with SIEM & Response.

We have five core competencies to address specific needs of threat mitigation. The objective is to transform your existing security posture through customized security services, enhancing detection speeds, hunt, and response times.

• Intelligence: Collection, optimization, and enrichment of threat intelligence.
• Investigation: Understand cyber threats with business context and environment.
• Detection: Proactive detection of active, serious threats targeting your networks.
• Automation: Eliminate manual processes and streamline investigation and response.
• Collaboration: Secure threat sharing via trusted circles, ISACs and ISAOs.

TMS Focus Areas:

We realize every organization’s security needs are different, and an optimized security operations model is needed to drive threat management plans to manage potential security risks and meet compliance. Our team of experts can continuously monitor your security posture and protect your intellectual property, infrastructure, critical assets, and brand reputation.

Our resource capability brief:

• CoE (Center of Excellence) driven approach to align experts and provide security support globally.
• Transform existing SOC, and retain advanced correlation capabilities, integrate tactical intelligence through STIX/TAXII protocols, improve workflow capability for incident escalation, tracking, and reporting.
• Automate vulnerability management processes, remediation workflow, and provide vulnerability intelligence.