Skip to main content

Posts

AWS ECS Integration

CloudHunter Amazon ECS Integration

Sift Security CloudHunter integrates with Amazon EC2 Container Service (ECS) to enable improved visibility and enhance detection, threat hunting, and incident response capabilities.  For ECS instances, CloudHunter provides high-fidelity anomaly detection results to identify potentially compromised instances. CloudHunter considers the quality of the baseline when determining how to prioritize alerts. Because containers are generally single-purpose and homogeneous, they have highly predictable baselines, from which CloudHunter can easily identify and prioritize abnormal behavior. CloudHunter also provides useful visualizations around ECS Instances, such as which auto scaling groups and images they are created from, and what users are responsible for any changes made to them.  

The screenshot below shows CloudHunter being used to investigate a compromised ECS instance.  The graph shows all the instances of a container, with an alert for one of the nine in…
Recent posts

Integrating with Amazon Inspector

Sift Security CloudHunter integrates with Amazon Inspector to enable enhanced detection, threat hunting, and accelerated incident response. Integrating AWS Inspector with CloudHunter allows organizations to take advantage of an additional security in the cloud. With AWS inspector you can: periodic files scans to identify misconfigurationsScan for insecure network protocolsScans application processes for bad default settingsScans for authentication best practices on AMI accounts.Scan installed operating system packages for a pre-determined list of CVEs
Key Features Dashboards summarize the total number of vulnerabilities, the instances with the most vulnerabilities, and other context about vulnerabilities found by your scanner.

Effective Management of Security Incidents

You'll be excited to hear that we released an additional tab under the Risks view of our product, to enable Incident Management. The Incidents tab surfaces the highest fidelity alerts that should be prioritized in terms of investigations and/or proactive hunting and enables management of those incidents.


Here's what you need to know about this new tab: What are the Key features?Visualization - dashboards and tables summarizing incidents Creation - create/edit incidents, manually or automatically Notification - set up notification options (Ticketing, Slack, Email,

Who's watching your data?

Open to the internet

Let's face it, cybersecurity can be a scary business, so what better time of year to highlight the fears of cyber crime than Halloween?
We've all heard the scary stories, read the chilling books, and watched the horror movies where someone is being watched - picture the scene with the creepy guy standing outside the house, looking back in through the window. Most of us close our curtains and lock our windows and doors at night before going to bed, hoping not to encounter the creepy guy. But If we go to great lengths to stop someone peeping into our private lives, or getting into our home, then why don't we do the same with our data; especially our data that's in the cloud. It's scary to think that a lot of data, especially on public clouds is left open to the internet. According to our security market research, nearly 80% of databases in amazon cloud are left unencrypted, of which 30% are open to the internet. The smart hackers who know about thi…

Sift Security + Visa Threat Intelligence

Incident responders and threat hunters depend on high fidelity threat intelligence to get early notification of attacks.  Threat intelligence is most useful when it describes attacks targeting peer organizations and it includes important contextual information.  This contextual information can include what types of attacks the indicators of compromise (IoCs) represent, when they were first observed, and how they are related to other IoCs.  
Sift Security has teamed up with Visa Threat Intelligence (VTI) to help merchants determine if they have been a target of a breach and to avoid future breaches. VTI provides high fidelity IoCs curated by Visa’s Risk and Fraud team, who work with merchants to collect and analyze TTP’s (Tactics, Techniques & Procedures) used by crime organizations during a breaches targeting merchants.  Sift Security combines VTI into our security graph analytics platform to enable timely notification of potential breaches and effective threat hunting.  
To help…