Scribd
Upload
1 views

Security Operations Center

The document outlines key components of a Security Operations Center, including data loss prevention, unified threat management, and secure access service edge. It discusses various technologies such as SIEM, SOAR, and Cortex solutions for endpoint protection, threat intelligence, and IoT security. Additionally, it highlights the importance of integrating security functions and utilizing advanced analytics for effective security operations.

Uploaded by

darshilvijay6371
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
1 views

Security Operations Center

The document outlines key components of a Security Operations Center, including data loss prevention, unified threat management, and secure access service edge. It discusses various technologies such as SIEM, SOAR, and Cortex solutions for endpoint protection, threat intelligence, and IoT security. Additionally, it highlights the importance of integrating security functions and utilizing advanced analytics for effective security operations.

Uploaded by

darshilvijay6371
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 22

Security Operations Center

Fundamentals
Data loss prevention

Inspect and prevent sensitive data from leaving a network such as:
▪ Personally identifiable information (PII)
▪ Classified materials
▪ Intellectual property, trade secrets, proprietary information
Unified threat management

An appliance that combines multiple security functions such as:


▪ Anti-malware
▪ Anti-spam
▪ Content filtering
▪ Data loss prevention
▪ Firewall (stateful inspection)
▪ IDS/IPS
▪ VPN
Secure access service edge
A unified, cloud-delivered solution that converges networking and security services

• Networking
▪ Software-defined wide-area network (SD-WAN)
▪ Virtual private network (VPN)
▪ Zero Trust network access (ZTNA)
▪ Quality of service (QoS)
• Security
▪ Firewall as a service (FWaaS)
▪ Domain Name System (DNS) security
▪ Threat prevention
▪ Secure web gateway (SWG)
▪ Data loss prevention (DLP)
▪ Cloud access security broker (CASB)
SIEM - Security information and event management

• Collects information generated by various network devices and applications


• Provides:
▪ Real-time monitoring
▪ Event correlation
▪ Analysis
▪ Notification of security alerts
SOAR - Security Orchestration, Automation, and Response

• Playbooks
• Integrations
Secure the Future (Cortex)

Endpoint protection (Cortex XDR)

Cortex XSOAR

Cortex Data Lake

Threat intelligence (AutoFocus)

IoT security (Zingbox)


Secure the Future (Cortex)
Struggles of a security analyst
Endpoint protection (Cortex XDR)
Malicious files vs. exploits
Endpoint protection (Cortex XDR)
Cortex XDR uses multiple technologies & techniques to protect endpoints from known & unknown malware
Endpoint protection (Cortex XDR)
Behavioral threat protection with Cortex XDR
Endpoint protection (Cortex XDR)
Cortex XDR focuses on exploit techniques rather than on the exploits themselves
Endpoint protection (Cortex XDR)
Cortex XDR: Investigate and respond to attacks
Endpoint protection (Cortex XDR)
The Cortex XDR dashboard
Endpoint protection (Cortex XDR)
Native integration with network, endpoint, and cloud apps as well as WildFire threat intelligence
Endpoint protection (Cortex XDR)
Cortex XDR speeds alert triage and incident response
Cortex XSOAR
Cortex XSOAR ingests alerts and IoCs from multiple sources and executes playbooks to respond to incidents
Cortex Data Lake

• Elastic cloud-based service provides on-demand compute and storage scalability

• Automatically collects, integrates, and normalizes data across security


infrastructure

• Unified data enables advanced AI and machine learning to radically simplify


security operations with apps built on Cortex

• Strict privacy and security controls prevent unauthorized access


Threat intelligence (AutoFocus)
Palo Alto Networks AutoFocus Threat Intelligence Cloud
Threat intelligence (AutoFocus)
Key capabilities

• Priority alerts and tags

• Threat correlation

• Actionable intelligence

• Threat indicator sharing (MineMeld)


Threat intelligence (AutoFocus)
MineMeld aggregates and correlates threat intelligence feeds
IoT security (Zingbox)

• Zingbox IoT Guardian automates orchestration of IoT lifecycle (security,


management, and optimization

• Unique IoT personality-based approach to secure and manage IoT devices with
integrated IoT security based on machine learning

• Automate threat detection and response from a single system

You might also like