RSA Live August 2014 Content Announcement

[Anonymous]

We are pleased to announce the release of our August Content pack in RSA Live for Security Analytics! This release continues last month’s focus on illuminating instances of sensitive data leakage and offers content designed to profile host and user activity. We’ll also be introducing our first batch of correlation rules connecting the dots between what SA is seeing “on the wire” and ECAT’s host-based alerts. Last but not least, this release expands our ability to provide our customers with the tools to detect potential identity theft and abuse.

Detection of Data Exfiltration

• Introducing new Application rules, ESA rules, and Reports for detecting large outbound connections to cloud services, 3^rd party mailers, and common posting sites. Also included is detection content to help customers identify instances of internal data harvesting and subsequent posting to cloud drive services.

ECAT & Security Analytics

• ECAT does an excellent job of detecting advanced threats affecting a host. To further complement its detection ability is a set of ESA rules that will look at both ECAT alerts and a protected host’s activity on the network. This builds a foundation for providing an unparalleled level of insight into the stealthiest of advanced threats. New are four ESA rules for correlating ECAT alerts with:

• Core Botnet alerting
• Beaconing activity
• Audit log clearing
• Suspicious encrypted traffic

Identity

• As Identity theft, fraud, and abuse further escalates to the top of our customers concerns, new content is being developed to help detect unauthorized, abusive, or fraudulent user activity occurring on their networks. Identity content includes:

• 2 ESA rules for detecting unusual administrative activity and suspicious account removal
• 3 Reports for summarizing user account activity, privileged account activity, and all activity associated with a particular user list

Additional Log Support

•   Support for Cisco Meraki and Safenet HSM platforms as well as updated support for 2 new and 28 updates