{"global":{"lastError":{},"locale":"en","locales":{"data":[{"id":"de","name":"Deutsch"},{"id":"en","name":"English"}],"loading":false,"error":false},"currency":{"id":49,"name":"EUR"},"currencies":{"data":[{"id":49,"name":"EUR"},{"id":124,"name":"RUB"},{"id":153,"name":"UAH"},{"id":155,"name":"USD"}],"loading":false,"error":false},"translations":{"product":{"reference-bonus":{"ru":"Предложить бонус за референс","_type":"localeString","en":"Offer a reference bonus"},"configurator":{"_type":"localeString","en":"Сonfigurator","ru":"Конфигуратор"},"i-sell-it":{"ru":"I sell it","_type":"localeString","en":"I sell it"},"i-use-it":{"en":"I use it","ru":"I use it","_type":"localeString"},"roi-calculator":{"en":"ROI-calculator","ru":"ROI-калькулятор","_type":"localeString"},"selling":{"ru":"Продают","_type":"localeString","en":"Selling"},"using":{"en":"Using","ru":"Используют","_type":"localeString"},"show-more-button":{"ru":"Показать еще","_type":"localeString","en":"Show more"},"hide-button":{"_type":"localeString","en":"Hide","ru":"Скрыть"},"supplier-popover":{"ru":"поставщик","_type":"localeString","en":"supplier"},"implementation-popover":{"ru":"внедрение","_type":"localeString","en":"deployment"},"manufacturer-popover":{"en":"manufacturer","ru":"производитель","_type":"localeString"},"short-description":{"_type":"localeString","en":"Pitch","ru":"Краткое описание"},"i-use-it-popover":{"ru":"Внесите свое внедрение и получите бонус от ROI4CIO или поставщика.","_type":"localeString","en":"Make your introduction and get a bonus from ROI4CIO or the supplier."},"details":{"ru":"Детальнее","_type":"localeString","en":"Details"},"description":{"_type":"localeString","en":"Description","ru":"Описание"},"product-features":{"_type":"localeString","en":"Product features","ru":"Особенности продукта"},"categories":{"en":"Categories","ru":"Категории","_type":"localeString"},"solutions":{"en":" Problems that solves","ru":"Проблемы которые решает","_type":"localeString"},"values":{"ru":"Ценности","_type":"localeString","en":"Values"},"сomparison-matrix":{"_type":"localeString","en":"Comparison matrix","ru":"Матрица сравнения"},"testing":{"ru":"Тестирование","_type":"localeString","en":"Testing"},"compare":{"_type":"localeString","en":"Compare with competitors","ru":"Сравнить с конкурентами"},"characteristics":{"ru":"Характеристики","_type":"localeString","en":" Characteristics"},"transaction-features":{"_type":"localeString","en":"Transaction Features","ru":"Особенности сделки"},"average-discount":{"_type":"localeString","en":"Partner average discount","ru":"Средняя скидка партнера"},"deal-protection":{"_type":"localeString","en":"Deal protection","ru":"Защита сделки"},"average-deal":{"ru":"Средний размер сделки","_type":"localeString","en":"Average deal size"},"average-time":{"_type":"localeString","en":"Average deal closing time","ru":"Средний срок закрытия сделки"},"login":{"ru":"Войти","_type":"localeString","en":"Login"},"register":{"en":"Register","ru":"Зарегистрироваться","_type":"localeString"},"to-know-more":{"en":"To know more","ru":"Чтобы узнать больше","_type":"localeString"},"scheme":{"ru":"Схема работы","_type":"localeString","en":" Scheme of work"},"competitive-products":{"ru":"Конкурентные продукты","_type":"localeString","en":" Competitive products"},"implementations-with-product":{"ru":"Внедрения с этим продуктом","_type":"localeString","en":"Deployments with this product"},"user-features":{"en":"User features","ru":"Особенности пользователей","_type":"localeString"},"job-roles":{"en":" Roles of Interested Employees","ru":"Роли заинтересованных сотрудников","_type":"localeString"},"organizational-features":{"ru":"Организационные особенности","_type":"localeString","en":"Organizational Features"},"calculate-price":{"ru":"Рассчитать цену продукта","_type":"localeString","en":" Calculate product price"},"selling-stories":{"en":" Selling stories","ru":"Продающие истории","_type":"localeString"},"materials":{"en":"Materials","ru":"Материалы","_type":"localeString"},"about-product":{"ru":"О продукте","_type":"localeString","en":"About Product"},"or":{"_type":"localeString","en":"or","ru":"или"},"program-sends-data":{"en":"Program Sends Data","_type":"localeString"},"calculate-roi":{"en":"Calculate Product ROI","ru":"Рассчитать ROI продукта","_type":"localeString"},"complementary-categories":{"ru":"Схожие категории","_type":"localeString","en":"Complementary Categories"},"program-receives-data":{"_type":"localeString","en":"Program Receives Data"},"rebate":{"en":"Bonus","ru":"Бонус","_type":"localeString"},"rebate-for-poc":{"ru":"Бонус 4 POC","_type":"localeString","en":"Bonus 4 POC"},"configurator-content":{"ru":"Рассчитайте стоимость продукта","_type":"localeString","en":"Calculate price for this product here"},"configurator-link":{"en":"here","ru":"тут","_type":"localeString"},"vendor-popover":{"_type":"localeString","en":"vendor","ru":"производитель"},"user-popover":{"ru":"пользователь","_type":"localeString","en":"user"},"select-for-presentation":{"ru":"выбрать продукт для презентации","_type":"localeString","en":"select product for presentation"},"auth-message":{"_type":"localeString","en":"You have to register or login.","ru":"Вам нужно зарегистрироваться или войти."},"add-to-comparison":{"ru":"Добавить в сравнение","_type":"localeString","en":"Add to comparison"},"added-to-comparison":{"_type":"localeString","en":"Added to comparison","ru":"Добавлено в сравнения"},"roi-calculator-content":{"ru":"Рассчитайте ROI для данного продукта","_type":"localeString","en":"Calculate ROI for this product here"},"not-yet-converted":{"en":"Data is moderated and will be published soon. Please, try again later.","ru":"Данные модерируются и вскоре будут опубликованы. Попробуйте повторить переход через некоторое время.","_type":"localeString"},"videos":{"_type":"localeString","en":"Videos","ru":"Видео"},"vendor-verified":{"ru":"Подтверждено производителем","_type":"localeString","en":"Vendor verified"},"event-schedule":{"_type":"localeString","en":"Events schedule","ru":"Расписание событий"},"scheduling-tip":{"ru":"Выберите удобную дату и время и зарегистрируйтесь на ивент.","_type":"localeString","en":"Please, сhoose a convenient date and time and register for the event."},"register-to-schedule":{"en":"To register for the event please log in or register on the site.","ru":"Для того чтобы зарегистрироваться на ивент пожалуйста авторизируйтесь или зарегистрируйтесь на сайт.","_type":"localeString"},"comparison-matrix":{"ru":"Матрица сравнений","_type":"localeString","en":"Comparison matrix"},"compare-with-competitive":{"_type":"localeString","en":" Compare with competitive","ru":"Сравнить с конкурентными"},"avg-deal-closing-unit":{"en":"months","ru":"месяцев","_type":"localeString"},"under-construction":{"_type":"localeString","en":"Current feature is still developing to become even more useful for you.","ru":"Данная услуга всё ещё находится в разработке."},"product-presentation":{"en":"Product presentation","ru":"Презентация продукта","_type":"localeString"},"go-to-comparison-table":{"ru":"Перейти к таблице сравнения","_type":"localeString","en":" Go to comparison table"},"see-product-details":{"en":"See Details","ru":"Детали","_type":"localeString"}},"header":{"help":{"ru":"Помощь","_type":"localeString","en":"Help","de":"Hilfe"},"how":{"_type":"localeString","en":"How does it works","de":"Wie funktioniert es","ru":"Как это работает"},"login":{"de":"Einloggen","ru":"Вход","_type":"localeString","en":"Log in"},"logout":{"ru":"Выйти","_type":"localeString","en":"Sign out"},"faq":{"en":"FAQ","de":"FAQ","ru":"FAQ","_type":"localeString"},"references":{"de":"References","ru":"Мои запросы","_type":"localeString","en":"Requests"},"solutions":{"ru":"Возможности","_type":"localeString","en":"Solutions"},"find-it-product":{"ru":"Подбор и сравнение ИТ продукта","_type":"localeString","en":"Selection and comparison of IT product"},"autoconfigurator":{"ru":"Калькулятор цены","_type":"localeString","en":" Price calculator"},"comparison-matrix":{"ru":"Матрица сравнения","_type":"localeString","en":"Comparison Matrix"},"roi-calculators":{"_type":"localeString","en":"ROI calculators","ru":"ROI калькуляторы"},"b4r":{"ru":"Бонус за референс","_type":"localeString","en":"Bonus for reference"},"business-booster":{"_type":"localeString","en":"Business boosting","ru":"Развитие бизнеса"},"catalogs":{"ru":"Каталоги","_type":"localeString","en":"Catalogs"},"products":{"en":"Products","ru":"Продукты","_type":"localeString"},"implementations":{"ru":"Внедрения","_type":"localeString","en":"Deployments"},"companies":{"ru":"Компании","_type":"localeString","en":"Companies"},"categories":{"en":"Categories","ru":"Категории","_type":"localeString"},"for-suppliers":{"en":"For suppliers","ru":"Поставщикам","_type":"localeString"},"blog":{"_type":"localeString","en":"Blog","ru":"Блог"},"agreements":{"en":"Deals","ru":"Сделки","_type":"localeString"},"my-account":{"_type":"localeString","en":"My account","ru":"Мой кабинет"},"register":{"_type":"localeString","en":"Register","ru":"Зарегистрироваться"},"comparison-deletion":{"_type":"localeString","en":"Deletion","ru":"Удаление"},"comparison-confirm":{"en":"Are you sure you want to delete","ru":"Подтвердите удаление","_type":"localeString"},"search-placeholder":{"ru":"Введите поисковый запрос","_type":"localeString","en":"Enter your search term"},"my-profile":{"ru":"Мои данные","_type":"localeString","en":"My profile"},"about":{"_type":"localeString","en":"About Us"},"it_catalogs":{"_type":"localeString","en":"IT catalogs"},"roi4presenter":{"_type":"localeString","en":"Roi4Presenter"},"roi4webinar":{"_type":"localeString","en":"Pitch Avatar"},"sub_it_catalogs":{"_type":"localeString","en":"Find IT product"},"sub_b4reference":{"_type":"localeString","en":"Get reference from user"},"sub_roi4presenter":{"_type":"localeString","en":"Make online presentations"},"sub_roi4webinar":{"en":"Create an avatar for the event","_type":"localeString"},"catalogs_new":{"_type":"localeString","en":"Products"},"b4reference":{"en":"Bonus4Reference","_type":"localeString"},"it_our_it_catalogs":{"en":"Our IT Catalogs","_type":"localeString"},"it_products":{"_type":"localeString","en":"Find and compare IT products"},"it_implementations":{"_type":"localeString","en":"Learn implementation reviews"},"it_companies":{"en":"Find vendor and company-supplier","_type":"localeString"},"it_categories":{"_type":"localeString","en":"Explore IT products by category"},"it_our_products":{"_type":"localeString","en":"Our Products"},"it_it_catalogs":{"en":"IT catalogs","_type":"localeString"}},"footer":{"copyright":{"en":"All rights reserved","de":"Alle rechte vorbehalten","ru":"Все права защищены","_type":"localeString"},"company":{"en":"My Company","de":"Über die Firma","ru":"О компании","_type":"localeString"},"about":{"_type":"localeString","en":"About us","de":"Über uns","ru":"О нас"},"infocenter":{"de":"Infocenter","ru":"Инфоцентр","_type":"localeString","en":"Infocenter"},"tariffs":{"_type":"localeString","en":"Subscriptions","de":"Tarife","ru":"Тарифы"},"contact":{"ru":"Связаться с нами","_type":"localeString","en":"Contact us","de":"Kontaktiere uns"},"marketplace":{"en":"Marketplace","de":"Marketplace","ru":"Marketplace","_type":"localeString"},"products":{"ru":"Продукты","_type":"localeString","en":"Products","de":"Produkte"},"compare":{"de":"Wähle und vergleiche","ru":"Подобрать и сравнить","_type":"localeString","en":"Pick and compare"},"calculate":{"de":"Kosten berechnen","ru":"Расчитать стоимость","_type":"localeString","en":"Calculate the cost"},"get_bonus":{"en":"Bonus for reference","de":"Holen Sie sich einen Rabatt","ru":"Бонус за референс","_type":"localeString"},"salestools":{"en":"Salestools","de":"Salestools","ru":"Salestools","_type":"localeString"},"automatization":{"ru":"Автоматизация расчетов","_type":"localeString","en":"Settlement Automation","de":"Abwicklungsautomatisierung"},"roi_calcs":{"_type":"localeString","en":"ROI calculators","de":"ROI-Rechner","ru":"ROI калькуляторы"},"matrix":{"en":"Comparison matrix","de":"Vergleichsmatrix","ru":"Матрица сравнения","_type":"localeString"},"b4r":{"ru":"Rebate 4 Reference","_type":"localeString","en":"Rebate 4 Reference","de":"Rebate 4 Reference"},"our_social":{"en":"Our social networks","de":"Unsere sozialen Netzwerke","ru":"Наши социальные сети","_type":"localeString"},"subscribe":{"_type":"localeString","en":"Subscribe to newsletter","de":"Melden Sie sich für den Newsletter an","ru":"Подпишитесь на рассылку"},"subscribe_info":{"_type":"localeString","en":"and be the first to know about promotions, new features and recent software reviews","ru":"и узнавайте первыми об акциях, новых возможностях и свежих обзорах софта"},"policy":{"ru":"Политика конфиденциальности","_type":"localeString","en":"Privacy Policy"},"user_agreement":{"ru":"Пользовательское соглашение ","_type":"localeString","en":"Agreement"},"solutions":{"en":"Solutions","ru":"Возможности","_type":"localeString"},"find":{"en":"Selection and comparison of IT product","ru":"Подбор и сравнение ИТ продукта","_type":"localeString"},"quote":{"ru":"Калькулятор цены","_type":"localeString","en":"Price calculator"},"boosting":{"ru":"Развитие бизнеса","_type":"localeString","en":"Business boosting"},"4vendors":{"ru":"поставщикам","_type":"localeString","en":"4 vendors"},"blog":{"ru":"блог","_type":"localeString","en":"blog"},"pay4content":{"en":"we pay for content","ru":"платим за контент","_type":"localeString"},"categories":{"_type":"localeString","en":"categories","ru":"категории"},"showForm":{"ru":"Показать форму","_type":"localeString","en":"Show form"},"subscribe__title":{"_type":"localeString","en":"We send a digest of actual news from the IT world once in a month!","ru":"Раз в месяц мы отправляем дайджест актуальных новостей ИТ мира!"},"subscribe__email-label":{"ru":"Email","_type":"localeString","en":"Email"},"subscribe__name-label":{"_type":"localeString","en":"Name","ru":"Имя"},"subscribe__required-message":{"ru":"Это поле обязательное","_type":"localeString","en":"This field is required"},"subscribe__notify-label":{"ru":"Да, пожалуйста уведомляйте меня о новостях, событиях и предложениях","_type":"localeString","en":"Yes, please, notify me about news, events and propositions"},"subscribe__agree-label":{"_type":"localeString","en":"By subscribing to the newsletter, you agree to the %TERMS% and %POLICY% and agree to the use of cookies and the transfer of your personal data","ru":"Подписываясь на рассылку, вы соглашаетесь с %TERMS% и %POLICY% и даете согласие на использование файлов cookie и передачу своих персональных данных*"},"subscribe__submit-label":{"ru":"Подписаться","_type":"localeString","en":"Subscribe"},"subscribe__email-message":{"ru":"Пожалуйста, введите корректный адрес электронной почты","_type":"localeString","en":"Please, enter the valid email"},"subscribe__email-placeholder":{"ru":"username@gmail.com","_type":"localeString","en":"username@gmail.com"},"subscribe__name-placeholder":{"_type":"localeString","en":"Last, first name","ru":"Имя Фамилия"},"subscribe__success":{"ru":"Вы успешно подписаны на рассылку. Проверьте свой почтовый ящик.","_type":"localeString","en":"You are successfully subscribed! Check you mailbox."},"subscribe__error":{"_type":"localeString","en":"Subscription is unsuccessful. Please, try again later.","ru":"Не удалось оформить подписку. Пожалуйста, попробуйте позднее."},"roi4presenter":{"_type":"localeString","en":"Roi4Presenter","de":"roi4presenter","ru":"roi4presenter"},"it_catalogs":{"_type":"localeString","en":"IT catalogs"},"roi4webinar":{"_type":"localeString","en":"Pitch Avatar"},"b4reference":{"_type":"localeString","en":"Bonus4Reference"}},"breadcrumbs":{"home":{"ru":"Главная","_type":"localeString","en":"Home"},"companies":{"ru":"Компании","_type":"localeString","en":"Companies"},"products":{"ru":"Продукты","_type":"localeString","en":"Products"},"implementations":{"_type":"localeString","en":"Deployments","ru":"Внедрения"},"login":{"en":"Login","ru":"Вход","_type":"localeString"},"registration":{"ru":"Регистрация","_type":"localeString","en":"Registration"},"b2b-platform":{"ru":"Портал для покупателей, поставщиков и производителей ИТ","_type":"localeString","en":"B2B platform for IT buyers, vendors and suppliers"}},"comment-form":{"title":{"en":"Leave comment","ru":"Оставить комментарий","_type":"localeString"},"firstname":{"ru":"Имя","_type":"localeString","en":"First name"},"lastname":{"ru":"Фамилия","_type":"localeString","en":"Last name"},"company":{"ru":"Компания","_type":"localeString","en":"Company name"},"position":{"ru":"Должность","_type":"localeString","en":"Position"},"actual-cost":{"en":"Actual cost","ru":"Фактическая стоимость","_type":"localeString"},"received-roi":{"en":"Received ROI","ru":"Полученный ROI","_type":"localeString"},"saving-type":{"ru":"Тип экономии","_type":"localeString","en":"Saving type"},"comment":{"_type":"localeString","en":"Comment","ru":"Комментарий"},"your-rate":{"en":"Your rate","ru":"Ваша оценка","_type":"localeString"},"i-agree":{"ru":"Я согласен","_type":"localeString","en":"I agree"},"terms-of-use":{"ru":"С пользовательским соглашением и политикой конфиденциальности","_type":"localeString","en":"With user agreement and privacy policy"},"send":{"ru":"Отправить","_type":"localeString","en":"Send"},"required-message":{"_type":"localeString","en":"{NAME} is required filed","ru":"{NAME} - это обязательное поле"}},"maintenance":{"title":{"ru":"На сайте проводятся технические работы","_type":"localeString","en":"Site under maintenance"},"message":{"en":"Thank you for your understanding","ru":"Спасибо за ваше понимание","_type":"localeString"}}},"translationsStatus":{"product":"success"},"sections":{},"sectionsStatus":{},"pageMetaData":{"product":{"meta":[{"name":"og:type","content":"website"},{"content":"https://roi4cio.com/fileadmin/templates/roi4cio/image/roi4cio-logobig.jpg","name":"og:image"}],"translatable_meta":[{"name":"og:title","translations":{"_type":"localeString","en":"Example product","ru":"Конкретный продукт"}},{"name":"og:description","translations":{"_type":"localeString","en":"Description for one product","ru":"Описание для конкретного продукта"}},{"name":"title","translations":{"_type":"localeString","en":"Product","ru":"Продукт"}},{"name":"description","translations":{"_type":"localeString","en":"Product description","ru":"Описание продукта"}},{"name":"keywords","translations":{"en":"Product keywords","ru":"Ключевые слова продукта","_type":"localeString"}}],"title":{"ru":"ROI4CIO: Продукт","_type":"localeString","en":"ROI4CIO: Product"}}},"pageMetaDataStatus":{"product":"success"},"subscribeInProgress":false,"subscribeError":false},"auth":{"inProgress":false,"error":false,"checked":true,"initialized":false,"user":{},"role":null,"expires":null},"products":{"productsByAlias":{"threatq":{"id":5886,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/ThreatQuotient_Logo.png","logo":true,"schemeURL":"https://old.roi4cio.com/fileadmin/user_upload/THREATQ_Scheme.png","scheme":true,"title":"ThreatQ","vendorVerified":0,"rating":"1.00","implementationsCount":1,"suppliersCount":0,"supplierPartnersCount":0,"alias":"threatq","companyTitle":"ThreatQuotient, Inc.","companyTypes":["supplier","vendor"],"companyId":5844,"companyAlias":"threatquotient-inc","description":"<span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">To understand and stop threats more effectively and efficiently your existing security infrastructure and people need to work smarter, not harder. ThreatQ can serve as an open and extensible threat intelligence platform that accelerates security operations through streamlined threat operations and management. The integrated, self-tuning threat library, adaptive workbench and open exchange allow you to quickly understand threats, make better decisions and accelerate detection and response.<br /><br /><span style=\"font-weight: bold; \">HOW THREATQ WORKS:</span><br /><br /><span style=\"font-weight: bold; \">THREAT LIBRARY</span><br /></span>\r\n<span style=\"font-weight: bold; \"><span style=\"font-size: 8pt; font-family: Calibri, Arial; font-style: normal; color: rgb(0, 0, 0); \">Shared Contextual Intelligence</span></span>\r\n<span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">Using ThreatQ as a threat intelligence platform equips you with a threat library that automatically scores and prioritizes threat intelligence based on parameters you set. Prioritization is calculated across many separate sources, both external and internal, to deliver a single source of truth using the aggregated context provided. This removes noise, reduces risk of false positives and enables users to focus on the data that really matters.<br /></span>\r\n<ul><li><span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">Self-tuning</span></li></ul>\r\n<ul><li><span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">Context from external + internal data</span></li></ul>\r\n<ul><li><span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">Structured and unstructured data import</span></li></ul>\r\n<ul><li><span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">Custom enrichment source for existing systems</span></li></ul>\r\n<span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \"><br /><span style=\"font-weight: bold; \">ADAPTIVE WORKBENCH</span></span>\r\n<span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \"><span style=\"font-weight: bold; \">Combine Automation and Human Intelligence for Proactive Detection and Response</span></span>\r\n<span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">Customer-defined configuration and integrations to work with your processes and tools. Customizable workflow and customer-specific enrichment streamline analysis of threat and event data for faster investigation and automates the intelligence lifecycle.</span>\r\n<ul><li><span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">Consolidated view, unified opinion</span></li></ul>\r\n<ul><li><span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">Automatically prioritize based on all sources</span></li></ul>\r\n<ul><li><span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">Continuous threat assessment</span></li></ul>\r\n<ul><li><span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">Push-button operations using existing tools and processes</span></li></ul>\r\n<ul><li><span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">User-specific watch list widget</span></li></ul>\r\n<span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \"><span style=\"font-weight: bold; \"><br />THREATQ INVESTIGATIONS</span></span>\r\n<span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \"><span style=\"font-weight: bold; \">The industry’s first cybersecurity situation room</span></span>\r\n<span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">ThreatQ Investigations solves the collaboration and coordination inefficiencies that exist across security operations to accelerate detection and response. As the first cybersecurity situation room, it streamlines investigations and improves active collaboration among and across teams. Team leaders can direct actions, assign tasks and see the results unfold in near real time.<br /></span>\r\n<ul><li><span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">Fuse together threat data, evidence and users</span></li></ul>\r\n<ul><li><span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">Accelerate investigation, analysis and understanding of threats in order to update your defense posture proactively</span></li></ul>\r\n<ul><li><span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">Drive down mean time to detect (MTTD) and mean time to respond (MTTR)</span></li></ul>\r\n<ul><li><span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">Build incident, adversary and campaign timelines</span></li></ul>\r\n<span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \"><span style=\"font-weight: bold; \">OPEN EXCHANGE</span></span>\r\n<span style=\"font-weight: bold; \"><span style=\"font-size: 8pt; font-family: Calibri, Arial; font-style: normal; color: rgb(0, 0, 0); \">Open and Extensible Architecture Enables Robust Ecosystem</span></span>\r\n<span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">Import and aggregate external and internal data sources, integrate with existing enrichment and analysis tools, and export the right intelligence to the right tools at the right time to accelerate detection and response. Get more from your existing security investments by integrating your tools, teams and workflows through standard interfaces and an SDK/API for customization.<br /></span>\r\n<ul><li><span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">Bring your own connectors and tools</span></li></ul>\r\n<ul><li><span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">SDK / API for customization</span></li></ul>\r\n<ul><li><span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">Standard STIX/TAXII support</span></li></ul>","shortDescription":"ThreatQ is the only Threat Intelligence Platform that centrally manages and correlates unlimited external sources.","type":"Software","isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":2,"sellingCount":11,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"ThreatQ","keywords":"","description":"<span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">To understand and stop threats more effectively and efficiently your existing security infrastructure and people need to work smarter, not harder.","og:title":"ThreatQ","og:description":"<span style=\"font-size:8pt; font-family:Calibri,Arial; font-weight:normal; font-style:normal; color:#000000; \">To understand and stop threats more effectively and efficiently your existing security infrastructure and people need to work smarter, not harder.","og:image":"https://old.roi4cio.com/fileadmin/user_upload/ThreatQuotient_Logo.png"},"eventUrl":"","translationId":5887,"dealDetails":{"avgPartnerDiscount":15,"dealProtection":1,"avgDealSize":160000,"dealSizeCurrency":"USD","avgDealClosing":9},"roi":null,"price":null,"bonusForReference":null,"templateData":[{"id":128,"title":"Threat Intelligence Platforms"}],"testingArea":"demo request","categories":[{"id":874,"title":"Threat Intelligence Platforms","alias":"threat-intelligence-platforms","description":"Threat Intelligence Platforms (TIPs) are an emerging technology discipline that helps organizations aggregate, correlate and analyze threat data from multiple sources in real time to support defensive actions. TIPs have evolved to address the growing amount of data generated by a variety of internal and external resources (such as system logs and threat intelligence feeds) and help security teams identify the threats that are relevant to their organization. By importing threat data from multiple sources and formats, correlating that data and then exporting it into an organization’s existing security systems or ticketing systems, a TIP automates proactive threat management and mitigation. A true TIP differs from typical enterprise security products in that it is a system that can be programmed by outside developers, in particular, users of the platform. TIPs can also use APIs to gather data to generate configuration analysis, WHOIS information, reverse IP lookup, website content analysis, name servers and SSL certificates.\r\nThe traditional approach to enterprise security involves security teams using a variety of processes and tools to conduct incident response, network defense and threat analysis. Integration between these teams and the sharing of threat data is often a manual process that relies on email, spreadsheets or a portal ticketing system. This approach does not scale as the team and enterprise grows and the number of threats and events increases. With attack sources changing by the minute, hour and day, scalability and efficiency is difficult. The tools used by large Security Operations Centers (SOCs), for example, produce hundreds of millions of events per day, from endpoint and network alerts to log events, making it difficult to filter down to a manageable number of suspicious events for triage.\r\nThreat intelligence platforms make it possible for organizations to gain an advantage over the adversary by detecting the presence of threat actors, blocking and tackling their attacks or degrading their infrastructure. Using threat intelligence, businesses and government agencies can also identify the threat sources and data that are the most useful and relevant to their own environment, potentially reducing the costs associated with unnecessary commercial threat feeds.\r\nTactical use cases for threat intelligence include security planning, monitoring and detection, incident response, threat discovery and threat assessment. A TIP also drives smarter practices back into SIEMs, intrusion detection and other security tools because of the finely curated, relevant and widely sourced threat intelligence that a TIP produces.\r\nAn advantage held by TIPs is the ability to share threat intelligence with other stakeholders and communities. Adversaries typically coordinate their efforts across forums and platforms. A TIP provides a common habitat, which makes it possible for security teams to share threat information among their own trusted circles, interface with security and intelligence experts and receive guidance on implementing coordinated counter-measures. Full-featured TIPs enable security analysts to simultaneously coordinate these tactical and strategic activities with incident response, security operations, and risk management teams while aggregating data from trusted communities.","materialsDescription":"<span style=\"font-weight: bold;\">What is a threat?</span>\r\nA threat is the ability of an entity to gain access to or interfere with the usual planned activities of an information network.\r\n<span style=\"font-weight: bold;\">What is an APT?</span>\r\nAn advanced persistent threat (APT) is a stealthy computer network threat actor, typically a nation state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period. In recent times, the term may also refer to non-state sponsored groups conducting large-scale targeted intrusions for specific goals.\r\n<span style=\"font-weight: bold;\">What is phishing?</span>\r\nPhishing is the fraudulent attempt to obtain sensitive information such as usernames, passwords and credit card details by disguising oneself as a trustworthy entity in an electronic communication. Typically carried out by email spoofing or instant messaging, it often directs users to enter personal information at a fake website which matches the look and feel of the legitimate site.\r\nPhishing is an example of social engineering techniques being used to deceive users. Users are often lured by communications purporting to be from trusted parties such as social web sites, auction sites, banks, online payment processors or IT administrators.\r\n<span style=\"font-weight: bold;\">What is malware?</span>\r\nMalware (a portmanteau for malicious software) is any software intentionally designed to cause damage to a computer, server, client or computer network (in contrast, software that causes unintentional harm due to some deficiency is typically described as a software bug). A wide variety of malware types exist, including computer viruses, worms, Trojan horses, ransomware, spyware, adware, rogue software and scareware.\r\nPrograms are also considered malware if they secretly act against the interests of the computer user. For example, at one point, Sony music compact discs silently installed a rootkit on purchasers' computers with the intention of preventing illicit copying, but which also reported on users' listening habits, and unintentionally created extra security vulnerabilities.\r\nA range of antivirus software, firewalls and other strategies are used to help protect against the introduction of malware, to help detect it if it is already present and to recover from malware-associated malicious activity and attacks.\r\n<span style=\"font-weight: bold;\">What is a botnet?</span>\r\nA botnet is a number of Internet-connected devices, each of which is running one or more bots. Botnets can be used to perform Distributed Denial-of-Service (DDoS) attacks, steal data, send spam and allows the attacker to access the device and its connection. The owner can control the botnet using command and control (C&amp;C) software. The word &quot;botnet&quot; is a portmanteau of the words &quot;robot&quot; and &quot;network&quot;. The term is usually used with a negative or malicious connotation.\r\n<span style=\"font-weight: bold;\">What is a DDoS-attack?</span>\r\nA distributed denial-of-service (DDoS) attack occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. Such an attack is often the result of multiple compromised systems (for example, a botnet) flooding the targeted system with traffic. A botnet is a network of zombie computers programmed to receive commands without the owners' knowledge. When a server is overloaded with connections, new connections can no longer be accepted. The major advantages to an attacker of using a distributed denial-of-service attack are that multiple machines can generate more attack traffic than one machine, multiple attack machines are harder to turn off than one attack machine and that the behavior of each attack machine can be stealthier, making it harder to track and shut down. These attacker advantages cause challenges for defense mechanisms. For example, merely purchasing more incoming bandwidth than the current volume of the attack might not help, because the attacker might be able to simply add more attack machines. This, ultimately, will end up completely crashing a website for periods of time.\r\n<span style=\"font-weight: bold;\">What is ransomware?</span>\r\nRansomware is a type of malware from cryptovirology that threatens to publish the victim's data, or perpetually block access to it, unless a ransom is paid. While some simple ransomware may lock the system in a way which is not difficult for a knowledgeable person to reverse, more advanced malware uses a technique called cryptoviral extortion, in which it encrypts the victim's files, making them inaccessible, and demands a ransom payment to decrypt them. In a properly implemented cryptoviral extortion attack, recovering the files without the decryption key is an intractable problem – and difficult to trace digital currencies such as Ukash or Bitcoin and other cryptocurrency are used for the ransoms, making tracing and prosecuting the perpetrators difficult.<br />Ransomware attacks are typically carried out using a Trojan that is disguised as a legitimate file that the user is tricked into downloading or opening when it arrives as an email attachment. However, one high-profile example, the &quot;WannaCry worm&quot;, travelled automatically between computers without user interaction.<br /><br />","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/threat-intelligence-cyber.png"}],"characteristics":[{"id":2429,"title":"Own feed providers / feed prep analytics centers","required":0,"type":"binary","templateId":128,"value":true,"options":{"values":null,"defaults":null}},{"id":2431,"title":"Normalization, feed deduplication","required":0,"type":"binary","templateId":128,"value":true,"options":{"values":null,"defaults":null}},{"id":2433,"title":"Number of feed suppliers out of the box","required":0,"type":"select","templateId":128,"value":"100+","options":["20-100","100+"]},{"id":2435,"title":"CSV files","required":0,"type":"binary","templateId":128,"value":true,"options":{"values":null,"defaults":null}},{"id":2437,"title":"JSON files","required":0,"type":"binary","templateId":128,"value":true,"options":{"values":null,"defaults":null}},{"id":2439,"title":"HTTP-feed","required":0,"type":"binary","templateId":128,"value":"N/A","options":{"values":null,"defaults":null}},{"id":2441,"title":"Email","required":0,"type":"binary","templateId":128,"value":true,"options":{"values":null,"defaults":null}},{"id":2443,"title":"STIX / TAXII Standards Support","required":0,"type":"binary","templateId":128,"value":true,"options":{"values":null,"defaults":null}},{"id":2445,"title":"Unstructured text data","required":0,"type":"binary","templateId":128,"value":true,"options":{"values":null,"defaults":null}},{"id":2447,"title":"The ability to enrich data from external sources (for example, WHOis, PassiveDNS, VirusTotal, etc.)","required":0,"type":"binary","templateId":128,"value":true,"options":{"values":null,"defaults":null}},{"id":2449,"title":"Connecting additional feed providers","required":0,"type":"binary","templateId":128,"value":true,"options":{"values":null,"defaults":null}},{"id":2451,"title":"Search for matches in SIEM events","required":0,"type":"binary","templateId":128,"value":true,"options":{"values":null,"defaults":null}},{"id":2453,"title":"Direct incident response through integration with third-party information security systems","required":0,"type":"binary","templateId":128,"value":true,"options":{"values":null,"defaults":null}},{"id":2455,"title":"Responding to incidents using complex algorithms (playbooks)","required":0,"type":"binary","templateId":128,"value":true,"options":{"values":null,"defaults":null}},{"id":2457,"title":"REST API Integration Capability","required":0,"type":"binary","templateId":128,"value":true,"options":{"values":null,"defaults":null}},{"id":2459,"title":"Manual adjustment of “weight” parameters for feed’s","required":0,"type":"binary","templateId":128,"value":true,"options":{"values":null,"defaults":null}},{"id":2461,"title":"Ability to build a graph of links between feed’s objects and internal artifacts","required":0,"type":"binary","templateId":128,"value":true,"options":{"values":null,"defaults":null}}],"concurentProducts":[{"id":5889,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/anomali_logo.png","logo":true,"scheme":false,"title":"Anomali ThreatStream","vendorVerified":0,"rating":"1.00","implementationsCount":3,"suppliersCount":0,"supplierPartnersCount":0,"alias":"anomali-threatstream","companyTitle":"Anomali","companyTypes":["supplier","vendor"],"companyId":5298,"companyAlias":"anomali","description":"SOC analysts, incident response teams and researchers face the challenge of operationalizing an overwhelming amount of threat data. A recent Ponemon survey showed that 78% say threat intelligence is critical for achieving a strong security posture but also showed that 70% are overwhelmed with threat data. Anomali ThreatStream® makes it easier for security teams to achieve the full promise of threat intelligence. ThreatStream automates all the processes for collecting, managing and integrating threat intelligence, and gives security analysts the tools and resources to respond quickly to active threats.<br /><span style=\"font-weight: bold; \">Collect</span><br />ThreatStream manages ingesting intelligence from many disparate sources, including:\r\n<ul><li>STIX/TAXII feeds</li></ul>\r\n<ul><li>Open source threat feeds</li></ul>\r\n<ul><li>Commercial threat intelligence providers</li></ul>\r\n<ul><li>Unstructured intelligence: PDFs, CSVs, emails</li></ul>\r\n<ul><li>ISAC/ISAO shared threat intelligence</li></ul>\r\n<span style=\"font-weight: bold; \">Manage</span><br />ThreatStream takes raw threat data and turns it into rich, usable intelligence:\r\n<ul><li>Normalizes feeds into a common taxonomy</li></ul>\r\n<ul><li>De-duplicates data across feeds</li></ul>\r\n<ul><li>Removes false positives</li></ul>\r\n<ul><li>Enriches data with actor, campaign, and TTP</li></ul>\r\n<ul><li>Associates related threat indicators</li></ul>\r\n<span style=\"font-weight: bold; \">Integrate</span><br />ThreatStream integrates with internal security systems to make threat intelligence actionable.\r\n<ul><li>Deep integration with SIEM, FW, IPS, and EDR</li></ul>\r\n<ul><li>Scales to process millions of indicators</li></ul>\r\n<ul><li>Risk ranks threats via machine learning</li></ul>\r\n<ul><li>Includes Threat Bulletins from Anomali Labs</li></ul>\r\n<ul><li>Secure, 2-way sharing with Trusted Circles</li></ul>","shortDescription":"ThreatStream operationalizes threat intelligence and unites all the tools in your security infrastructure, speeding the detection of threats and enabling proactive defense measures.","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":0,"sellingCount":0,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"Anomali ThreatStream","keywords":"","description":"SOC analysts, incident response teams and researchers face the challenge of operationalizing an overwhelming amount of threat data. A recent Ponemon survey showed that 78% say threat intelligence is critical for achieving a strong security posture but also ","og:title":"Anomali ThreatStream","og:description":"SOC analysts, incident response teams and researchers face the challenge of operationalizing an overwhelming amount of threat data. A recent Ponemon survey showed that 78% say threat intelligence is critical for achieving a strong security posture but also ","og:image":"https://old.roi4cio.com/fileadmin/user_upload/anomali_logo.png"},"eventUrl":"","translationId":5889,"dealDetails":{"avgPartnerDiscount":15,"dealProtection":1,"avgDealSize":150000,"dealSizeCurrency":"","avgDealClosing":9},"roi":null,"price":null,"bonusForReference":null,"templateData":[{"id":128,"title":"Threat Intelligence Platforms"}],"testingArea":"https://www.anomali.com/request-a-demo","categories":[{"id":874,"title":"Threat Intelligence Platforms","alias":"threat-intelligence-platforms","description":"Threat Intelligence Platforms (TIPs) are an emerging technology discipline that helps organizations aggregate, correlate and analyze threat data from multiple sources in real time to support defensive actions. TIPs have evolved to address the growing amount of data generated by a variety of internal and external resources (such as system logs and threat intelligence feeds) and help security teams identify the threats that are relevant to their organization. By importing threat data from multiple sources and formats, correlating that data and then exporting it into an organization’s existing security systems or ticketing systems, a TIP automates proactive threat management and mitigation. A true TIP differs from typical enterprise security products in that it is a system that can be programmed by outside developers, in particular, users of the platform. TIPs can also use APIs to gather data to generate configuration analysis, WHOIS information, reverse IP lookup, website content analysis, name servers and SSL certificates.\r\nThe traditional approach to enterprise security involves security teams using a variety of processes and tools to conduct incident response, network defense and threat analysis. Integration between these teams and the sharing of threat data is often a manual process that relies on email, spreadsheets or a portal ticketing system. This approach does not scale as the team and enterprise grows and the number of threats and events increases. With attack sources changing by the minute, hour and day, scalability and efficiency is difficult. The tools used by large Security Operations Centers (SOCs), for example, produce hundreds of millions of events per day, from endpoint and network alerts to log events, making it difficult to filter down to a manageable number of suspicious events for triage.\r\nThreat intelligence platforms make it possible for organizations to gain an advantage over the adversary by detecting the presence of threat actors, blocking and tackling their attacks or degrading their infrastructure. Using threat intelligence, businesses and government agencies can also identify the threat sources and data that are the most useful and relevant to their own environment, potentially reducing the costs associated with unnecessary commercial threat feeds.\r\nTactical use cases for threat intelligence include security planning, monitoring and detection, incident response, threat discovery and threat assessment. A TIP also drives smarter practices back into SIEMs, intrusion detection and other security tools because of the finely curated, relevant and widely sourced threat intelligence that a TIP produces.\r\nAn advantage held by TIPs is the ability to share threat intelligence with other stakeholders and communities. Adversaries typically coordinate their efforts across forums and platforms. A TIP provides a common habitat, which makes it possible for security teams to share threat information among their own trusted circles, interface with security and intelligence experts and receive guidance on implementing coordinated counter-measures. Full-featured TIPs enable security analysts to simultaneously coordinate these tactical and strategic activities with incident response, security operations, and risk management teams while aggregating data from trusted communities.","materialsDescription":"<span style=\"font-weight: bold;\">What is a threat?</span>\r\nA threat is the ability of an entity to gain access to or interfere with the usual planned activities of an information network.\r\n<span style=\"font-weight: bold;\">What is an APT?</span>\r\nAn advanced persistent threat (APT) is a stealthy computer network threat actor, typically a nation state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period. In recent times, the term may also refer to non-state sponsored groups conducting large-scale targeted intrusions for specific goals.\r\n<span style=\"font-weight: bold;\">What is phishing?</span>\r\nPhishing is the fraudulent attempt to obtain sensitive information such as usernames, passwords and credit card details by disguising oneself as a trustworthy entity in an electronic communication. Typically carried out by email spoofing or instant messaging, it often directs users to enter personal information at a fake website which matches the look and feel of the legitimate site.\r\nPhishing is an example of social engineering techniques being used to deceive users. Users are often lured by communications purporting to be from trusted parties such as social web sites, auction sites, banks, online payment processors or IT administrators.\r\n<span style=\"font-weight: bold;\">What is malware?</span>\r\nMalware (a portmanteau for malicious software) is any software intentionally designed to cause damage to a computer, server, client or computer network (in contrast, software that causes unintentional harm due to some deficiency is typically described as a software bug). A wide variety of malware types exist, including computer viruses, worms, Trojan horses, ransomware, spyware, adware, rogue software and scareware.\r\nPrograms are also considered malware if they secretly act against the interests of the computer user. For example, at one point, Sony music compact discs silently installed a rootkit on purchasers' computers with the intention of preventing illicit copying, but which also reported on users' listening habits, and unintentionally created extra security vulnerabilities.\r\nA range of antivirus software, firewalls and other strategies are used to help protect against the introduction of malware, to help detect it if it is already present and to recover from malware-associated malicious activity and attacks.\r\n<span style=\"font-weight: bold;\">What is a botnet?</span>\r\nA botnet is a number of Internet-connected devices, each of which is running one or more bots. Botnets can be used to perform Distributed Denial-of-Service (DDoS) attacks, steal data, send spam and allows the attacker to access the device and its connection. The owner can control the botnet using command and control (C&amp;C) software. The word &quot;botnet&quot; is a portmanteau of the words &quot;robot&quot; and &quot;network&quot;. The term is usually used with a negative or malicious connotation.\r\n<span style=\"font-weight: bold;\">What is a DDoS-attack?</span>\r\nA distributed denial-of-service (DDoS) attack occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. Such an attack is often the result of multiple compromised systems (for example, a botnet) flooding the targeted system with traffic. A botnet is a network of zombie computers programmed to receive commands without the owners' knowledge. When a server is overloaded with connections, new connections can no longer be accepted. The major advantages to an attacker of using a distributed denial-of-service attack are that multiple machines can generate more attack traffic than one machine, multiple attack machines are harder to turn off than one attack machine and that the behavior of each attack machine can be stealthier, making it harder to track and shut down. These attacker advantages cause challenges for defense mechanisms. For example, merely purchasing more incoming bandwidth than the current volume of the attack might not help, because the attacker might be able to simply add more attack machines. This, ultimately, will end up completely crashing a website for periods of time.\r\n<span style=\"font-weight: bold;\">What is ransomware?</span>\r\nRansomware is a type of malware from cryptovirology that threatens to publish the victim's data, or perpetually block access to it, unless a ransom is paid. While some simple ransomware may lock the system in a way which is not difficult for a knowledgeable person to reverse, more advanced malware uses a technique called cryptoviral extortion, in which it encrypts the victim's files, making them inaccessible, and demands a ransom payment to decrypt them. In a properly implemented cryptoviral extortion attack, recovering the files without the decryption key is an intractable problem – and difficult to trace digital currencies such as Ukash or Bitcoin and other cryptocurrency are used for the ransoms, making tracing and prosecuting the perpetrators difficult.<br />Ransomware attacks are typically carried out using a Trojan that is disguised as a legitimate file that the user is tricked into downloading or opening when it arrives as an email attachment. However, one high-profile example, the &quot;WannaCry worm&quot;, travelled automatically between computers without user interaction.<br /><br />","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/threat-intelligence-cyber.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":5890,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/ThreatConnect_Logo.jpg","logo":true,"scheme":false,"title":"Threat Intelligence Platform","vendorVerified":0,"rating":"1.00","implementationsCount":1,"suppliersCount":0,"supplierPartnersCount":0,"alias":"threatconnect-platform","companyTitle":"ThreatConnect, Inc.","companyTypes":["supplier","vendor"],"companyId":5842,"companyAlias":"threatconnect-inc","description":"<span style=\"font-style: italic;\"><span style=\"font-weight: bold; font-size: 16px;\">With our Threat Intelligence Platform (TIP), centralize the aggregation and management of threat data no matter the source. Whether it’s Open Source data from OSINT Feeds, Blogs, or RSS Feeds; or indicators being sent from a threat intel feed provided by an ISAC or Premium Provider, we take that data and add additional context. </span></span>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold; font-size: 16px;\">Robust integrations with tools like your SIEM, EDR, and firewall pull internally generated logs into ThreatConnect for further enrichment. You’re provided with a place to organize and prioritize the data so you can then use it to drive actions inside and outside of the Platform.</span></span>\r\n<span style=\"font-weight: bold; \">Agnostic and Extensible Integrations for Distributing Information to Other Security Tools</span><br />Intelligence collected within our Threat Intelligence Platform has the ability to dictate decisions being made across your technology stack. Send relevant and actionable insights from the TIP to other tools with our wide breadth of integrations and flexible Playbooks. Export Threat Intelligence Reports and share the information with other teams to help your organization stay up to date on relevant threats. Read more about how ThreatConnect helped a customer use relevant threat intelligence here.\r\n<span style=\"font-weight: bold; \">Dynamic Intel-driven Automation and Orchestration for Better Decision Making</span>\r\nAs additional context and associations are applied to an indicator, you are armed with intelligence that should influence decision making. But, indicators are dynamic and ever changing. And as they change, so should the processes tied to them. With ThreatConnect, intel-driven automation, orchestration, and response gives you the ability to adjust decisions on the fly based on the changes seen in the intelligence that is influencing the process. Your automated processes are made smarter with Playbooks that enable continuous dynamic decision-making.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold; font-size: 16px;\">With ThreatConnect, you are able to centralize your intelligence, establish process consistency, scale operations, and measure your effectiveness all in one place. Make your security operations and analysts more efficient, while providing real-time insights to security leaders to make better business decisions. </span></span>\r\nWith ThreatConnect’s intelligence-driven security operations platform, your team has the ability to leverage threat intelligence, automation, and orchestration directly from one platform. Automation or orchestration informed by threat intelligence makes your pre-existing technology investments and your entire security team — including security operations and incident response — more efficient and more effective. \r\nA complete solution, ThreatConnect enables you to gain visibility into threats and understand their relevance to your organization, as well as increase efficiency with automation, task management, and orchestration. \r\nWith ThreatConnect, every member of your security team — including leadership — benefits from using the same platform. A centralized system of record, ThreatConnect can measure the effectiveness of your organization with cross-platform analytics and customizable dashboards.\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">Product Features</span></p>\r\n<ul><li>Open Source Feeds</li><li> Ingest Premium Feeds</li><li>Access to CAL™ Data</li><li>TAXII Server</li><li>ThreatConnect Intelligence Source</li><li>Custom Dashboards</li><li>Automated Email Import</li><li>Manage Incidents and Tasks</li><li>Create Threat Intelligence</li><li>Orchestration</li><li>Custom Indicator Types</li></ul>","shortDescription":"Automate the Collection of Intel From All Sources\r\n","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":9,"sellingCount":12,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"Threat Intelligence Platform","keywords":"","description":"<span style=\"font-style: italic;\"><span style=\"font-weight: bold; font-size: 16px;\">With our Threat Intelligence Platform (TIP), centralize the aggregation and management of threat data no matter the source. Whether it’s Open Source data from OSINT Feeds, Blog","og:title":"Threat Intelligence Platform","og:description":"<span style=\"font-style: italic;\"><span style=\"font-weight: bold; font-size: 16px;\">With our Threat Intelligence Platform (TIP), centralize the aggregation and management of threat data no matter the source. Whether it’s Open Source data from OSINT Feeds, Blog","og:image":"https://old.roi4cio.com/fileadmin/user_upload/ThreatConnect_Logo.jpg"},"eventUrl":"","translationId":5891,"dealDetails":{"avgPartnerDiscount":15,"dealProtection":1,"avgDealSize":150000,"dealSizeCurrency":"","avgDealClosing":9},"roi":null,"price":null,"bonusForReference":null,"templateData":[{"id":128,"title":"Threat Intelligence Platforms"}],"testingArea":"https://threatconnect.com/request-a-demo/\r\nContact: sales@softprom.com","categories":[{"id":874,"title":"Threat Intelligence Platforms","alias":"threat-intelligence-platforms","description":"Threat Intelligence Platforms (TIPs) are an emerging technology discipline that helps organizations aggregate, correlate and analyze threat data from multiple sources in real time to support defensive actions. TIPs have evolved to address the growing amount of data generated by a variety of internal and external resources (such as system logs and threat intelligence feeds) and help security teams identify the threats that are relevant to their organization. By importing threat data from multiple sources and formats, correlating that data and then exporting it into an organization’s existing security systems or ticketing systems, a TIP automates proactive threat management and mitigation. A true TIP differs from typical enterprise security products in that it is a system that can be programmed by outside developers, in particular, users of the platform. TIPs can also use APIs to gather data to generate configuration analysis, WHOIS information, reverse IP lookup, website content analysis, name servers and SSL certificates.\r\nThe traditional approach to enterprise security involves security teams using a variety of processes and tools to conduct incident response, network defense and threat analysis. Integration between these teams and the sharing of threat data is often a manual process that relies on email, spreadsheets or a portal ticketing system. This approach does not scale as the team and enterprise grows and the number of threats and events increases. With attack sources changing by the minute, hour and day, scalability and efficiency is difficult. The tools used by large Security Operations Centers (SOCs), for example, produce hundreds of millions of events per day, from endpoint and network alerts to log events, making it difficult to filter down to a manageable number of suspicious events for triage.\r\nThreat intelligence platforms make it possible for organizations to gain an advantage over the adversary by detecting the presence of threat actors, blocking and tackling their attacks or degrading their infrastructure. Using threat intelligence, businesses and government agencies can also identify the threat sources and data that are the most useful and relevant to their own environment, potentially reducing the costs associated with unnecessary commercial threat feeds.\r\nTactical use cases for threat intelligence include security planning, monitoring and detection, incident response, threat discovery and threat assessment. A TIP also drives smarter practices back into SIEMs, intrusion detection and other security tools because of the finely curated, relevant and widely sourced threat intelligence that a TIP produces.\r\nAn advantage held by TIPs is the ability to share threat intelligence with other stakeholders and communities. Adversaries typically coordinate their efforts across forums and platforms. A TIP provides a common habitat, which makes it possible for security teams to share threat information among their own trusted circles, interface with security and intelligence experts and receive guidance on implementing coordinated counter-measures. Full-featured TIPs enable security analysts to simultaneously coordinate these tactical and strategic activities with incident response, security operations, and risk management teams while aggregating data from trusted communities.","materialsDescription":"<span style=\"font-weight: bold;\">What is a threat?</span>\r\nA threat is the ability of an entity to gain access to or interfere with the usual planned activities of an information network.\r\n<span style=\"font-weight: bold;\">What is an APT?</span>\r\nAn advanced persistent threat (APT) is a stealthy computer network threat actor, typically a nation state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period. In recent times, the term may also refer to non-state sponsored groups conducting large-scale targeted intrusions for specific goals.\r\n<span style=\"font-weight: bold;\">What is phishing?</span>\r\nPhishing is the fraudulent attempt to obtain sensitive information such as usernames, passwords and credit card details by disguising oneself as a trustworthy entity in an electronic communication. Typically carried out by email spoofing or instant messaging, it often directs users to enter personal information at a fake website which matches the look and feel of the legitimate site.\r\nPhishing is an example of social engineering techniques being used to deceive users. Users are often lured by communications purporting to be from trusted parties such as social web sites, auction sites, banks, online payment processors or IT administrators.\r\n<span style=\"font-weight: bold;\">What is malware?</span>\r\nMalware (a portmanteau for malicious software) is any software intentionally designed to cause damage to a computer, server, client or computer network (in contrast, software that causes unintentional harm due to some deficiency is typically described as a software bug). A wide variety of malware types exist, including computer viruses, worms, Trojan horses, ransomware, spyware, adware, rogue software and scareware.\r\nPrograms are also considered malware if they secretly act against the interests of the computer user. For example, at one point, Sony music compact discs silently installed a rootkit on purchasers' computers with the intention of preventing illicit copying, but which also reported on users' listening habits, and unintentionally created extra security vulnerabilities.\r\nA range of antivirus software, firewalls and other strategies are used to help protect against the introduction of malware, to help detect it if it is already present and to recover from malware-associated malicious activity and attacks.\r\n<span style=\"font-weight: bold;\">What is a botnet?</span>\r\nA botnet is a number of Internet-connected devices, each of which is running one or more bots. Botnets can be used to perform Distributed Denial-of-Service (DDoS) attacks, steal data, send spam and allows the attacker to access the device and its connection. The owner can control the botnet using command and control (C&amp;C) software. The word &quot;botnet&quot; is a portmanteau of the words &quot;robot&quot; and &quot;network&quot;. The term is usually used with a negative or malicious connotation.\r\n<span style=\"font-weight: bold;\">What is a DDoS-attack?</span>\r\nA distributed denial-of-service (DDoS) attack occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. Such an attack is often the result of multiple compromised systems (for example, a botnet) flooding the targeted system with traffic. A botnet is a network of zombie computers programmed to receive commands without the owners' knowledge. When a server is overloaded with connections, new connections can no longer be accepted. The major advantages to an attacker of using a distributed denial-of-service attack are that multiple machines can generate more attack traffic than one machine, multiple attack machines are harder to turn off than one attack machine and that the behavior of each attack machine can be stealthier, making it harder to track and shut down. These attacker advantages cause challenges for defense mechanisms. For example, merely purchasing more incoming bandwidth than the current volume of the attack might not help, because the attacker might be able to simply add more attack machines. This, ultimately, will end up completely crashing a website for periods of time.\r\n<span style=\"font-weight: bold;\">What is ransomware?</span>\r\nRansomware is a type of malware from cryptovirology that threatens to publish the victim's data, or perpetually block access to it, unless a ransom is paid. While some simple ransomware may lock the system in a way which is not difficult for a knowledgeable person to reverse, more advanced malware uses a technique called cryptoviral extortion, in which it encrypts the victim's files, making them inaccessible, and demands a ransom payment to decrypt them. In a properly implemented cryptoviral extortion attack, recovering the files without the decryption key is an intractable problem – and difficult to trace digital currencies such as Ukash or Bitcoin and other cryptocurrency are used for the ransoms, making tracing and prosecuting the perpetrators difficult.<br />Ransomware attacks are typically carried out using a Trojan that is disguised as a legitimate file that the user is tricked into downloading or opening when it arrives as an email attachment. However, one high-profile example, the &quot;WannaCry worm&quot;, travelled automatically between computers without user interaction.<br /><br />","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/threat-intelligence-cyber.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":3756,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/eclecticiq.png","logo":true,"scheme":false,"title":"EclecticIQ Platform","vendorVerified":0,"rating":"1.00","implementationsCount":0,"suppliersCount":0,"supplierPartnersCount":0,"alias":"eclecticiq-platform","companyTitle":"EclecticIQ","companyTypes":["supplier","vendor"],"companyId":5439,"companyAlias":"eclecticiq","description":"EclecticIQ Platform is a Threat Intelligence Platform (TIP) that empowers threat analysts to perform faster, better, and deeper investigations while disseminating intelligence at machine-speed.<br />EclecticIQ Platform connects and interprets intelligence data from open sources, commercial suppliers and industry partnerships.\r\n<b>Features:</b> \r\n<b>Gather relevant intelligence</b>\r\n<ul> <ul> <li>Capture incoming intelligence</li> <li>Conduct triage</li> </ul> </ul>\r\n\r\n<b>Integrate threat intelligence into the enterprise</b>\r\n<ul> <ul> <li>Distribute to stakeholders</li> <li>Automate feeds into security controls</li> </ul> </ul>\r\n\r\n<b>Participate in the broader intelligence community</b>\r\n<ul> <ul> <li>Share with communities</li> <li>Support STIX and TAXII standards</li> </ul> </ul>\r\n\r\n<b>Empower analysts</b>\r\n<ul> <ul> <li>Graph with advanced search</li> <li>Collaborate with colleagues</li> <li>Generate insightful reports</li> <li>Create structured intelligence</li> </ul> </ul>\r\n\r\n<b>Benefits:</b>\r\n<b>CISOs</b>\r\nEclecticIQ Platform enables CISOs to align investment in CTI according to the reality of cyber threats. In addition, EclecticIQ improves the efficiency and effectiveness of other security management (e.g. SIEM, IPS/IDS) solutions, improving the performance of cyber threat defense within the enterprise.\r\n<b>Intelligence Analysts</b>\r\nEclecticIQ Platform empowers analysts to optimize their workflow using with automation tools based on analytics. Instead of manually crunching through data, analysts can better spend their time on collaboration with peers, working to enrich, qualify, analyze and share threat information to stakeholders.\r\n<b>Incident Response Teams</b>\r\nEclecticIQ Platform facilitates and accelerates investigations with a scalable, fast and flexible solution that provides a single point of aggregation along with automated and manual analysis tools. These capabilities optimize response time and improve remediation efforts.\r\n<b>Heads of Cyber Threat Intelligence</b>\r\nEclecticIQ Platform provides a centralized solution for consolidating threat intelligence that facilitates knowledge sharing and reporting of strategic, operational and tactical intelligence to stakeholders.\r\n<b>Security Operations Centers</b>\r\nEclecticIQ Platform delivers much-needed context and relevance to SOCs by incorporating enriched data into IOC feeds. This reduces the mean time to respond to high-priority incidents.\r\n<b>IT Operations</b>\r\nEclecticIQ Platform is a versatile system that offers a wide variety of on-premise and cloud deployments (including CentOS, RedHat, and Ubuntu). Leveraging the latest data management technologies, it can process massive amounts of information at high speed with a relatively low impact on resources. EclecticIQ Platform is a demonstration of stability and interoperability through CTI standards.","shortDescription":"EclecticIQ Platform is a Threat Intelligence Platform (TIP) that empowers threat analysts to perform faster, better, and deeper investigations while disseminating intelligence at machine-speed.","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":15,"sellingCount":13,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"EclecticIQ Platform","keywords":"","description":"EclecticIQ Platform is a Threat Intelligence Platform (TIP) that empowers threat analysts to perform faster, better, and deeper investigations while disseminating intelligence at machine-speed.<br />EclecticIQ Platform connects and interprets intelligence data","og:title":"EclecticIQ Platform","og:description":"EclecticIQ Platform is a Threat Intelligence Platform (TIP) that empowers threat analysts to perform faster, better, and deeper investigations while disseminating intelligence at machine-speed.<br />EclecticIQ Platform connects and interprets intelligence data","og:image":"https://old.roi4cio.com/fileadmin/user_upload/eclecticiq.png"},"eventUrl":"","translationId":3755,"dealDetails":{"avgPartnerDiscount":15,"dealProtection":1,"avgDealSize":150000,"dealSizeCurrency":"","avgDealClosing":9},"roi":null,"price":null,"bonusForReference":null,"templateData":[{"id":128,"title":"Threat Intelligence Platforms"}],"testingArea":"https://go.eclecticiq.com/product/get-threat-intel-platform-demo","categories":[{"id":874,"title":"Threat Intelligence Platforms","alias":"threat-intelligence-platforms","description":"Threat Intelligence Platforms (TIPs) are an emerging technology discipline that helps organizations aggregate, correlate and analyze threat data from multiple sources in real time to support defensive actions. TIPs have evolved to address the growing amount of data generated by a variety of internal and external resources (such as system logs and threat intelligence feeds) and help security teams identify the threats that are relevant to their organization. By importing threat data from multiple sources and formats, correlating that data and then exporting it into an organization’s existing security systems or ticketing systems, a TIP automates proactive threat management and mitigation. A true TIP differs from typical enterprise security products in that it is a system that can be programmed by outside developers, in particular, users of the platform. TIPs can also use APIs to gather data to generate configuration analysis, WHOIS information, reverse IP lookup, website content analysis, name servers and SSL certificates.\r\nThe traditional approach to enterprise security involves security teams using a variety of processes and tools to conduct incident response, network defense and threat analysis. Integration between these teams and the sharing of threat data is often a manual process that relies on email, spreadsheets or a portal ticketing system. This approach does not scale as the team and enterprise grows and the number of threats and events increases. With attack sources changing by the minute, hour and day, scalability and efficiency is difficult. The tools used by large Security Operations Centers (SOCs), for example, produce hundreds of millions of events per day, from endpoint and network alerts to log events, making it difficult to filter down to a manageable number of suspicious events for triage.\r\nThreat intelligence platforms make it possible for organizations to gain an advantage over the adversary by detecting the presence of threat actors, blocking and tackling their attacks or degrading their infrastructure. Using threat intelligence, businesses and government agencies can also identify the threat sources and data that are the most useful and relevant to their own environment, potentially reducing the costs associated with unnecessary commercial threat feeds.\r\nTactical use cases for threat intelligence include security planning, monitoring and detection, incident response, threat discovery and threat assessment. A TIP also drives smarter practices back into SIEMs, intrusion detection and other security tools because of the finely curated, relevant and widely sourced threat intelligence that a TIP produces.\r\nAn advantage held by TIPs is the ability to share threat intelligence with other stakeholders and communities. Adversaries typically coordinate their efforts across forums and platforms. A TIP provides a common habitat, which makes it possible for security teams to share threat information among their own trusted circles, interface with security and intelligence experts and receive guidance on implementing coordinated counter-measures. Full-featured TIPs enable security analysts to simultaneously coordinate these tactical and strategic activities with incident response, security operations, and risk management teams while aggregating data from trusted communities.","materialsDescription":"<span style=\"font-weight: bold;\">What is a threat?</span>\r\nA threat is the ability of an entity to gain access to or interfere with the usual planned activities of an information network.\r\n<span style=\"font-weight: bold;\">What is an APT?</span>\r\nAn advanced persistent threat (APT) is a stealthy computer network threat actor, typically a nation state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period. In recent times, the term may also refer to non-state sponsored groups conducting large-scale targeted intrusions for specific goals.\r\n<span style=\"font-weight: bold;\">What is phishing?</span>\r\nPhishing is the fraudulent attempt to obtain sensitive information such as usernames, passwords and credit card details by disguising oneself as a trustworthy entity in an electronic communication. Typically carried out by email spoofing or instant messaging, it often directs users to enter personal information at a fake website which matches the look and feel of the legitimate site.\r\nPhishing is an example of social engineering techniques being used to deceive users. Users are often lured by communications purporting to be from trusted parties such as social web sites, auction sites, banks, online payment processors or IT administrators.\r\n<span style=\"font-weight: bold;\">What is malware?</span>\r\nMalware (a portmanteau for malicious software) is any software intentionally designed to cause damage to a computer, server, client or computer network (in contrast, software that causes unintentional harm due to some deficiency is typically described as a software bug). A wide variety of malware types exist, including computer viruses, worms, Trojan horses, ransomware, spyware, adware, rogue software and scareware.\r\nPrograms are also considered malware if they secretly act against the interests of the computer user. For example, at one point, Sony music compact discs silently installed a rootkit on purchasers' computers with the intention of preventing illicit copying, but which also reported on users' listening habits, and unintentionally created extra security vulnerabilities.\r\nA range of antivirus software, firewalls and other strategies are used to help protect against the introduction of malware, to help detect it if it is already present and to recover from malware-associated malicious activity and attacks.\r\n<span style=\"font-weight: bold;\">What is a botnet?</span>\r\nA botnet is a number of Internet-connected devices, each of which is running one or more bots. Botnets can be used to perform Distributed Denial-of-Service (DDoS) attacks, steal data, send spam and allows the attacker to access the device and its connection. The owner can control the botnet using command and control (C&amp;C) software. The word &quot;botnet&quot; is a portmanteau of the words &quot;robot&quot; and &quot;network&quot;. The term is usually used with a negative or malicious connotation.\r\n<span style=\"font-weight: bold;\">What is a DDoS-attack?</span>\r\nA distributed denial-of-service (DDoS) attack occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. Such an attack is often the result of multiple compromised systems (for example, a botnet) flooding the targeted system with traffic. A botnet is a network of zombie computers programmed to receive commands without the owners' knowledge. When a server is overloaded with connections, new connections can no longer be accepted. The major advantages to an attacker of using a distributed denial-of-service attack are that multiple machines can generate more attack traffic than one machine, multiple attack machines are harder to turn off than one attack machine and that the behavior of each attack machine can be stealthier, making it harder to track and shut down. These attacker advantages cause challenges for defense mechanisms. For example, merely purchasing more incoming bandwidth than the current volume of the attack might not help, because the attacker might be able to simply add more attack machines. This, ultimately, will end up completely crashing a website for periods of time.\r\n<span style=\"font-weight: bold;\">What is ransomware?</span>\r\nRansomware is a type of malware from cryptovirology that threatens to publish the victim's data, or perpetually block access to it, unless a ransom is paid. While some simple ransomware may lock the system in a way which is not difficult for a knowledgeable person to reverse, more advanced malware uses a technique called cryptoviral extortion, in which it encrypts the victim's files, making them inaccessible, and demands a ransom payment to decrypt them. In a properly implemented cryptoviral extortion attack, recovering the files without the decryption key is an intractable problem – and difficult to trace digital currencies such as Ukash or Bitcoin and other cryptocurrency are used for the ransoms, making tracing and prosecuting the perpetrators difficult.<br />Ransomware attacks are typically carried out using a Trojan that is disguised as a legitimate file that the user is tricked into downloading or opening when it arrives as an email attachment. However, one high-profile example, the &quot;WannaCry worm&quot;, travelled automatically between computers without user interaction.<br /><br />","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/threat-intelligence-cyber.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]}],"jobRoles":[{"id":60,"title":"Chief Information Officer"},{"id":64,"title":"Chief IT Security Officer"},{"id":70,"title":"IT Security and Risk Management"}],"organizationalFeatures":["IT Security Department in company","Company branches in different countries"],"complementaryCategories":[],"solutions":["Risk or Leaks of confidential information","Risk of attacks by hackers","Risk of data loss or damage","Decentralized IT systems","High costs of IT personnel"],"materials":[{"id":2236,"title":"","description":"THREATQ™","uri":"https://www.threatq.com/threat-intelligence-platform/"},{"id":2575,"title":"","description":"demo ","uri":"https://drive.google.com/file/d/1hfi1SOhlCqrSG2MCQuRAVZSxGhQMaPZ5/view?usp=sharing"},{"id":2576,"title":"","description":"The ThreatQ Open Exchange \r\n\r\n","uri":"https://www.youtube.com/watch?v=AoudSD6DEcQ"},{"id":2577,"title":"","description":"Threat Hunting with ThreatQ\r\n","uri":"https://www.youtube.com/watch?v=u8-e4n5YELQ&t=32s"},{"id":2578,"title":"","description":"ThreatQ Investigations - Creating an Investigation\r\n","uri":"https://www.youtube.com/watch?v=PH7F6k-Z3l4"}],"useCases":[],"best_practices":[],"values":["Enhance Staff Productivity","Manage Risks"],"implementations":[{"id":1267,"title":"ThreatQ platform for Airbus Cybersecurity","url":"https://old.roi4cio.com/vnedrenija/vnedrenie/threatq-platform-for-airbus-cybersecurity/"}],"presenterCodeLng":"","productImplementations":[{"id":1267,"title":"ThreatQ platform for Airbus Cybersecurity","description":" <span style=\"font-weight: bold;\">Augmented Intelligence: Airbus Cybersecurity Strengthens its Threat Intelligence with ThreatQuotient</span><br /><br /><span style=\"font-style: italic;\">“Since 2011, our threat intelligence service has worked very closely with our incident response teams. Among other things, this has allowed us to be very relevant and responsive when it comes to tracking attackers,”</span> explains Julien Menissez, Product Manager for Managed Services in Europe at Airbus Cybersecurity.\r\nThis proximity has paid off, enabling the service to better contextualize alerts that would otherwise remain purely technical, such as lists of IP addresses and other indicators of compromise (IoCs). Technical alerts are effective in blocking specific attacks, often in an automated way. However, when they are enriched with relevant, contextual information they can become real decision-making tools allowing security analysts to answer questions, such as:<br />What do we know about the attacker’s current targets and campaigns? Are we a potential target for this group in particular?<br />In theory this is attractive, but to deliver this in practice Airbus Cybersecurity needed to be equipped to offer a robust, industry-ready service. <span style=\"font-style: italic;\">“In 2015, we decided to create a dissemination offering that would allow customers operating their own SOC to benefit from this increased information. We first worked with flat files, and then we deployed MISP interfaces for our customers,”</span> continues Julien Menissez.<br /><br /><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Difficulty scaling up</span></span>\r\nMISP (Malware Information Sharing Platform) is a must in the world of threat intelligence. Available as a free solution, MISP facilitates the sharing of IoCs between researchers. But before IoCs can be shared, they must be acquired and consolidated. This is where things get complicated. Julien Menissez recalls, <span style=\"font-style: italic;\">“MISP is very good for dissemination, but ingestion is not simple! We were forced to use many other open source tools in parallel, requiring a lot of scripting and manual operations before delivering the information to our customers, while remaining within the timeframes allowed by our SLAs.”</span>\r\nThe dissemination service became so successful, that the load on the Airbus Threat Intelligence team increased dramatically. As customers demanded more and more context and richer information, beyond what MISP can do with its tagging and commenting functionalities, it quickly became clear that a manual approach could not be scaled up.\r\nThe Airbus Cybersecurity team then decided to research a new “cyber-intelligence back office” — a tool capable of natively managing concepts such as the freshness of information, reliability, context, and related data.\r\n<span style=\"font-style: italic;\">“We quickly saw in ThreatQuotient the vendor best suited to our needs. We shared the same vocabulary (coming from the defense sector). The ThreatQ platform met our criteria, and the technical level of the ThreatQuotient subject matter experts was excellent,”</span> explains Julien Menissez.<br /><br />\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">From weekly delivery to continuous information</span></span>\r\nThe deployment of ThreatQ allows Airbus Cybersecurity to meet their goals. <span style=\"font-style: italic;\">“We can now deliver the same service and the same knowledge, with the same quality as before, but much more quickly and with far fewer technical manipulations,”</span> details Julien Menissez.<span style=\"font-style: italic;\"> “And, obviously, it’s our customers who benefit. Airbus has gone from weekly information delivery to continuous information delivery.”</span>\r\nBetter still, for slightly more mature customers, who do not yet operate their own SOC, but still have an internal CSIRT team, the Airbus team can now offer an optional tool capable of helping them capitalize on their knowledge. The knowledge acquired during the customer’s internal investigations is seamlessly integrated into the ThreatQ platform to enrich the information delivered back to the customer via the Airbus service.\r\nThe ThreatQ platform is completely complementary to an existing MISP solution, allowing the customer to build up their own knowledge base adapted with their context. Customers also have the freedom to change their threat intelligence feeds and sources at any time, since they will keep all of their data within the ThreatQ Threat Library and therefore all the knowledge acquired by their CSIRT.<br /><br /><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Better responsiveness in times of crisis</span></span>\r\nThe ThreatQuotient solution allows Airbus Cybersecurity analysts to respond better and faster to customer requests. <span style=\"font-style: italic;\">“Most SOCs work with a workflow system to investigate IoCs collected during an incident. It is often a manual process but since the ThreatQ platform can be integrated with a SIEM to do the research and automatically identify patterns and linkages and how to pivot from a given IoC, we have even been able to reduce our response time to our customers,”</span> says Julien Menissez. <span style=\"font-style: italic;\">“And obviously, in an incident, quickly identifying the pivots and monitoring malicious activities as closely as possible is a major advantage.”</span><br /><br />\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Personalized information</span></span>\r\nFinally, the choice of the ThreatQuotient solution allowed Airbus Cybersecurity to refine the information delivered to customers in order to better manage their security posture. The ThreatQ platform makes it possible to automatically “package” the most relevant flows according to the exposure of the client to specific risks, and thus take a strategic approach to mitigate risk.","alias":"threatq-platform-for-airbus-cybersecurity","roi":0,"seo":{"title":"ThreatQ platform for Airbus Cybersecurity","keywords":"","description":" <span style=\"font-weight: bold;\">Augmented Intelligence: Airbus Cybersecurity Strengthens its Threat Intelligence with ThreatQuotient</span><br /><br /><span style=\"font-style: italic;\">“Since 2011, our threat intelligence service has worked very closely with","og:title":"ThreatQ platform for Airbus Cybersecurity","og:description":" <span style=\"font-weight: bold;\">Augmented Intelligence: Airbus Cybersecurity Strengthens its Threat Intelligence with ThreatQuotient</span><br /><br /><span style=\"font-style: italic;\">“Since 2011, our threat intelligence service has worked very closely with"},"deal_info":"","user":{"id":9166,"title":"Airbus CyberSecurity (User)","logoURL":"https://old.roi4cio.com/uploads/roi/company/Airbus_01.jpg","alias":"airbus-cybersecurity-user","address":"","roles":[],"description":" Airbus CyberSecurity is a European specialist in cyber security. Its mission is to protect governments, military, organisations and critical national infrastructure from cyber threats.<br />Airbus CyberSecurity is a fully owned subsidiary of Airbus Defence and Space, with over 900 cyber professionals based across France, Germany, the UK and Spain, each with a Security Operations Centre (SOC). Additionally, the organisation includes Stormshield, a France-based subsidiary which offers security products to enterprise and government clients.<br />With over 30 years of experience providing reliable cyber security products and services, Airbus CyberSecurity has become one of the most advanced sovereign cyber security players in Europe. Having protected Airbus Defence and Space’s complex systems and networks with its SOCs for years, Airbus CyberSecurity has leveraged our Airbus DNA to develop products and services for customers facing similar challenges as vendor, based on state-of-the-art trusted technologies.<br /><br />","companyTypes":[],"products":{},"vendoredProductsCount":0,"suppliedProductsCount":0,"supplierImplementations":[],"vendorImplementations":[],"userImplementations":[],"userImplementationsCount":1,"supplierImplementationsCount":0,"vendorImplementationsCount":0,"vendorPartnersCount":0,"supplierPartnersCount":0,"b4r":0,"categories":{},"companyUrl":"https://airbus-cyber-security.com/","countryCodes":[],"certifications":[],"isSeller":false,"isSupplier":false,"isVendor":false,"presenterCodeLng":"","seo":{"title":"Airbus CyberSecurity (User)","keywords":"","description":" Airbus CyberSecurity is a European specialist in cyber security. Its mission is to protect governments, military, organisations and critical national infrastructure from cyber threats.<br />Airbus CyberSecurity is a fully owned subsidiary of Airbus Defence an","og:title":"Airbus CyberSecurity (User)","og:description":" Airbus CyberSecurity is a European specialist in cyber security. Its mission is to protect governments, military, organisations and critical national infrastructure from cyber threats.<br />Airbus CyberSecurity is a fully owned subsidiary of Airbus Defence an","og:image":"https://old.roi4cio.com/uploads/roi/company/Airbus_01.jpg"},"eventUrl":""},"supplier":{"id":5844,"title":"ThreatQuotient, Inc.","logoURL":"https://old.roi4cio.com/uploads/roi/company/ThreatQ.png","alias":"threatquotient-inc","address":"","roles":[],"description":" \r\n<span lang=\"EN\"><span style=\"font-weight: bold;\">ThreatQuotient </span>develops solutions to improve the efficiency and effectiveness of cybersecurity operations. The company's proprietary software platform speeds up and simplifies the incident investigation process and optimizes the work of security teams. ThreatQuotient solutions combine the organization's existing processes and technologies into a single workspace, reduce information noise, highlight the most important threats and automate processes to maximize focus and decision support while making the most of limited resources. ThreatQuotient's threat-focused approach supports a variety of use cases, including incident response, threat search and analysis, phishing detection, alert sorting, vulnerability management, and more. ThreatQuotient is headquartered in Northern Virginia (USA) with overseas offices in EMEA and APAC.</span>","companyTypes":[],"products":{},"vendoredProductsCount":1,"suppliedProductsCount":1,"supplierImplementations":[],"vendorImplementations":[],"userImplementations":[],"userImplementationsCount":0,"supplierImplementationsCount":1,"vendorImplementationsCount":1,"vendorPartnersCount":0,"supplierPartnersCount":0,"b4r":0,"categories":{},"companyUrl":"https://www.threatq.com/","countryCodes":[],"certifications":[],"isSeller":false,"isSupplier":false,"isVendor":false,"presenterCodeLng":"","seo":{"title":"ThreatQuotient, Inc.","keywords":"","description":" \r\n<span lang=\"EN\"><span style=\"font-weight: bold;\">ThreatQuotient </span>develops solutions to improve the efficiency and effectiveness of cybersecurity operations. The company's proprietary software platform speeds up and simplifies the incident investigati","og:title":"ThreatQuotient, Inc.","og:description":" \r\n<span lang=\"EN\"><span style=\"font-weight: bold;\">ThreatQuotient </span>develops solutions to improve the efficiency and effectiveness of cybersecurity operations. The company's proprietary software platform speeds up and simplifies the incident investigati","og:image":"https://old.roi4cio.com/uploads/roi/company/ThreatQ.png"},"eventUrl":""},"vendors":[{"id":5844,"title":"ThreatQuotient, Inc.","logoURL":"https://old.roi4cio.com/uploads/roi/company/ThreatQ.png","alias":"threatquotient-inc","address":"","roles":[],"description":" \r\n<span lang=\"EN\"><span style=\"font-weight: bold;\">ThreatQuotient </span>develops solutions to improve the efficiency and effectiveness of cybersecurity operations. The company's proprietary software platform speeds up and simplifies the incident investigation process and optimizes the work of security teams. ThreatQuotient solutions combine the organization's existing processes and technologies into a single workspace, reduce information noise, highlight the most important threats and automate processes to maximize focus and decision support while making the most of limited resources. ThreatQuotient's threat-focused approach supports a variety of use cases, including incident response, threat search and analysis, phishing detection, alert sorting, vulnerability management, and more. ThreatQuotient is headquartered in Northern Virginia (USA) with overseas offices in EMEA and APAC.</span>","companyTypes":[],"products":{},"vendoredProductsCount":1,"suppliedProductsCount":1,"supplierImplementations":[],"vendorImplementations":[],"userImplementations":[],"userImplementationsCount":0,"supplierImplementationsCount":1,"vendorImplementationsCount":1,"vendorPartnersCount":0,"supplierPartnersCount":0,"b4r":0,"categories":{},"companyUrl":"https://www.threatq.com/","countryCodes":[],"certifications":[],"isSeller":false,"isSupplier":false,"isVendor":false,"presenterCodeLng":"","seo":{"title":"ThreatQuotient, Inc.","keywords":"","description":" \r\n<span lang=\"EN\"><span style=\"font-weight: bold;\">ThreatQuotient </span>develops solutions to improve the efficiency and effectiveness of cybersecurity operations. The company's proprietary software platform speeds up and simplifies the incident investigati","og:title":"ThreatQuotient, Inc.","og:description":" \r\n<span lang=\"EN\"><span style=\"font-weight: bold;\">ThreatQuotient </span>develops solutions to improve the efficiency and effectiveness of cybersecurity operations. The company's proprietary software platform speeds up and simplifies the incident investigati","og:image":"https://old.roi4cio.com/uploads/roi/company/ThreatQ.png"},"eventUrl":""}],"products":[],"countries":[],"startDate":"0000-00-00","endDate":"0000-00-00","dealDate":"0000-00-00","price":0,"status":"finished","isImplementation":true,"isAgreement":false,"confirmed":1,"implementationDetails":{},"categories":[],"additionalInfo":{"budgetNotExceeded":"-1","functionallyTaskAssignment":"-1","projectWasPut":"-1","price":0,"source":{"url":"","title":"-"}},"comments":[],"referencesCount":0}]}},"aliases":{},"links":{},"meta":{},"loading":false,"error":null,"useProductLoading":false,"sellProductLoading":false,"templatesById":{},"comparisonByTemplateId":{}},"filters":{"filterCriterias":{"loading":false,"error":null,"data":{"price":{"min":0,"max":6000},"users":{"loading":false,"error":null,"ids":[],"values":{}},"suppliers":{"loading":false,"error":null,"ids":[],"values":{}},"vendors":{"loading":false,"error":null,"ids":[],"values":{}},"roles":{"id":200,"title":"Roles","values":{"1":{"id":1,"title":"User","translationKey":"user"},"2":{"id":2,"title":"Supplier","translationKey":"supplier"},"3":{"id":3,"title":"Vendor","translationKey":"vendor"}}},"categories":{"flat":[],"tree":[]},"countries":{"loading":false,"error":null,"ids":[],"values":{}}}},"showAIFilter":false},"companies":{"companiesByAlias":{},"aliases":{},"links":{},"meta":{},"loading":false,"error":null},"implementations":{"implementationsByAlias":{},"aliases":{},"links":{},"meta":{},"loading":false,"error":null},"agreements":{"agreementById":{},"ids":{},"links":{},"meta":{},"loading":false,"error":null},"comparison":{"loading":false,"error":false,"templatesById":{"128":{"id":128,"title":"Threat Intelligence Platforms"}},"comparisonByTemplateId":{},"products":[],"selectedTemplateId":null},"presentation":{"type":null,"company":{},"products":[],"partners":[],"formData":{},"dataLoading":false,"dataError":false,"loading":false,"error":false},"catalogsGlobal":{"subMenuItemTitle":""}}