Eset is expanding its Threat Intelligence offering with the Investigation Lab. The tools are designed to help security analysts assess incidents faster and with greater confidence.
Eset is launching the Threat Intelligence Investigation Lab, a set of tools that lets analysts validate suspicious files and indicators. It is a separate service within Eset Threat Intelligence.
The lab combines two functions in one API-driven workflow. It should help SOCs save time on incident response, without replacing their existing way of working or their CTI (Cyber Threat Intelligence).
Based on Eset telemetry
The Investigation Lab relies on the Eset LiveGuard Advanced module, which monitors file behaviour within Eset Protect. On top of that comes the expertise of the research, threat intelligence and MDR teams.
The IOC (indicators of compromise) Search function checks IP addresses, URLs, hashes and domains on request against the telemetry and the intelligence data that Eset compiles itself. With Sample Submission, analysts submit samples for analysis. These end up in an advanced sandbox and are analysed, which produces behavioural evidence.
Extra information for analysts
SOC teams have to process suspicious IOCs and files every day. In doing so, they have to weigh the differing verdicts of various vendors, while context about behaviour is sometimes too limited and strict privacy requirements apply to sample analysis.
The Investigation Lab gives them a second opinion and readable reports. Analysts can see whether a file is dangerous, where it appeared before and what step comes next. On that basis, they decide whether to block, isolate, investigate further, escalate or close an alert.
With this targeted validation, Eset aims to reduce alert fatigue and improve investigation results. It wants to make telemetry more accessible to customers, with additional behavioural context.
Availability
The target audience consists of SOCs at large enterprises and government organisations, CERTs and MSSPs. The Eset Threat Intelligence Investigation Lab is available as a separate Eset Threat Intelligence service, via the Eset TI portal and via an API. Eset has not disclosed pricing.