CyberX ICS Threat Monitoring for Splunk
Overview
Details
The CyberX ICS Threat Monitoring application for Splunk makes it easier for industrial and critical infrastructure organizations to detect, investigate, and act on cyber threats to their industrial networks. By continuously monitoring wire data from industrial networks and applying patented behavioral analytics to it, CyberX enables joint customers to obtain real-time intelligence about OT risk and correlate it with other risk information in their Splunk repositories.
CyberX’s agentless, non-intrusive OT security platform enables joint customers to auto-discover their
assets and network topology, identify critical vulnerabilities and attack vectors, and continuously monitor their OT networks for destructive cyberattacks such as WannaCry, NotPetya, and TRITON.
Release Notes
Version 1.1.0
CyberX’s agentless, non-intrusive OT security platform enables customers to auto-discover their
assets and network topology, identify critical vulnerabilities and attack vectors, and continuously monitor their OT networks for destructive cyberattacks such as WannaCry, NotPetya, and TRITON.
Combined with the Splunk API, the CyberX client application adds OT wire-data to Splunk’s logging capabilities in order extend detection and of OT alerts. The graphical interface in the CyberX app allows Splunk administrators to analyze the OT alerts that CyberX sends and monitor the entire OT security deployment, including details such as:
• Which CyberX appliance sent the alert
• the source and IP address of the alert
• which protocol violation triggered the alert
• the severity of the alert
With the Splunk and CyberX integration, joint customers can reliably implement solutions and gain benefits such as hybrid ICS threat detection and real-time OT visibility.