Splunk and DTEX Systems are accelerating security response times and root cause analysis, driving faster event resolution with advanced analytics and reporting, as well as decreasing manual security and IT operations. DTEX InTERCEPT’s human-based endpoint telemetry provides the full context around the data, machines, applications, and people involved in an event via a single, noise-free endpoint data signal.
DTEX InTERCEPT brings a previously unavailable data source to existing cyber security architectures that multiplies the value of NGAV while allowing for the consolidation of UEBA, endpoint DLP and digital forensics tools. It’s next-generation DMAP+ forwarders and cloud analytics engine deliver a single endpoint data source to Splunk security solutions to proactively identify insider threats, predict data loss events, protect remote workers, flag possible credential compromise, and monitor file servers and packaged applications for abnormal behavior and requests.
“Early customer response to our integrated solution with Splunk Enterprise Security and Splunk SOAR has been overwhelmingly positive,” said Mohan Koo, Co-founder and Chief Technology Officer at DTEX Systems. “Unlike legacy solutions, DTEX InTERCEPT provides a simple and clear view of human activity, and because the hundreds of meta-data elements we collect are filtered at the source, the number of notable events that require investigation drops by nearly ninety-percent. This means overworked SOC teams and analysts spend more time focused on what matters and can have full confidence in automated response and orchestration workflows.”
Splunk Enterprise Security ingests DTEX InTERCEPT’s risk-based alerts, also known as ‘Indicators of Intent,’ from the Splunk Security Analytics Platform. It uses these alerts to provide customers with a better, more contextually rich understanding of how user activity is influencing what’s happening in their environments and if those behaviors are creating risks to data, users and operational processes.