Most security products have done well at detecting suspicious activities in the past by correlating events and behaviours over time. However, over the years the attackers have evolved, their attacks have become sophisticated, and their activities are harder to detect. The event-centric approach no longer works as the attackers use legitimate operating system tools to evade these simple heuristics to stay under the radar. Instead, we need a solution that looks at the attacker’s behavior holistically and over longer periods of time, across all data sources including EDR, NDR and SIEMs.

With Kognos, attacks are identified faster with higher accuracy and the scope and context of the attack can be autonomously investigated. It also provides real-time response capabilities with fully enumerated list of compromised devices, suspicious processes, suspicious external domains.