1. Introduction to Illumination Process
Introduces Lumu's illumination process as the core of continuous compromise assessment. Explains how telemetry is collected and matched against known threats to confirm compromises.
Lumu's illumination process is the core enabler of continuous compromise assessment.This process is a patent pending technology that allows organizations to continuously detect and confirm compromise across network, identity, endpoint and cloud.Let's take a look at how it works first, telemetry is collected in real time and correlated against known compromises.LUMU gathers threat data from its own proprietary threat intelligence as well as privately and publicly curated sources.When there is a match with a known threat, a confirmed compromise is immediately reported resulting in a LUMU incident.
2. Detecting Anomalies with AI
Describes how residual telemetry is analyzed by an AI engine to find unusual behavior and anomalies of interest. Contrasts Lumu's approach with vendors that leave analysts to determine whether anomalies are real attacks.
We don't stop there.The residual telemetry is ingested into an artificial intelligence engine which allows us to identify anomalies in your environment.For example, traffic patterns or user behavioral patterns that are out of the ordinary or that occur within a certain frequency are flagged.What results of this is a list of anomalies of interest which may represent compromise.Those anomalies can be good or bad.
Most vendors report anomalies of interest to the security analyst and task them with identifying if they are an attack or a false positive.But LUMU goes beyond that.
3. Deep Correlation for Compromise
Explains the deep correlation step that measures how close anomalies are to known compromises. Shows how this process filters results into highly probable compromises and reports them as incidents.
Anomalies of interest are put through a process called deep correlation, which measures the technical distance between anomalies of interest and known compromises.As an example, cybercriminals can use a newly registered domain that resolves to IPs that are associated with known IOCs, or can be part of the same group that has acquired a large set of domains that are listed as known IOCs.This deep correlation step generates only highly probable compromises, and at this point, highly probable compromise is reported as a LUMU incident.
4. Historical Playback and Protection
Covers long-term telemetry storage and the playback concept used to compare new IOCs against years of network metadata. Concludes with the value of protecting against zero-day and emerging threats, followed by the call to action.
From here, the remaining telemetry is stored for two years.Why?Because when there are new IOCs, the next question you want to answer is if your network was speaking to those now known IOCs.And this is implemented through our proprietary playback concept which will compare every new IOC against 22 years of network metadata for every customer we're protecting.This unique differentiation allows us to protect customers from zero day attacks and newly emerging threats.
Experience the power of the illumination process by opening a LUMU free account today.
