The SAGAN Security Analytics Platform

Our Packet Analysis solution detects intrusions by first parsing network traffic in order to extract its application-level semantics. It then executes event-oriented analyzers that compare the activity with patterns deemed nefarious. Its analysis includes detection of specific attacks including those defined by signatures, as well as those defined in terms of events and unusual activities or patterns.

BlueDot Threat Intelligence System is our solution to combat reputational deficiencies and garner a new paradigm of threat detection technology. 

• Powered by the Core Sagan Technology, BlueDot is a comprehensive tool that analyzes system and network artifacts in real-time in order to identify emerging threats. 
• It aggregates and processes information from honeypots, malware research, and incidents vetted by our skilled team of security analysts to find relationships between attack data.
• Information from BlueDot feeds the Sagan Ecosystem’s real-time detection capabilities, where analysts can use historical threat data to correlate attacks between adversaries and industries.

Malware Detonation comes standard as part of the Sagan Technology Platform and allows our sensors to extract files traversing your network and safely execute (detonate) them in a secure network off-premises. This technology is used to detect malware where other tools, like antivirus, fail. Rather than depending on signatures and static analysis, the malware is detected by its behavior within a secure virtual environment. This type of service is useful in detecting advanced threats and undocumented attacks.

Phishing and domain squatting attacks often rely on the end-user to detect and report potential threats and incidents. We have developed a proactive utility,

• Domain Tracker reduces the potential for human error, automates enrichment of data related to suspicious domains, and disseminates additional attack indicators throughout the Sagan Ecosystem.
• Domain Tracker takes initiative from potential attackers by anticipating possible attack vectors before they can be utilized.

One of the key security issue is identifying the assets that you are trying to defend. In many network, it is often challenging to know what is in the network at any given time, and what services are running. To solve this problem, Quadrant developed a passive fingerprinting system that uses data we already have access to. At the packet level, we create special signatures to identify software and services running in your network. At the log level, we have special signatures to identify services that are running on the system. The resulting data power the Fingerprint screen within the Quadrant console, which gives you a view into your network as it looks "at this point in time".  Historical data go into a long-term storage system. 

The most useful and important feature of this system is the correlation of fingerprint events with alerts. When a security event is identified, our analysts will receive not only the information about that specific event but the current fingerprint data as well, allowing our analysts to make better determinations about the attack and the likelihood of success.  

Upon start-up, Quadrant’s product contains over 8,000 internally developed attack signatures that are used to detect and validate malicious activity and critical events throughout your infrastructure.

• In addition, custom rules and signatures are written specific for your network, devices, and applications to maximize visibility and detection, at no additional charge.
• Custom reports are available in the state-of-the-art Sagan Console and can be tailored to your individual needs, ranging from detailed technical reports to high level overviews of activity.

The Sagan Console is Quadrant’s state-of-the-art security dashboard and event analysis portal. Each Client has access to their own portal via the web, thus making it available from anywhere. The Console houses a number of important features:

• The dashboard provides a quick overview of the system’s operational status and any security threat activity.  

• Search functionality for events, network packets, and logs.

• Security event origins are displayed on an Attack Map, giving you a glimpse into the types of threat actors that may be targeting your networks.

• Custom executive-level reporting capabilities through aggregated event data.