Sangfor Technologies Named as an Example Vendor for NDR in Gartner Emerging Tech Reports

"To be competitive in the NDR market, product leaders must ensure their NDR offering has strong AI-based detection."¹

"AI is a core technology evolution that separates NDR from other network security products. Instead of a detection capability that identifies “known” attacks only, AI enables NDR to find “unknown” attacks via correlation of historic data or recognizing anomalous activity that is (or probably is) malicious."¹

"NDR detection starts from a network perspective and must also include behavioral detection capabilities, including signatureless methods and advanced analytics such as machine learning (ML) and other forms of AI."¹

Cyber Command’s unique AI detection utilizes several advanced techniques and technologies including:

1. Network Traffic Analysis (NTA): Cyber Command leverages advanced machine learning algorithms and AI purpose-built modeling to correlate and analyze network traffic in real time. By continuously learning from vast amounts of data, Cyber Command accurately identifies anomalies in traffic patterns that are highly indicative of malicious activity, such as lateral movement and data exfiltration. AI-enabled malware are increasingly executing these attacks using advanced techniques that cannot be detected using signatures. 
2. User and Entity Behavioral Analytics (UEBA): Cyber Command integrates AI behavioral analytics extends network traffic analysis to detect deviations in the normal behavior of users and applications. This approach enhances the detection of stealthy attacks that leverage compromised valid accounts and legitimate programs as well as insider threats.
3. Neural-X Threat Intelligence: Cyber Command integrates with Sangfor Neural-X, our AI powered cloud-based threat intelligence and analytics platform. Neural-X continuously enriches Cyber Command with real-time threat intelligence of malicious patterns and behaviors from proprietary and 3rd-party sources, ensuring that it remains effective against emerging threats.

Cyber Command aggregates and correlates data from multiple sources across the network, including network packets and NetFlow records, as well as external threat intelligence. It also supports threat detection in cloud environments by ingesting endpoint protection data, DNS logs and other data deployed on cloud infrastructure.

By correlating data from a wide coverage of sources, Cyber Command generates high-fidelity alerts that indicate genuine security threats.

Cyber Command’s unique Golden Eye feature provides security teams with a highly intuitive graphical representation of the APT attack chain, displaying every stage of cyber-attacks by simply inputting the IP addresses, domains, ports, or URLs. It provides security teams with in-depth visibility of attacks, including tracing the source of the attack and the attack path, and helps them assess the impact and severity of attacks so that they can take the most appropriate and effective action. Users can further drill down to each step for detailed insights and remediation suggestions.

Cyber Command also provides full MITRE ATT&CK mapping, encompassing the entire spectrum of adversary techniques, with each technique precisely mapped by its five detection engines. This mapping enables security teams to gain a comprehensive understanding of the techniques leveraged by threat actors to infiltrate and propagate through the network.

"To take advantage of the rise in interest in NDR among midsize organizations, product adjustments will be needed because midsize organizations have less resources and require more automation. For example, most artificial intelligence (AI) used in NDR today is still focused on detection. This remains important, but redirecting AI development to operational workflows should yield large improvements in automation and overall ease of use. Product leaders should look for opportunities to use AI in operational aspects, including:

1. Prioritization of alerts
2. Recommended next steps
3. Sourcing forensics automatically"²

Cyber Command harnesses the power of ML and purpose-built AI models to streamline the incident response process, enabling security teams to act quickly and effectively.

1. Prioritization of alerts: Cyber Command intelligently prioritizes alerts based on factors such as threat type, severity, criteria, and the detected interval to ensure that security teams focus on the most critical incidents, significantly reducing alert fatigue.
2. Recommended next steps: Cyber Command provides users with recommended next steps for each detected security incident. Mapping security incidents to the MITRE ATT&CK framework also provides valuable context and insights. Leveraging this, Cyber Command recommends appropriate next steps for security teams to take based on the best practices against specific threats.
3. Sourcing forensics automatically: AI plays a crucial role in Cyber Command’s ability to gather and analyze forensic data in the event of a security incident. By analyzing network traffic patterns, user behavior, and other relevant data, Cyber Command automatically researches and validates a wide variety of indicators of compromise (IOCs) and behavior indicators of compromise (BIOCs).

Cyber Command integrates seamlessly with other Sangfor products and services, including Endpoint Secure (EDR), NGAF (NGFW), and Neural-X. Using its built-in SOAR module, Cyber Command issues effective response actions to the other components. For example, Endpoint Secure can execute instructions from the NDR platform to isolate compromised hosts and scan all endpoints for the same malware.

Cyber Command also integrates with third-party firewall, endpoint protection, and SIEM products from an array of vendors, including Palo Alto, Sophos, Fortinet, Check Point, Cisco, Bitdefender, Symantec, Trend Micro, Splunk, IBM QRadar, and more.

"False positives and the fear of false positives remain the biggest reasons that organizations do not enable response…

…More confidence behind convictions should remove reluctance to use response, which is important to increase the value of NDR products."¹