Devo SIEM

API 2.0 Compatible

Devo’s SIEM platform collects, analyzes, and provides insight from ingested data and can be scaled as the amount of data grows. Devo enables a company to ingest data from all data sources, closing the visibility gap that puts your organization at higher risk.

By integrating Mimecast and Devo, organizations gain search and correlation capabilities across all log types to detect and   respond to cyberattacks. The analytics and integrated applications cut cyberattack detection times, empowering incident-response, and threat-hunting teams to uncover the full kill chain and proactively find malicious activity.

The Devo platform ingests Mimecast logs, along with other log sources, to obtain complete visibility across all environments. Fast, accurate threat hunting, investigation and response are possible only when analysts have full context about the alerts crossing their screens. Devo enables analysts to focus on the threats that matter most by enriching data with known threat activity, prior investigation history, and third-party intelligence feeds. Having that complete context at their fingertips across the entire threat lifecycle makes analysts more productive and effective.

Solution Overview

1. Emails received by Mimecast are passed through a series of hygiene scanning techniques, to ensure that they are safe before delivery to the recipient.

2. Email intelligence provided by Mimecast is sent to Devo Security for normalization.

3. Devo uses the email intelligence to alert analysts and add context to data from other data sources.

Mimecast and Devo Security Use Cases:

• Threat Correlation

  Identify initial attack deployment methodology, characteristics and subsequent access attempts without the need for manual effort or multiple toolsets. 

• Advanced threat Detection

  Improve your organization's security posture and detect threats by augmenting email perimeter defense with user and entity behavior analytics.

• Lateral Movement Detection

  Detect and follow attackers even as they switch IP addresses, devices or credentials

• Alert Prioritization

  Increase efficiency and effectiveness by prioritizing the most pressing threats.

• Threat Intelligence

  Understand how your organization has been targeted and what attacks have been blocked for better protection at the email perimeter, inside the network and beyond its perimeter.

• Threat Investigation

  Analyze activity events before and after an attack across the entire attack chain to enhance analyst productivity and repair vulnerabilities.

Key Benefits

1. Earlier detection and containment of attacks, with rapid response to phishing and business email compromise tactics.
2. Threat intelligence enrichment detects threats within Mimecast events.
3. Improve analysis and knowledge of threats through built in dashboards and Mimecast regional threat intelligence.
4. Correlation across Mimecast events, cloud, endpoint, and network data to quickly identify high-risk individuals and devices that may create future security breaches.
5. Shared intelligence identities the original threat and targets.