McAfee Network Threat Response

McAfee Network Threat Response

Deconstruct, analyze, and respond to threats inside your network

Next Steps:

Overview

McAfee Network Threat Response is a software package that captures, deconstructs, and analyzes malware that is resident inside your network today. Network Threat Response is a powerful cybertool for security analysts. It automatically identifies malware targeting internal network vulnerabilities, and instantly captures and analyzes it to aid in rapid remediation and ongoing network defense.

Reveals what attackers don't want us to see
Network Threat Response combs through PDFs, Microsoft Office files, and all other network activities looking for attempts to hide or obscure malicious content, providing analysts with instant visibility into attacks.

Uncovers persistent attacks
Network Threat Response identifies and accumulates portions of attacks that trickle in over time, piecing together threat puzzles that sneak into networks at a snail’s pace.

Cuts analysis time down to minutes
Network Threat Response automates security analysts’ tasks by combing through network traffic, looking for signature patterns of malware activity. These attack vectors are automatically forwarded for full analysis and presented to the analyst who can view all the facets of an attack and make appropriate, targeted security changes. These targeted changes allow networks to maintain optimal protection with minimal impact on internal IT operations.

High-performance, high-security platform
Customers seeking to lower the hardware maintenance and management costs can now deploy Network Threat Response on the scalable and multifunctional CloudShield CS-4000 platform. Network Threat Response on the CS-4000 platform provides security-conscious enterprises with a scalable, physically secure, and cybertough approach to finding and avoiding security breaches caused by advanced malware attacks.

Features & Benefits

Maximizes Security Staff Effectiveness

A single McAfee Network Threat Response device gives any security team the power of 20 analysts and reverse engineers without requiring a single hire. Unlike other security devices, which can generate thousands of events a day, analysts can review every event generated by McAfee Network Threat Response within minutes.

Reveals What They Don’t Want Us to See

A distinguishing characteristic of advanced malware is its ability to evade detection. McAfee Network Threat Response looks at PDFs, Microsoft Office files, and all other network activities for attempts to hide or obscure traffic. NTR doesn’t just alert to the presence of obfuscation; it decodes the traffic, providing analysts with visibility into the attack that is not possible with other existing tools.

Increased Flexibility and Analytical Capabilities

IPS solutions that are deployed in-line are forced to make difficult trade-offs due to performance pressures. That means more complicated threats may go undetected. NTR sits out of band, which frees it to perform more in-depth analysis without having to worry about time contstraints.

Assembles Puzzle Pieces Together

Network Threat Response has the unique ability to uncover slow moving, persistent attacks, identifying and accumulating portions of attacks that trickle in over time. Nothing else gives our customers the ability to piece together threat puzzles that sneak into their network at a snail’s pace.

Multi-faceted Exploit Detection

Most tools are one-dimensional in their detections, but NTR utilizes a host of different methodologies that increase detection rates and allow for the detection of complicated attacks. NTR deploys a suite of commercial AV engines for validating network objects, in addition to McAfee AV. Sandbox Analysis? NTR deploys both ValidEdge and Cuckoo for executing and studying the impact of suspicious network objects in a virtual environment. In addition to these engines, NTR employs many other detection and analysis algorithms including JAR analysis, PDF analysis, Office document analysis, etc.

Shellcode Detection and Deobfuscation

Shellcode is the set of instructions used by malware to infect and control a device. McAfee Network Threat Response uses patent-pending heuristics to detect the presence of shellcode, without requiring prior knowledge of the ever-changing, encrypted attack payload. Even obfuscated shellcode is detected with NTR’s suite of analysis engines, and it takes it a step further, deobfuscating the detected code and presenting it for easy analysis by security professionals.

Cuts Analysis Time Down to Minutes

NTR automates the Security Analysts task by combing through network traffic looking for signature patterns of malware activity and attack. Once identified, these “attack vectors” are automatically forwarded into the full suite of NTR analysis services. The result of this processing is presented to the analyst who can view all the facets of the attack and make appropriate, targeted security changes. These targeted security changes allow networks to maintain optimal protection with minimal impact on internal IT operations.

Incident Response with PCAP Analysis

McAfee Network Threat Response accelerates the analysis of the captured data via its PCAP import capabilities. Captured data can be replayed through the McAfee Network Threat Response analysis engines where hidden traffic is decoded and key indicators are highlighted. As a result, an analyst has anchor points from which to start the investigation—shaving days off of analysis time. Netwitness and Solera are excellent sources of captured PCAP data.

System Requirements

McAfee Network Threat Response is a software solution that can run on a variety of hardware platforms. For optimal security and performance, we recommend running Network Threat Response on the CloudShield CS-4000 platform. Please see the data sheet for appliance specifications and details.

Awards / Certifications

CRN Ranks McAfee in their 2013 Top 25 Best Companies to Partner With
CRN Ranks McAfee in their 2013 Top 25 Best Companies to Partner With

Ranked by IT solution providers (SPs), CRN Research ranks the Top 25 must-have technology suppliers from a list of nearly 230 companies in 12 product categories that SPs need to consider when formalizing their partnerships today and for the future. 1,000 unique SPs of all types and sizes were surveyed.

Resources

Data Sheets

McAfee Network Threat Response on CloudShield CS-4000

For a technical summary of the CloudShield product listed above, please view the product data sheet and learn how McAfee Network Threat Response on the CloudShield CS-4000 platform complements your existing network defenses.

McAfee Network Threat Response

For a technical summary on the McAfee product listed above, please view the product data sheet.

White Papers

Low Hanging Fruits: The Top Five Easiest Ways to Hack or Get Hacked

How familiar are you with low-hanging fruit — the easiest ways for attackers to gain entry to your network and potentially run off with your valuable data? This white paper explores penetration tests that you can perform at your organization to gain an understanding of how to apply the proper defenses to prevent exploitation of the top five low-hanging fruit.

Deep Dive into McAfee Network Threat Response

By providing a single, expandable framework supporting a proactive security infrastructure, McAfee Network Threat Response enables IT administrators to focus on tasks core to their business model without the need to reconfigure, reinstall, and retrain for an ever-changing threat landscape.

Community

Blogs

  • Franchising Ransomware
    Vincent Weafer - July 2, 2015

    Got a great business idea? Want to expand with less risk? Build a good product, develop some training, put them together into a repeatable formula, and collect the royalties from your franchisees. This model, used successfully for everything from fast food to hair salons to tax preparation, is now available for criminal ransomware. Cybercriminals have […]

    The post Franchising Ransomware appeared first on McAfee.

  • Beat the Ticking Clock Against Emerging Threats
    Paul Zimski - July 1, 2015

    In order to beat todays advanced threats, your security defense system relies on good communication. However, when your security posture is dependent on a slew of different products from a spread of vendors, communication can break down. This breakdown in communication means you’re losing valuable time in detecting cyberthreats. To address this communication breakdown, there […]

    The post Beat the Ticking Clock Against Emerging Threats appeared first on McAfee.

  • Securing Critical Infrastructure
    Lorie Wigle - July 1, 2015

    Protecting the Industrial Internet of Things from cyberthreats is a national priority.  Industrial automation and control systems are increasingly online, sending out information and receiving commands from local and remote control centers and corporate data systems. Technologies in this Industrial Internet of Things (IIoT) have tremendous potential to improve operations, reduce costs, enhance safety, increase […]

    The post Securing Critical Infrastructure appeared first on McAfee.

  • Cyber Resilience And Spear Phishing
    Mo Cashman - June 29, 2015

    Balanced security capability, defense in depth, integrated countermeasures, and a threat-intelligence strategy are critical to defending your business from spear-phishing attacks. Spear phishing continues to be the most successful means of gaining entry to an enterprise network and to valuable business or personal data. According to the latest Verizon Data Breach Investigations Report, two-thirds of […]

    The post Cyber Resilience And Spear Phishing appeared first on McAfee.

  • Government Agencies Should Turn to CDM During 30-Day Sprint
    Tom Gann - June 29, 2015

    The fallout from the OPM breach continues with news that clearance information may have been stolen and that more than 10 million federal employee records may have been breached. In response, the White House has ordered every agency to engage in a “30 day sprint” to shore up and bolster their defensive cybersecurity capabilities. During […]

    The post Government Agencies Should Turn to CDM During 30-Day Sprint appeared first on McAfee.