As businesses adapt to the changing digital landscape, more customer and business operations are shifting from being behind the protection of firewalls to being available via the internet. This exposes your company and customers to extremely skilled, malicious, and persistent threats.

The good news for threat hunters in your organization is that data exists to help expose the infrastructure being used by attackers. This allows you to find, block, and prevent attacks.

RiskIQ PassiveTotal™ expedites investigations by connecting internal activity, event, and incident indicator of compromise (IOC) artifacts to what is happening outside the firewall—external threats, attackers, and their related infrastructure.

PassiveTotal simplifies the event investigation process and provides analysts access to a consolidated platform of data necessary to accurately understand, triage, and address security events.

• Simplify and accelerate the investigative process
• Intelligently aggregate and correlate data to provide context to events
• Proactively track and alert on changes in threat infrastructure to predict new attack vectors
• Identify and proactively block all threat infrastructure being used by the attackers

Watch the video: PassiveTotal in 60 Seconds

Your internal security systems are constantly generating alerts based on events and anomalies inside your organization. Often, the alerts are triggered by activity that has origins or is beaconing outside the firewall and need to be enriched quickly to provide context and triage them for investigation.

PassiveTotal provides your security teams with the tools needed to investigate and connect your internal anomalies or indicators of compromise (IOCs) with threat actors, their tactics, techniques, and procedures (TTPs), and other infrastructure that they’re using. PassiveTotal helps answer questions like:

• Who is attacking me?
• Where are they coming from?
• What else belongs to them?

See how The Citizen Lab Defends Civil Society with PassiveTotal in this case study.

Don’t reinvent the wheel. PassiveTotal makes it easy for analysts to share information about existing and ongoing investigations and known threat infrastructure using projects.

Projects allow organization of related threat infrastructure elements, like domains, IPs, website trackers, WHOIS registrant information, to make it easier to hand off investigation working files to other analysts or maintain an ongoing workspace for a particular research project. These projects can be shared publicly with the security community, or privately with other analysts in within the organization.

RiskIQ also works closely with the analyst community and publishes curated public projects as starting points for new investigations. These projects include recent threats, many of which appear in the news, giving you a head start in your research.

Read what Ovum Research says about how RiskIQ helps businesses see, manage, and mitigate web, social, and mobile threats in the On The Radar Report.

Leverage PassiveTotal’s extensive internet data sets in existing security tools via apps written for Splunk and IBM QRadar. PassiveTotal has an extensive API capability that allows your organization to bring the vast RiskIQ and PassiveTotal data sets directly into your own security operations tools. You can even create visual graphs using PassiveTotal Maltego transforms hosted by Malformity.