">

The Journey from Siloed Security to XSIAM

Understand how Endpoint Detection and Response, SIEM, and more are merging into a converged AI-driven platform for the SOC.
Click an icon on the map to reveal details
Milestone
Definition
Threat
Antivirus and Endpoint Protection
Endpoint Detection and Response
Network Detection and Response
Network Firewalls
User Behavior Analytics
Cloud Data and Cloud Security
SIEM
XDR
Direct Evolution (Solid Line)
Data Sent from (Dashed Line)
MFirst VirusAntivirusMTVirusOutbreaksMNGAVDEPPMDecline of EPPMPersonalFirewallMDiskEncryptionEDRMEDR FeaturesDEDR asa ServiceMEPPConvergenceMDeclineof EDRMLogManagementMCorrelationComplianceMSIEMMSIEM DefinitionDMBig DataStacksCustomAnalyticsMUBAMUEBADHow ItWorksDUBA =A FeatureMXDRITDRModuleDPacketFilterFirewallMStatefulInspectionDIntrusionsTNGFWMEnhancedLoggingMML-PoweredNGFWsDSoftwareNGFWVirtualization& CloudComputingDContainerization,KubernetesMCSPMMCWPPMCIEMMCNSPMCDRMXDRXDRMXSIAMAutomationwith SOARMXDR 2.0MXDR 3.0MCentral LogManagement andCorrelationMNDRMNDRDefinitionD

First Virus

The term "virus" was first coined to describe self-replicating programs by Frederick Cohen and his colleague, Len Adlema in 1983. Frederick defined a virus as "A program that can infect other programs by modifying them to include a, possibly evolved, version of itself."

Antivirus

Signature-based antivirus software was invented to scan all endpoint files for patterns or signatures of known malware.

Virus Outbreaks

In the late 1990s and early 2000s, viruses and worms like Code Red and Mydoom infected millions of computers.

NGAV

To combat polymorphic malware, security vendors added machine learning and behavioral threat protection to create next-gen antivirus in the early 2000s.

EPP

The endpoint protection platform (EPP) combines antivirus or next-gen antivirus, personal firewall, encryption, USB device control, vulnerability assessment, and more.

Decline of EPP

The Gartner Hype Cycle for Security Operations, 2021 claims: "Endpoint protection platforms (EPP) no longer address the nature of modern threats as it is no longer practical to focus on achieving 100% prevention and protection."

Personal Firewall

Personal firewall software, first appearing in the 1990s, protected endpoints by controlling inbound and outbound traffic.

Disk Encryption

To protect data from unauthorized access, disk encryption encrypts all data on a disk or disk volume.

EDR

Gartner Analyst Anton Chuvakin coined the term "Endpoint Threat Detection and Response" to describe "the tools primarily focused on detecting and investigating suspicious activities" on endpoints in 2013. This name evolved to Endpoint Detection and Response by 2015.

EDR Features

  • Endpoint data collection
  • Analysis of endpoint data to find anomalies and attack techniques
  • An interface for hunting and investigations
  • Response to remediate and recover from attacks

EDR as a Service

For scale, agility, and ease of management, EDR tools increasingly began to support cloud deployment.

EPP Convergence

The Gartner report "Redefining Endpoint Protection for 2017 and 2018" acknowledges the convergence of EPP and EDR, stating "Interest in [EDR] capabilities has grown significantly over the past few years and has become more broadly adopted and desired by the mainstream EPP market."

Decline of EDR

Log Management

Syslog was developed as a network-based logging service in the 1980s. Built for Unix systems originally, it is now supported by many operating systems and devices.

Correlation

Log management systems introduced correlation to link related events together. This advancement allowed users to analyze data from different sources together for advanced detection and security use cases.

Compliance

In 2004, the top payment brands released the Payment Card Industry Data Security Standard (PCI DSS). It mandated that organizations "track and monitor all access to network resources and cardholder data." Many organizations acquired log management systems to address PCI requirement 10.

SIEM

In 2005, Gartner analysts Mark Nicolett and Amrit Williams coined the term SIEM or security information and event management system. A SIEM combined the capabilities of:

SIM (security information management), which offered storage capacities and indexing of all traces of systems for analysis and reporting.

SEM (security event management), which offered real-time event processing to extract, normalize, correlate, and report alerts to the operators in a management console.

SIEM Definition

As defined by Williams and Nicollet, a SIEM solution shall:

  • Be capable of analyzing, gathering, and presenting information after collecting it from the network and connected security devices
  • Have identity and access-management applications
  • Have tools for vulnerability management and policy compliance
  • Consist of the operating system, application logs and database, and external threat data

Big Data Stacks

In January 2008, Yahoo released Hadoop as an open-source project. Big data technologies like Hadoop help organizations store and process large datasets.

Custom Analytics

Vendors began using big data and analytics to detect financial fraud, account takeover, and insider abuse.

UBA

User Behavior Analytics (UBA) emerged as a technology that "helps enterprises detect insider threats, targeted attacks, and financial fraud," according to the 2014 Gartner Market Guide for User Behavior Analytics. UBA platforms provided visibility into activities and behaviors of threat actors and malicious insiders.

UEBA

The UBA category expands to include behavioral analysis of "entities" such as devices and applications, in 2015.

How It Works

UBA uses large datasets to model expected and unusual behaviors of users and entities within a network. It uses machine learning and statistical analysis to determine whether anomalous activity or behavior could indicate an attack.

UBA a Feature?

Increasingly, UBA became a feature of other security tools, such as SIEM, Cloud Access Security Brokers (CASB), or XDR.

XDR ITDR Module

The Cortex XDR ITDR module leverages AI and automation to offer advanced protection against identity-based threats, integrating detection with UEBA to streamline the security stack. It enhances threat response, focuses on high-priority incidents, and supports continuous monitoring, reducing the risk of security breaches.

Packet Filter Firewalls

Early packet filter firewalls emerged in the late 1980s to help monitor and control network traffic. They were simple but also easy to bypass.

Stateful Inspection

Stateful packet inspection firewalls added the ability to track the sessions of network connections traversing through the firewall.

Intrusions

Worms, Trojans, and phishing led to an increase in network intrusions in the early 2000s.

NGFW

Palo Alto Networks introduced the first next-generation firewall (NGFW) in 2008. The NGFW offered enhanced application visibility and control to traditional firewalls and also added user, content, and app awareness.

Enhanced Logging

To power network detection and response, NGFWs add rich device and application data to log messages.

ML-Powered NGFWs

For the first time ever, machine learning allows NGFWs to deliver proactive, real-time, and inline zero-day protection.

Software NGFW

Similar to the Hardware NGFWs but offered in virtualized, containerized, or cloud form factors to ease deployment and scaling of network security.

Virtualization & Cloud Computing

Cloud computing was first used in 1996 by engineers at Compaq to refer to the delivery of computing services over the quickly expanding yet still nascent commercial internet. Virtualization, originally developed in the 1960s to partition mainframes, evolved and helped pave the way for cloud computing.

Containerization, Kubernetes

In 2014, Docker took containers mainstream, allowing users to run multiple containers or applications on the same kernel or operating system. The release of Kubernetes v1.0 in July 2015 took container deployment, management, and scaling to the next level.

CIEM

Cloud Infrastructure Entitlement Management (CIEM) products, according to Gartner, help organizations manage cloud access risks. They use analytics and machine learning to detect anomalies in account entitlements and privileges.

CNSP

Organizations are increasingly turning to Cloud Native Security Platforms (CNSP) to protect their cloud assets. CNSPs:

  • Provide context about cloud infrastructure, users, platforms, data and workloads.
  • Empower SecOps and DevOps teams to respond to threats and protect cloud native applications.
  • Remediate misconfigurations and vulnerabilities across the entire build-deploy-run lifecycle.

CDR

Cloud Detection and Response (CDR) allows SOC teams to extend detection, monitoring and investigation to cloud environments. Encompassing cloud host data, traffic logs, audit logs, and cloud security data, CDR empowers SOC teams to hunt for threats and quickly uncover and respond to attacks.

CSPM

Cloud Security Posture Management (CSPM) products reduce risk and improve defenses of cloud resources by providing visibility into misconfigurations, detecting threats and addressing compliance. According to Gartner research, in 2021, 50% of organizations mistakenly have cloud storage, applications or APIs directly exposed to the public internet, driving the need for CSPM.

CWPP

Gartner defines cloud workload protection platforms (CWPPs) as "workload-centric security products that protect server workloads in hybrid, multicloud data center environments." Organizations need to protect workloads by identifying vulnerabilities and misconfigurations and protect against attacks with runtime protection and development scanning.

Learn more by reading the Gartner 2021 Market Guide for Cloud Workload Protection Platforms.

The Industry's First XDR Platform

In February 2019, Palo Alto Networks introduced Cortex XDR. Cortex XDR gathers endpoint, network, and cloud data for detection and response. XDR is designed to detect attacker techniques that evade prevention, streamline analysis, and improve SOC efficiency.

XSIAM

Cortex XSIAM, the automation-first platform for modern SOCs, leverages machine intelligence to transform security operations. Integrated with Cortex XDR, it enhances threat detection and response, streamlining SOC activities through automated analysis and rapid incident management, thus delivering superior security outcomes with efficiency and precision.

Automation with SOAR

XDR platforms integrate with security orchestration tools for case management, alert enrichment, response automation, and more.

XDR 2.0

XDR platforms begin to gather data from third-party sources such as firewalls. XDR platforms fully integrate NGAV and endpoint protection capabilities.

XDR 3.0

Third-generation XDR platforms add support for data from any source, full cloud detection and response, including containers and Kubernetes integration, identity analytics, and digital forensics.

Central Log Management and Correlation

XDR platforms added the ability to collect, parse, and correlate data from any source.

NDR

Network Detection and Response(NDR) tools first appeared in the mid-2010s to help organizations detect network-based threats such as lateral movement, command and control, and malware activity.

NDR Definition

According to Gartner, "NDR solutions primarily use non-signature-based techniques (for example, machine learning or other analytical techniques) to detect suspicious traffic on enterprise networks." NDR tools monitor and analyze network traffic and profile behavior to detect unusual activity associated with attack techniques.

© 2024 Palo Alto Networks, Inc. All Rights Reserved.
Privacy | Terms of Use | Contact Us