From Threat Prevention to Protection
As a means of prevention, SSPM operates as the security layer in the Identity Fabric to establish robust user governance. As a second layer of threat protection, ITDR provides extensive coverage in detecting SaaS-related threats, such as password-based attacks, IP behavior anomalies, OAuth-based attacks, unauthorized document access, unusual user agent activities, and more.
How This ITDR Platform Can Help You
Tactics, Techniques, and Procedures (TTP)
MITRE ATT&CK Mapping
Alerts and SIEM & SOAR Integrations
Remediation Guidance
Get actionable insights and step-by-step guidance to address and mitigate vulnerabilities, weaknesses, or compromises in the event of a security incident
Threat Detection: Selected Examples
Payment Received
When a threat actor changed an invoice’s account payment information to redirect the funds to their own account, Adaptive Shield detected the change and ensured that the payment went to the correct account.
Two Places at Once
IP geographical data indicated a user accessed their CRM from Baltimore at the same time that they were logged into their email account from Paris. Adaptive Shield detected the anomaly and recognized that the Paris login was using an unusual OS. The company blocked the Paris login and reset the user’s login credentials for all applications.
Wrong VPN Accesses Application
A user who always logged into their applications through the company’s standard VPN was detected logging in through a private VPN, which is commonly used to hide identities. While this alone wasn’t enough to indicate a threat, the suspicious login took place at a time when it was unusual for the user to be logged in. The combination of factors led the security team to discover that the account had been compromised.
