![\"\"](\"https:\/\/www.cloudfall.cn\/wp-content\/uploads\/2022\/05\/image-15.png\")
<\/figure>\n<\/div>\n\n\n\n\n\n\n
Why UEBA is needed ? <\/p>\n\n\n\n
- According to the security consulting firm’s report, for the ratio of insider to outsider threats to the enterprise is approximately: 75% vs 25%<\/li>
- Cost and frequency of insider threats have increased dramatically over the past two years. the average cost of an insider threat incident in 2019 was $11.45 million, up nearly 31% from $8.76 million in 2018, and the number of threat incidents was 4,716, up 47% from 3,200 in 2018<\/li>
- Common enterprise pain points: missing data sources for insider threats \/ missing user behavior perspective \/ static rule-based prone to a lot of false positives and noise \/ missing long-cycle analysis algorithm capabilities<\/li><\/ul>\n\n\n\n
![\"\"](\"https:\/\/www.cloudfall.cn\/wp-content\/uploads\/2022\/05\/image-16.png\")
<\/figure>\n<\/div>\n\n\n
\n\n\n\nRedkernel UEBA<\/p>\n\n\n\n
Cloudfall Redkernel aims to focus on insider threats and unknown threats based on users’ existing data base and through pre-built machine learning algorithms and models. At the same time, through the long-term operation and improvement of the analyst team, the models and scenarios are constantly tuned and improved to make UEBA truly usable and intelligent.<\/p>\n\n\n\n
- Redkernel relies on public cloud and cloud-native technologies and does not require users to take on huge local computing resources or expertise in information security and machine learning.<\/li>
- Advanced analysis models and static association rules combine to set a baseline for normal user and entity activity to detect deviations from that baseline, the peer group’s baseline, and the organization.<\/li>
- Sensitive data loss and detection of insider threat risk signals.<\/li><\/ul>\n\n\n\n<\/div>\n\n\n\n
Common application pain points<\/strong><\/p>\n\n\n\n
\n\n- UEBA relies heavily on advanced analytical methods, and it is difficult for companies to effectively assess the skills and capabilities of their suppliers.<\/li><\/ul>\n\n\n\n
- For enterprise users, even for a single scenario and use case, UEBA deployment can be more time and labor intensive than the vendor promises. <\/li><\/ul>\n\n\n\n
- Most enterprises do not use and operate SIEM solutions well and lack the data base, detection system, expert knowledge and other related conditions<\/li><\/ul>\n<\/div>\n\n\n\n\n
![\"\"](\"https:\/\/www.cloudfall.cn\/wp-content\/uploads\/2022\/05\/image-17.png\")
<\/figure>\n<\/div>\n<\/div>\n\n\n\n
\n\n\n\nRedkernel Lite<\/p>\n\n\n\n
In the era of big data, traditional manual analysis can no longer meet the needs of enterprise users who need to process massive amounts of data every day. RedKernel Lite, as an intelligent algorithm engine, can help enterprise users combine with their own data platforms to provide flexible anomaly detection capabilities through a PaaS-based approach.<\/p>\n\n\n\n
RedKernel Lite relies on public cloud and cloud-native technologies for rapid deployment, expansion and use, and does not require user expertise in machine learning. As a product for enterprise users, RedKernel supports all types of databases commonly used in the industry and provides a simple and easy-to-use web-based operating platform.<\/p>\n\n\n\n
<\/div>\n\n\n\n![\"\"](\"https:\/\/www.cloudfall.cn\/wp-content\/uploads\/2022\/05\/E2fFHVfts0.jpg\")
<\/figure>\n<\/div>\n\n\n
\n\n\n\nMain Functional Modules<\/strong><\/p>\n\n\n\n
<\/p>\n\n\n\n
Redkernel supports automated feature engineering and model tuning, as well as various types of data. The built-in anomaly detection models support supervised, semi-supervised and unsupervised models, and algorithmic models across multiple categories such as time series prediction models, machine learning models and deep learning models. With the increasing emphasis on model interpretability, all of Redkernel’s built-in models provide model interpretability, which not only helps users better understand model prediction results, but also provides corroboration for model credibility.<\/p>\n\n\n\n
<\/p>\n\n\n\n
<\/div>\n\n\n\n\n\nUser entity behavior analysis<\/h3>\n\n\n\n
\n\n\n\n
- Most enterprises do not use and operate SIEM solutions well and lack the data base, detection system, expert knowledge and other related conditions<\/li><\/ul>\n<\/div>\n\n\n\n
- For enterprise users, even for a single scenario and use case, UEBA deployment can be more time and labor intensive than the vendor promises. <\/li><\/ul>\n\n\n\n
- UEBA relies heavily on advanced analytical methods, and it is difficult for companies to effectively assess the skills and capabilities of their suppliers.<\/li><\/ul>\n\n\n\n