Lacework launches new capabilities for better threat detection

Lacework has announced new capabilities that enable organisations to uncover more critical threats to their infrastructure and empower teams to collaborate more efficiently in alert investigation and response.

More specifically, Lacework has added fully automated time series modelling to the existing anomaly detection capabilities of the Polygraph Data Platform.

Using automated learning and behavioural analytics, the time series model builds a baseline of the volume and frequency of activity within a customer's environment and actively monitors for spikes that deviate from that unique baseline to detect potential threats, such as cryptominer attacks and compromised accounts, with accuracy.

Organisations can also proactively discover increased cloud usage due to misconfigurations - gaining a better understanding of their environment to help control costs.

Lacework has also upgraded its alerting experience with features that empower teams to collaborate more efficiently in alert investigation and response.

Polygraph, the Lacework cloud behavioural analytics engine, uses dozens of models to build a baseline of normal behaviours in the cloud. The time series model introduces a new dimension of analysis by tracking changes in activity frequency and volume over time in a cloud environment. It works with the existing models to uncover more anomalies with fewer alerts.

Lacework also automatically adjusts the severity of alerts based on continuous learning and a fine-grained understanding of how much the observed behaviours deviate from the predicted baseline for improved accuracy.

According to Cybersecurity Ventures, the number of unfilled cybersecurity jobs worldwide grew by 350% between 2013 and 2021 with no sign of relief in the next five years. By consolidating alerts into only those that matter and providing security teams with more context about what is happening across their environment, Lacework is focused on allowing these overburdened teams to uncover more risks and deal with them more efficiently.

Frank Dickson, IDC group vice president, security and trust, says, "It's critical organisations get transparency as to what is happening across their multicloud environments, but security teams face a massive challenge keeping up with the dynamic nature of cloud environments while threats like cryptomining continue to proliferate.

"As an industry plagued by a seemingly insurmountable skills shortage, simply layering more alerts on the SOC does not help. Context matters; context quickly forwards SOC investigations from awareness to understanding by enabling correlations across datasets.

"Alerts are thus replaced with context rich incidents that are quickly actionable and facilitate outcomes for customers. In the end, secure outcomes are the goal of every SOC.

Lacework has also revamped the alerting experience to help organisations better collaborate with teams to prioritise, investigate, and track the status of all alerts. This includes:

• Context-rich insights: Insights give the complete picture of what happened, associated events, timelines, and other details, helping organisations understand where to focus and make better decisions.
• Configurable bi-directional sync: When teams update an alert on the Lacework user interface or the associated ticket in backend workflow tools like Jira, the alert status is automatically updated on both sides with bi-directional sync for accelerated resolution. Organisations can also give feedback on Lacework alert severity levels, which in turn helps the Polygraph Data Platform learn and optimise modelling to further improve alerting experience.
• Alert lifecycle management: Teams can more easily organise alerts, view tags, filter to see a set of specific alerts, change the state of an alert to indicate whether it needs to be investigated or has been resolved, and add comments to classify and better collaborate with teams.

Arash Nikkar, VP of engineering, Lacework, says, "Lacework relentlessly innovates to deliver features that help customers gain the visibility and controls they need to stay ahead of the evolving threat landscape.

"The Polygraph Data Platform is the only cloud security solution to combine automated time series analysis with sophisticated cloud behavioural analytics to build baselines that are tailored to a company's unique environment.

"Combined with our enhanced alerting capabilities, we're making it easier for teams to identify relevant risks and prioritise threats, even as their organisation scales, the attack surface grows bigger, and security incidents increase exponentially.

Time series modelling is available now for Lacework customers in AWS environments. Configurable bi-directional sync enhancements to the Lacework alerting experience are available to select customers in beta.