Deep Discovery

Targeted Attack Detection, In-depth Analysis, and Rapid Response

Network-wide monitoring powered by custom sandboxing and relevant real-time intelligence provide early attack detection, enable rapid containment, and deliver custom security updates to immediately improve your protection against further attack.

Deep Discovery’s proven approach provides the best detection with the fewest false positives and the greatest coverage by identifying malicious content, communications, and behavior across every stage of the attack sequence. Through detection and in-depth analysis of both advanced malware and evasive attacker behavior, Deep Discovery provides enterprises and government organizations with a new level of visibility and intelligence to combat APTs and targeted attacks across the evolving computing environment.

Deep Discovery provides custom defense against APTs

• Monitors your specific environment for malicious content, communication and behavior
• Uses detection methods tailored to your specific host configurations
• Leverages deep threat analysis to generate custom updates to your protection points
• Provides the customer-tailored and relevant intelligence to guide your rapid response

The Deep Discovery solution is comprised of two components. The Deep Discovery Inspector provides network traffic inspection, advanced threat detection and real-time analysis and reporting. The optional Deep Discovery Advisor provides open, scalable custom sandbox analysis, visibility to network-wide security events, and security update exports—–all in a unified intelligence platform.

Deep Discovery Inspector

This network security solution is purpose-built for detecting APT and targeted attacks. Deep Discovery Inspector uses a 3-level detection scheme to perform initial detection, then sandbox simulation and correlation, then ultimately, a final cross-correlation to discover “low and slow” and other evasive attacker activities discernable only over an extended period.

Specialized detection and correlation engines provide the most accurate and up-to-date protection aided by global threat intelligence from Trend Micro Smart Protection Network and dedicated Threat Researchers. The results are high detection rates, low false positives, and in-depth incident reporting information designed to speed the containment of an attack.

Deep Discovery Inspector Features

Advanced Threat Detection
Deep Discovery Inspector focuses on indentifying malicious content, communications, and behavior indicative of advanced malware or attacker activity across every stage of the attack sequence, using a non-intrusive, listen-only inspection of all  types of network traffic.

• Dedicated Threat Engines and multi-level correlation rules deliver the best detection and minimize false positives
• Virtual Analyzer uses custom sandbox simulation to provide additional detection and full forensic analysis of suspect content
• Smart Protection Network intelligence and dedicated Threat Researchers provide continually updated detection intelligence and correlation rules to identify attacks

Threat Tracking,  Analysis, and Action
Deep Discovery Inspector provides real-time threat visibility and deep analysis in an intuitive format that allows security professionals to focus on the real risks, perform forensic analysis, and rapidly remediate issues.

• Real-Time Threat Console places threat visibility and deep analysis at your fingertips
  • Quick access widgets provide critical information at a glance
  • In-depth analysis of attack characteristics, behavior, and communication
  • GeoTrack identifies the origins of malicious communication
• Watch List delivers risk-focused monitoring of high severity threats and high value assets
  • Focused tracking of suspicious activity and events on designated hosts
  • Hosts to be tracked determined via threat detection or customer selection
  • Detailed event timeline tracks all attack activities involving target hosts
• Threat Connect provides the threat intelligence you need to understand and remediate an attack
  • Direct access to Trend Micro intelligence portal for a specific attack or malware
  • Containment and remediation recommendations
  • Direction to available antivirus or other signature update for this threat

SIEM Management
Deep Discovery Inspector integrates with leading SIM platforms to deliver improved enterprise-wide threat management from a single SIEM console. 

• Network detections,  confirmed incidents and contextual data are reported to SIEM
• Deep network visibility enhances correlation and multi-dimensional attack profiling of SIEM
• Enterprise-wide threat detection and management provided by SIEM as the central console

Flexible, High-Capacity Deployment
Deep Discovery Inspector features a high-performance architecture designed to meet the demanding and diverse capacity requirements of customers of all sizes. The product is available on a full range of hardware, software and virtual appliances supporting multi-gigabit corporate backbones down to remote office locations.

Deep Discovery Advisor

This threat intelligence solution provides expanded threat analysis and visibility into network-wide security events and security update exports.

Deep Discovery Advisor Features

Threat Analyzer
The Threat Analyzer is an optional component designed to offer in-depth simulation and analysis of potentially malicious sample files including executables and common office documents. It can augment and centralize the simulation of Deep Discovery Inspector as well as provide advanced detection and analysis security for professionals or any security product or service via an open web services interface.

• In-depth threat simulation and analysis uses sandbox simulation and other advanced detection engines to classify and deeply analyze submitted files
• Custom sandbox execution environments allow the customer to create and analyze multiple fully custom target images that  precisely match their host environments
• Scalable architecture supports incremental capacity ranges up to 50,000 samples/day
• Open, automated, and manual submission supports input from security analysts as well as automated loopback by Trend Micro products and third-party or custom products
• Integration with Deep Discovery Inspector and other Trend Micro products provides expanded detection and analysis options to customers  

Threat Intelligence Center
The Threat Intelligence Center is a complete analysis environment for event data from the Threat Analyzer as well as security events and logs collected from Deep Discovery Inspector, other Trend Micro products, and third-party solutions. Using these sources and integrated Threat Connect intelligence, Threat Intelligence Center provides in-depth insights to drive risk-based incident assessment, containment and remediation.

• In-depth analysis of incidents and events using automated analysis, visualization, and advanced search and investigation tools
• Risk-focused monitoring and investigation
• Network-wide security event collection of events/logs from most Trend Micro and third-party products ensures a full risk assessment and effective containment and remediation measures 
• Threat Connect intelligence is automatically integrated into analysis results, providing detailed threat characteristics and context-relevant intelligence for containment and remediation
• Deep Discovery Inspector centralized reporting consolidates detection results from multiple Deep Discovery Inspector units into a single dashboard and customizable reports 
• SIEM connect with leading platforms delivers improved enterprise-wide threat management from a single SIEM console.

Security Update Server
The Security Update Server provides the means to export useful security blocking information learned from Threat Analyzer simulation. This information includes newly identified malicious IP/URL addresses and file hash codes that can be useful to a variety of security products. Deep Discovery Inspector and certain other Trend Micro products automatically receive this information. The information can also be manually exported via CSF files.