xTONER
Governance of Predictive Risk, Threat Intelligence & Incident Management
THREAT INTELLIGENCE & INFOSHARING: THE BUSINESS ISSUE
The Cyber threat landscape is growing rapidly and organizations, both public and private, are faced with increasingly complex and numerous attacks. In such a scenario, Cyber Threat Intelligence (CTI) is an essential part of risk management, enabling a greater understanding of the threats that are occurring and those that are being prepared, and gathering the information needed to prevent, identify and mitigate attacks, in order to minimize their impact.
But Cyber Threat intelligence can no longer be limited to the corporate sphere: the notion of Cyber Intelligence is increasingly joined by that of Cyber Infosharing, which is the ability of different players, industries, financial services companies, public or private actors, to share intelligence capabilities and IoCs to create a common awareness and ability to respond to cyber risk, especially for threat prevention purposes.
In order for Cyber Threat Intelligence & Infosharing to be effective, there are two key factors: the relevance of the information, which must be rapidly available, complete and reliable, and its interoperability, which must be supported by the standardization of CTI information according to specific formats (e.g. STIX, TAXII, etc.).
xTONER is a threat intelligence platform for the management, correlation and sharing of feeds, for a proactive risk management and an effective and timely prevention and mitigation of threats, incidents and data-breaches. The solution allows to intervene directly on Cyber Intelligence information, initiating Incident Response processes.
Key Features
DOCUMENT ACQUISITION
• Automated acquisition
• Document Analysis
• Management of meta-information
• Observable collection
• Document Analysis
• Management of meta-information
• Observable collection
FEED COLLECTION
• Automated feed acquisition planning
• On-demand acquisition
• Correlation between feed information and observables
• On-demand acquisition
• Correlation between feed information and observables
OBSERVABLE & IoC
• Manual input of Observables
• Observables/feeds correlation
• Promotion to IOC
• Enrichment
• STIX editor
• TAXII Sharing
• Observables/feeds correlation
• Promotion to IOC
• Enrichment
• STIX editor
• TAXII Sharing
RESEARCH
• Research on feeds
• Research on documents
• Information Export
• Research on documents
• Information Export
REPORTING
• Standard/Custom
INCIDENT MANAGEMENT WORKFLOW CREATION
The Incident Management & Response Workflow can be created and customized through xToner's low code workflow builder
AUTOMATED DOCUMENT ANALYSIS AND OBSERVABLE EXTRACTION
When opening an incident it is possible to associate a set of machine-readable documents to it, which xToner will store and analyze to automatically identify a set of Observables for each document
INCIDENT ENRICHMENT & FEED CORRELATION
xToner automatically integrates the documents related to the incident with the extracted observables and other intelligence feeds collected by the platform.
This provides the intelligence team with all the information they need to assess and take action on the incident.
This provides the intelligence team with all the information they need to assess and take action on the incident.
IoC CREATION & ENRICHMENT
xToner allows in-platform promotion of the Observables to full-fledged Indicators of Compromise, their correlation with other IoCs and their enrichment with additional information to define complete attack scenarios
SCENARIO MODELING AND SHARING
xToner's Visual scenario editor allows easy modeling of Threat scenarios in STIX 2.1 standard, allowing its publication on TAXII servers for Inosharing purposes.