USE CASE EXAMPLE Searching and Using Current & Historical EDR Data Across Security Operations

The Challenge Current and historical EDR data is valuable for many security operations activities, such as event & incident investigation, threat hunting, and incident response. When security data is hard to reach, analysts and security operators are less likely to make use of it when they need it most.

Endpoint Detection and Response (EDR) is a key control for strong security operations, but… Storage EDR systems create approximately 25GB of data per 1000 employees per day. Ingestion Putting all of this data in a SIEM can cost $40-100k per 1000 employees a year. Normalization Attempting to filter or transform the data is time consuming and can result in missing data.

The Solution With one search bar to simultaneously search current and archived EDR data, Query can deliver answers from EDR data wherever it is already stored.

Our federated search for security solution: Restores Control Gives you control over where and how EDR data is stored. Save money by archiving data to low-cost cloud storage — reducing cost. Enriches Data Enriches answers with context from other distributed security relevant data without needing to move or transform data ahead of time — increasing visibility. Visualizes Connections Visualizes data linkage and context to allow operators to quickly orient and act; eliminating alert fatigue and providing additional understanding and situational awareness. Streamlines Investigations Quickly pivots from one question to the next — reducing time to investigate and respond to minutes instead of hours.