<h2 class="text-center">Get Actionable Threat Detection</h2>
<h4>Enrich and accelerate your threat detection, alerting, and response capabilities with Anomali Match and Microsoft Azure Sentinel</h4>
<h3>Match and Sentinel Joint Solution Features</h3>
<ul>
<li>Combines Sentinel’s ability to aggregate data from all sources -- users, applications, servers, devices in the cloud or on-premises -- with Match’s continuous correlation of all event and log data against millions of global IOCs</li>
<li>Exposes previously unknown adversaries that have already penetrated your network</li>
<li>Allows instantaneous retrospective analysis of your event logs and your threat intel going back years</li>
</ul>
<h3>Enhances Your Azure Sentinel SIEM to</h3>
<ul>
<li>Correlate logs with millions of threat intelligence records imported into Anomali Match to create detection alerts</li>
<li>Export the alerts created by these matches back into Azure Sentinel in the form of Common Security (CEF) logs, and then create incidents on top of them for triage by the Security Operations Center (SOC) analyst team</li>
</ul>
<h2>Put Your Logs and Your Intel to Work at Scale</h2>
<p>Anomali Match is a high-performance threat detection and response solution that continuously correlates all collected security event and log data from Azure Sentinel and other sources against millions of globally observed indicators of compromise (IOCs) to expose previously unknown adversaries that have already penetrated your network. Match retrospective analysis looks back as far as five years. The integration allows a powerful bi-directional flow of data between Azure Sentinel and Match.</p>
<p>Azure Sentinel users can now export log data out of Sentinel into Anomali Match by simply registering an application in the Azure Active Directory. Once the log data is imported into Anomali Match, it is correlated against the threat intelligence also stored in Anomali Match and generates alerts as matches are identified. These alerts can then be pushed back to Azure Sentinel using a CEF over Syslog collector. This allows importation of high fidelity alerts from Anomali Match into the Common Security table of Azure Sentinel, from where customers can generate incidents using simple KQL-based scheduled rules for making them available for triage in Azure Sentinel</p>
<div class="row">
<div class="col-md-4">
<h4>Find Threats Faster</h4>
<p>Match works with Sentinel to capture and automatically, continuously correlate all of your historical event logs, asset data, and active threat intelligence to power comprehensive threat detection and response, resulting in faster Mean-Time-To- Detection (MTTD), reduced cost of security incidents, and more efficient operations.</p>
</div>
<div class="col-md-4">
<h4>See Alerts by Priority</h4>
<p>Triaging high volumes of alerts and prioritizing them for investigation and response is an ongoing challenge for SOC analysts. See alerts by priority, review only relevant log data, analyze a timeline of events to find “patient zero”, and alert incident response systems for remediation.</p>
</div>
<div class="col-md-4">
<h4>Investigate by Techniques</h4>
<p>Identify threats in your environment based on TTPs, as well as actors, campaigns, threat bulletins, and vulnerabilities. Search for intrusions in your environment by threat actor, threat bulletins, campaign, or vulnerability, and analyze the techniques for a selected actor in the MITRE ATT&CK framework heatmap.</p>
</div>
</div>
<h2><strong>Case Study:</strong> Have we been impacted?</h2>
<table style="width:100%">
<tbody>
<tr>
<td style="width:60px;vertical-align:top;"><img alt="" src="https://www.anomali.com/images/uploads/resources/challenge.png" style="width: 45px;" /></td>
<td>
<h3 class="nomargin">Challenge:</h3>
<p>When a new threat is discovered in the wild, searching back through historical logs to find out if you were compromised can be a long and expensive process.</p>
</td>
</tr>
<tr>
<td style="width:60px;vertical-align:top;"><img alt="" src="https://www.anomali.com/images/uploads/resources/solution.png" style="width: 45px;" /></td>
<td>
<h3 class="nomargin">Solution:</h3>
<p>Match tells you in seconds if a threat indicator was present in your historic event data months or years in the past.</p>
<ul>
<li>Search historical event logs going back five years or more</li>
<li>Search for threat indicators, Mitre Attack techniques, actors, vulnerabilities, or threat bulletins</li>
<li>Return all threat matches in seconds</li>
<li>Deliver these matches to Sentinel, or your ticketing or SOAR solution</li>
</ul>
</td>
</tr>
<tr>
<td style="width:60px;vertical-align:top;"><img alt="" src="https://www.anomali.com/images/uploads/resources/benefit.png" style="width: 45px;" /></td>
<td>
<h3 class="nomargin">Customer Benefit:</h3>
<p>Get to answers quickly and easily identify if you’ve been impacted by a specific actor or campaign.</p>
</td>
</tr>
</tbody>
</table>
<h2><strong>Case Study:</strong> Prioritized response based on Risk Score</h2>
<table style="width:100%">
<tbody>
<tr>
<td style="width:60px;vertical-align:top;"><img alt="" src="https://www.anomali.com/images/uploads/resources/challenge.png" style="width: 45px;" /></td>
<td>
<h3 class="nomargin">Challenge:</h3>
<p>Once you’ve identified malicious behavior in your network, it can be a challenge to decide which threats are the most important to deal with first.</p>
</td>
</tr>
<tr>
<td style="width:60px;vertical-align:top;"><img alt="" src="https://www.anomali.com/images/uploads/resources/solution.png" style="width: 45px;" /></td>
<td>
<h3 class="nomargin">Solution:</h3>
<p>Anomali Match integrates asset and vulnerability scan data into your threat detection results, allowing your analysts to prioritize remediation based on risk.</p>
<ul>
<li>Identify the top assets that show malicious activity at a glance</li>
<li>Prioritize response based on risk score and asset criticality</li>
<li>Track malicious activity back to the original point of intrusion and review a timeline of compromise.</li>
</ul>
</td>
</tr>
<tr>
<td style="width:60px;vertical-align:top;"><img alt="" src="https://www.anomali.com/images/uploads/resources/benefit.png" style="width: 45px;" /></td>
<td>
<h3 class="nomargin">Customer Benefit:</h3>
<p>Instead of looking for needles in a haystack of millions of alerts, know which are the highest priority needing investigation and response first.</p>
</td>
</tr>
</tbody>
</table>
