GLIMPS and SEKOIA.IO: a new example of interoperability within the OPEN XDR PLATFORM

The Open XDR Platform is an alliance bringing together specialized and complementary cybersecurity solution providers to offer a rapid, coordinated response to the ever-increasing number and sophistication of cyberattacks.

This modular, customizable approach provides analysts and security managers with the components they need to better deliver their day-to-day business. This alliance is based on the development of connectors between the various players to enrich each solution.

With this in mind, and to take advantage of the synergies offered by the Open XDR Platform, SEKOIA.IO and GLIMPS have worked on the interoperability of their solutions.

GLIMPS Malware Expert natively integrates a SEKOIA.IO connector, providing a first level of automatic enrichment for certain analyses. This integration gives Malware Expert users an overview of certain contextual information relating to malware identified by GLIMPS and known by SEKOIA.IO.

How does it work in practice?

When an alert is sent after analysis by GLIMPS Malware Expert, the full characterization is displayed in the complete GLIMPS Malware Expert view. But also a first level of information on the threat with the presentation of the malware file known by SEKOIA Intelligence. With a single click, users who are SEKOIA Intelligence customers can continue their journey through the SEKOIA.IO platform and benefit from all the known elements associated with the malicious code analyzed, such as its modus operandi, its targets, or the indicators that characterize it. This makes it much easier to choose the right actions to detect and remediate the threat.

What added value?

The use of SEKOIA Intelligence operational intelligence enables the analyst to immediately understand the nature of the threat identified by the GLIMPS detection engine in order to:

– consolidate cross-referenced information on the targeted threat in a single interface

– accelerate tactical decision-making and operational responses by providing context around the identified threat.

The combination of GLIMPS’ detection power and SEKOIA Intelligence’s knowledge enables analysts to immediately understand the scale of the threat. Mean Time to Detect (MTTD) is greatly accelerated.

Switching over to the full SEKOIA.IO interface for SEKOIA Intelligence customers enables them to benefit from the full CTI knowledge of the identified threat to counter it. This time, the “Mean Time to React” (MTTR) has improved significantly.

The aim of this integration is to automate the investigation and in-depth analysis of files linked to alerts from different sources, directly in the SEKOIA Defend console.

The GLIMPS connector in SEKOIA Defend can be configured in a matter of seconds using two elements:
– the URL of a GLIMPS Malware instance
– A GLIMPS API key
Once configured, an enrichment and analysis playbook is then available in SEKOIA Defend, making it easy to call up GLIMPS Malware to access existing analyses.

In just a few seconds, a “simple” result is obtained, including:

– File status: Malicious |Suspect | Safe
– Threat score
– Malware family
– Link to the full GLIMPS interface