Collect, Alert, Respond
Cyphon is an incident-response platform that receives, processes, and triages events to create a more efficient analytic workflow — aggregating data, bundling and prioritizing alerts, and empowering analysts to investigate and document incidents.
Cyphon collects data from a variety of sources, including emails, log messages, and social media. It lets you shape the data however you like, so it’s easier for you to analyze. You can also enhance your data with automated analyses, like geocoding.
Cyphon creates alerts for important data as it arrives, so you’re notified when something of interest happens. You can prioritize alerts using custom rulesets, and bundle related alerts so you don’t get inundated.
Analysts can quickly investigate alerts by exploring related data, and annotate alerts with their findings. With JIRA integration, they can escalate important alerts by creating a ticket in Service Desk.
Many organizations manage post-processed security events as email notifications, which is incredibly inefficient. An inbox flooded with alert notifications creates an environment where critical issues are overlooked and rarely investigated.
Cyphon eliminates this issue by throttling events and prioritizing them based on user-defined rules. Analysts can quickly investigate incidents by correlating other data sets against indicators that matter. They can then annotate alerts with the results of their analysis.
Today, Cyphon supports integrations with Bro, Snort, Nessus, and other popular security products.
Social Media Monitoring
Leveraging publicly available APIs, Cyphon can collect data from streaming sources. Search is based on keywords, geofencing, and adhoc parameters. Cyphon supports the current version of the Twitter Public Streams API.
IoT and Sensor Data Processing
Cyphon can process events from any sensor type, offering a unique way to analyze information from physical environments.
- Aggregate data from numerous sources: email, logs, social media, and APIs
- Enhance data with automated analyses, like geoip
- Generate custom alerts with push notifications
- Throttle alerts and bundle related incidents
- View alerts by category, priority, and source
- Investigate alerts and track work performed
Third-party dependency security patches:
Copyright (C) 2017 Leila Hadj-Chikh, Chase Brewer