Firewall Threat Detection & Response (TDR)

Starlight TDR solution effectively reduces threats entering customer’s network by automating the detection and response process. TDR produces IOC objects for firewall to perform blocking action to the IOCs.

Starlight TDR – How it works

The TDR system setup in the infrastructure consists of the following components

Firewall Log Analytics System
Threat Detection & Response (TDR) Machine Learning System

TDR System learns the network activities from the firewall Log Analytics system and accumulates Intelligence related to Attacker’s IP address. These IP addresses are stored in the Database as Attacker IOC objects.

TDR assigns retention period of the IOC objects depending on the intensivity of the learned attacks.

Firewall pulls Attacker IOC objects and applies them to its firewall protection profile. Matched IP address with the protection profile will be blocked by firewall.

Only clean traffic will pass through firewall.

Starlight Firewall TDR System eliminates the requirement of manual user intervention in responding to large quantities of attack activities to customer networks. It provides consistent results operating around the clock responding to attacks at machine speed.