Transparent Real-time Enterprise Network Defense (TREND)

Enterprise Network Defense Overview

Transparent Real-time Enterprise Network Defense (TREND) provides enterprise network command, control, situational awareness, and network policy using CloudShield's trusted, multi-bladed, deep packet processing platforms. TREND enables immediate blocking, logging, or other measures to be taken by the network before potential threats reach their destinations. Customers can manage these threats using the TREND application operating on CloudShield platforms through real-time command and control as well as policy enforcement. With TREND, users can define policy triggers and set automated responses, such as blocking traffic or capturing questionable flows, and provide this insight to security operators for oversight and corrective actions.

TREND Applications

TREND resides in an enterprise security or network operations center with a client program running on CloudShield platforms deployed within and around the enterprise network. It lets operators define their view of network traffic and how they want the system to respond. When a trigger is detected, the response is implemented inside the TREND application running on CloudShield, and an alert goes back instantly to the TREND situational awareness system for operator awareness and intervention. TREND provides dashboard views and detailed, drill-down capabilities and can export to industry-leading security information and event management (SIEM) tools in Common Event Format (CEF).

TREND Features

TREND lets a single central authority define and deploy policy for networks, and it enforces that policy in real time with operational feedback and an intervention capability.

• Real-time reporting and analysis
• Optional SIEM interface in CEF
• Easy-to-use web interface, enabling access from any authorized computer
• Manage and control network traffic in real time with Specific Network Intrusion Prevention and Exploit Response (SNIPER) network intrusion detection software running on CloudShield devices
• Monitor network status, modifying individual responses and policies as circumstances change

Real-time Benefits

TREND provides real-time sensing of network traffic at line rates up to 10 gigabits per second per link. In addition, TREND implements real-time reaction to sensed content, enabling the network to immediately block, log, or take other measures before potential threats reach their destinations. TREND monitors network traffic, looking for patterns of network information and user data, determines whether it matches triggers defined in deployed policy, and implements the response determined by the policy in real time. Then it notifies the operators at the central TREND management system for their situational awareness, giving them the opportunity to override the individual response or modify the deployed policy.

_{CloudShield is a registered trademark of CloudShield technologies, a wholly owned subsidiary of SAIC, in the U.S. and/or other countries.}