The document summarizes an integration between Damballa Failsafe and the Blue Coat Security Analytics Platform. It allows organizations to rapidly discover infected devices, analyze threats, and respond quickly. Damballa Failsafe can find hidden infections and prioritize risks, while the Security Analytics Platform provides comprehensive threat intelligence and analysis of network activity to help responders understand attacks. The integration enables information sharing so Failsafe alerts can be investigated further using full packet data from the Security Analytics solution.

1. Security
Empowers
Business
SOLUTION BRIEF
The prevailing security mindset has shifted from preventing infection to assuming compromise. As new advanced
threats continue to circumvent traditional security tools, enterprises are searching for better solutions that
improve visibility and time to respond. Tools that help responders adapt to the evolving threat landscape are in
high demand. Solutions need to rapidly discover, validate, and prioritize assets under a threat actor’s control.
Comprehensive, real-time threat intelligence and advanced forensics are keys to understanding the kill chain of an
attack and improving the overall security posture.
Solution Overview
Damballa Failsafe, a leader in finding hidden infections with certainty,
and the award winning Blue Coat Security Analytics Platform, have
teamed up to provide world class advanced threat discovery and
analytics to enable swift and intelligent incident response.
Together Failsafe and the Security Analytics Platform allow organizations to:
• Discover and Prioritize – Find infections in seconds, minutes, or hours,
not weeks or months. Dynamic risk scoring shows which infections
pose the highest damage potential.
• Analyze and Respond – Comprehensive and conclusive analysis
strengthens security incident response.
Damballa Failsafe is unmatched at finding advanced threats that have
bypassed prevention controls, and in prioritizing their risk.
The Security Analytics Platform extracts and reconstructs all attributes
associated with advanced malware and threats, including source and
destination IPs, as well as every packet, flow, file, and application
detail associated with an attack. The Security Analytics technology
also leverages the Blue Coat Global Intelligence Network – aggregated
threat intelligence from 15,000 customers and 75 million users – and
Blue Coat ThreatBLADES, which provide instant, actionable intelligence
about web, email, or file-based threats. The Security Analytics Platform
provides security professionals clear and concise answers to critical
post-breach security questions, including: Who did this? How? When?
What was accessed? It records and classifies every packet of network
traffic – from Layer 2 through Layer 7 – while indexing and storing the
data to provide comprehensive threat intelligence and post-breach
analytics on any security event.
How it Works
The open, web services REST API in the Security Analytics Platform
enables direct integration to Damballa Failsafe. Failsafe allows first
responders a pivot directly from an infected assets page to full packet-level
detail in the Security Analytics solution. This allows instant visibility
into other relevant activity from infected devices. The Security Analytics
Platform acts like a security camera on the network, to record and index
BLUE COAT TECHNOLOGY PARTNER:
DAMBALLA
Partner: Damballa
Partner Product: Failsafe
Blue Coat Product: Security Analytics Platform
Users Servers Mobile
API
Security Analytics
Appliance
with ThreatBLADES
Global Intelligence
Network
Damballa Failsafe
Tap/Span Tap/Span
1. Damballa Failsafe – Discovers infected devices, suspected devices, and
active C&C domains
2. Damballa Failsafe – Using the Security Analytics API creates lists of
infected assets, suspected assets, and active Command and Control
(C&C) domains
3. Security Analytics – Provides instant visibility into infected assets and
correlated endpoint processes
4. Security Analytics – Enables quick updates to security policies based on
corroborated evidence of an attack

2. Security
Empowers
Business
SOLUTION BRIEF
© 2014 Blue Coat Systems, Inc. All rights reserved. Blue Coat, the Blue Coat logos, ProxySG, PacketShaper, CacheFlow, IntelligenceCenter, CacheEOS, CachePulse, Crossbeam, K9, the K9 logo, DRTR, Mach5, Packetwise, Policycenter, ProxyAV, ProxyClient,
SGOS, WebPulse, Solera Networks, the Solera Networks logos, DeepSee, “See Everything. Know Everything.”, “Security Empowers Business”, and BlueTouch are registered trademarks or trademarks of Blue Coat Systems, Inc. or its affiliates in the U.S. and certain
other countries. This list may not be complete, and the absence of a trademark from this list does not mean it is not a trademark of Blue Coat or that Blue Coat has stopped using the trademark. All other trademarks mentioned in this document owned by third parties
are the property of their respective owners. This document is for informational purposes only. Blue Coat makes no warranties, express, implied, or statutory, as to the information in this document. Blue Coat products, technical services, and any other technical data
referenced in this document are subject to U.S. export control and sanctions laws, regulations and requirements, and may be subject to export or import regulations in other countries. You agree to comply strictly with these laws, regulations and requirements, and
acknowledge that you have the responsibility to obtain any licenses, permits or other approvals that may be required in order to export, re-export, transfer in country or import after delivery to you. v.SB-TECHPARTNER-SAPLATFORM-DAMBALLA-EN-v1a-1214
Blue Coat Systems Inc.
www.bluecoat.com
Corporate Headquarters
Sunnyvale, CA
+1.408.220.2200
EMEA Headquarters
Hampshire, UK
+44.1252.554600
APAC Headquarters
Singapore
+65.6826.7000
full packet captures of all activity – even on today’s fastest networks.
Captured packet data can then be analyzed to provide context that
enables rapid response to Damballa alerts. For example, when Damballa
Failsafe generates an asset alert within the console, alert parameters are
seamlessly passed to the Security Analytics Platform, which responds
with a complete analysis, detailing what occurred before, during and
after the event. The Failsafe user can even recreate actual artifacts
(documents, files, executables, etc.) from stored packet data. By
reconstructing what happened before an infection, the Security Analytics
Platform determines the root cause and provides the intelligence needed
to prevent other assets from falling victim to the same attack.
Using the API, Failsafe also creates “Favorites” in the Security Analytics
Platform management console. Failsafe creates lists of infected assets,
suspected assets, and active Command and Control (C&C) domains.
This enables Incident responders to quickly analyze traffic to and from
compromised assets and then take swift and focused action. Damballa
Failsafe also publishes active C&C domains with successful connections
for immediate response.
The integration between Damballa Failsafe and Blue Coat Security
Analytics is:
• Powerful – Rapidly find hidden infections with certainty
• Fast – Gain instant visibility into suspected/infected assets and
correlated endpoint processes
• Actionable – Quickly update security policies based on corroborated
evidence
EXAMPLE
Damballa Failsafe identifies successful connections to a new C&C
infrastructure. A never-before-seen attack has successfully bypassed
traditional security tools and has infected several devices on the
network.
Failsafe dynamically pushes the newly identified C&C domain to the
Favorites list in the Security Analytics Platform where responders can
quickly search for all assets that have attempted connections to the
active C&C domain and can then remove them from the network.
Key Benefits
Damballa Failsafe and Blue Coat Security Analytics Platform provide
enterprises with clear and concise actionable intelligence for advanced
threats and compromised assets to:
• Rapidly detect, prioritize and remediate infected devices
• Respond to infections and advanced threats in near real-time
• Quickly implement and update security controls, preventing further
compromise
• Gain better visibility of security posture regarding “hidden” and zero-day
threats
About Damballa
As experts in advanced threat protection and containment, Damballa
discovers actual infections that have already bypassed security
prevention layers. Damballa identifies evidence of malicious network
traffic to rapidly pinpoint compromised devices that represent the
highest risk to a business. Our patented solutions leverage Big Data
from the industry’s broadest data set of consumer and enterprise
network traffic, combined with machine learning. This enables us
to automatically discover and terminate criminal activity, stop data
theft, minimize business disruption and reduce time to response.
Damballa protects any device or OS regardless of threat entry point.
Damballa protects approximately half a billion devices globally at
enterprises in every major market and for the world’s largest ISP
and telecommunications providers. For more information, visit
www.damballa.com, or follow us on Twitter @DamballaInc.
For More Information
Learn more about Blue Coat technology partners on our website.