This document discusses how graph intelligence and graph analytics can help with cybersecurity investigations. It argues that defenders currently think in lists while attackers think in graphs, putting defenders at a disadvantage. Using graph databases and visualization tools like Linkurious Enterprise allows security teams to analyze data across systems, identify complex attack patterns, and speed up investigations. The document provides examples of how graph analysis has helped organizations reduce fraud and detect phishing attacks. It presents Linkurious as a solution to help organizations shift from siloed data approaches to using graphs to gain critical context and a more comprehensive view of security risks and attacks.

1. SAS founded in 2013 in Paris | https://linkurio.us | @linkurious
Graph Intelligence: the
Essentials for
Cybersecurity.

2. In cyber-security,
context is critical.
Internal
endpoint
External
server

3. In cyber-security,
context is critical.
Internal
endpoint
APT group
C2 server

4. Defenders think in
lists. Attackers think
in graphs.
Source:
https://github.com/JohnLaTwC/Shared/blob/master/Defenders%20think%20in%20lists.%2
0Attackers%20think%20in%20graphs.%20As%20long%20as%20this%20is%20true%2C%20
attackers%20win.md

5. Defenders think in
lists. Attackers
think in graphs.
Source: https://github.com/BloodHoundAD/BloodHound

6. Concrete use cases.
Attack paths
(read team).
Incident
response.
Digital
forensics.
Cyber Threat
Intelligence.
Threat
detection.

7. Graph analytics adds
context to your
investigations, no
matter how big or
complex your data
is.
Faster investigations
Cyber security analysts can navigate
everything associated with a threat to act
with confidence.
Improved detection of attack patterns
New complex patterns can be added to
your arsenal of threat detection rules.
Enhance coverage of risks.

8. Linkurious Enterprise
helps detect and
investigate cyber
threats.

9. Investigations 5X
faster and 20%
more real fraud
cases at BforBank:
case study

10. A siloed data
approach.
Retail
clients
Corporate
clients
Website
Third party
data

11. A siloed data
approach.
Retail
clients
Corporate
clients
Website
Third party
data

12. Example: analysing a
phishing attack.
Source: https://www.cloudflare.com/learning/access-management/phishing-attack/

13. Example: analysing a
phishing attack.
Who is involved in investigating and
stopping phishing attacks?
Cyber-analyst Fraud analyst

14. How silos turn into
cyber-security
blindspots.
Ineffective identification of suspicious
behaviors
With analytics focused on silo-specific
information, the opportunity to detect
anomalies is reduced.
Harder to identify the spread of an
attack
Shifting from one data domain to another
within an investigation is complex. It limits
the ability to map the full extent of
accomplices and security issues.
Wasted resources
The time of investigators is wasted on
internal communications or ad-hoc data
wrangling.

15. A paradigm shift:
from tables to
graph.
Data
preparation.
Graph
database.
Linkurious
Enterprise.
Stop cyber
attacks.
Your team identifies
the relevant data
sources for your
project.
A graph expert
imports your data in a
graph database, it’s a
matter of days for
structured data.
Your analysts work
with a graph expert
to customize the look
and feel of Linkurious
Enterprise and setup
alerts and query
templates based on
your requirements.
Your analysts
connect to Linkurious
Enterprise or access it
via an existing app to
detect and investigate
cyber attacks.

16. Conducting a
cyber-security
investigation with
Linkurious Enterprise:
demo.

17. Linkurious helps
80+ organizations
worldwide detect
and investigate
threats.

18. Questions?
www.linkurio.us
contact@linkurio.us