RiskIQ Passive Total
More Than 80,000 Security Analysts Trust RiskIQ for Their Threat Investigations
Faster, More Complete Threat Investigations
As businesses adapt to the changing digital landscape, more customer and business operations are shifting from being behind the protection of firewalls to being available via the internet. This exposes your company and customers to extremely skilled, malicious, and persistent threats.
The good news for threat hunters in your organization is that data exists to help expose the infrastructure being used by attackers. This allows you to find, block, and prevent attacks.
RiskIQ PassiveTotal™ expedites investigations by connecting internal activity, event, and the incident indicator of compromise (IOC) artefacts to what is happening outside the firewall—external threats, attackers, and their related infrastructure.
PassiveTotal simplifies the event investigation process and provides analysts access to a consolidated platform of data necessary to accurately understand, triage, and address security events.
Terabytes of Internet Data at Your Fingertips
PassiveTotal gives threat hunters access to internet data they need to help understand who their adversary is and what infrastructure they use to conduct their attacks. By bringing together critical data sources in an easy-to-use visual interface, PassiveTotal enables analysts to investigate digital threats and map and analyze adversary infrastructure. Simply search PassiveTotal using an indicator of compromise (IOC) or suspicious artefacts, like a domain, IP address, or email address, and uncover all that RiskIQ has observed about that artefact.
PassiveTotal provides access to:
Passive DNS resolution data
WHOIS registrant and registrar details (current and historical)
SSL certificate information
Web tracker information found on pages — Google Analytics, Clicky, New Relic, and more
Web component information — details about software and frameworks running on web servers
Host pairs — connections between a web page and subsequent requests from that page
Connect What You See Inside with Threats Outside
Your internal security systems are constantly generating alerts based on events and anomalies inside your organization. Often, the alerts are triggered by activity that has origins or is beaconing outside the firewall and needs to be enriched quickly to provide context and triage them for investigation.
PassiveTotal provides your security teams with the tools needed to investigate and connect your internal anomalies or indicators of compromise (IOCs) with threat actors, their tactics, techniques, and procedures (TTPs), and other infrastructure that they’re using. PassiveTotal helps answer questions like:
Who is attacking me?
Where are they coming from?
What else belongs to them?
Intelligently Pivot Across Data Sets
Threat hunting and incident response is difficult. Not only do you need to understand what happened during a potential breach, incident, or exposure, but you need to provide additional context and other potential attack vectors that could also be exploited.
PassiveTotal normalizes, correlates, and links data across data sets, allowing for easy pivoting between them. This reduces the number of dead-ends that you might encounter while performing an investigation. With access to the most comprehensive number of internet data sets available, you no longer need multiple tabs open to search through WHOIS records, IP resolutions, DNS data, SSL certificate data, or other open source intelligence.
For example, if you find a suspicious or malicious domain, you can pivot and find WHOIS registrant details, find that it is registered to guy@bad[.]com, and then pivot off of that email address and instantly find other domains and IPs registered to or associated with guy@bad[.]com.
Collaborate and Share Projects
Don’t reinvent the wheel. PassiveTotal makes it easy for analysts to share information about existing and ongoing investigations and known threat infrastructure using projects.
Projects allow organization of related threat infrastructure elements, like domains, IPs, website trackers, WHOIS registrant information, to make it easier to hand off investigation working files to other analysts or maintain an ongoing workspace for a particular research project. These projects can be shared publicly with the security community, or privately with other analysts in within the organization.
RiskIQ also works closely with the analyst community and publishes curated public projects as starting points for new investigations. These projects include recent threats, many of which appear in the news, giving you a head start in your research.