Global Threat Intelligence

Vulnerability Feed provides customers with detailed descriptions and recommendations to address current vulnerabilities. CTU researchers gather and process vulnerability data from numerous public feeds, enriching the data with expert analysis and recommendations. Vulnerabilities are mapped to assets and applications in your environment, and you can easily query the vulnerability database and run reports across vulnerability data relevant to your organization.

Vulnerability Feed features:

• Comprehensive vulnerability analysis with expert recommendations
• Threat level evaluation of each vulnerability
• Mapping of vulnerability data to specific assets and applications
• Delivery via the Customer Portal, XML feed and email

The Threat Feed provides customers with in-depth analyses of emerging threats, including detailed decompositions of Trojan horses, worms, rootkits and other forms of malware. Detailed threat reports investigate the core functions and operations of malware and are published to the Customer Portal, where they are mapped to the profile of your environment and cross-referenced with relevant vulnerability entries.

Threat Feed features:

• In-depth analyses of malware samples representing emerging threats
• Detailed decompositions that illustrate popular attack vectors and techniques
• Cross-referencing of threats with vulnerability data
• Delivery via the SecureWorks Portal, XML feed and email
  

The Advisory Feed includes strategic security reports that focus on significant events and trends across the current threat landscape. Using security data collected from monitoring security activity across thousands of customer networks, CTU researchers regularly publish Advisory Reports that include analysis of aggregate attack data and emerging trends.

Advisory Feed features:

• Detailed analysis of high impact, widespread threats
• Actionable recommendations for protecting assets
• Cross-referencing with applicable threat and vulnerability data
• Delivery via the Customer Portal, XML feed and email
  

The Weekly Intelligence Summary provides a recap of worldwide cyber security issues from new activity and research performed during the previous week, and summarizes the last seven days of threats, vulnerabilities, advisories and CTU TIPS.

Weekly Intelligence Summary features:

• Quickly review CTU Research activity from the previous week
• High-level report helps demonstrate value to management
• Links make it easy to drill into the recent activity
  

Emerging Threat Bulletins give you a window into the analysis of threats currently being investigated by our experts. Emerging Threat Bulletins are based on real-time security information and are designed to keep clients informed of security issues as they are being investigated.

Emerging Threat Bulletin features:

• Insight into current threats as they are investigated by our team
• Real-time information on active tools, tactics and procedures seen in the wild
• Expert commentary and opinion on emerging threats and security issues
• Minimum of five bulletins per week
  

On a monthly basis, CTU researchers host a live Threat Intelligence Briefing that encompasses the current threats, vulnerabilities and advisories. During this session, our researchers review aggregate attack data from across our client base and provide their analysis of the latest news and trends in information security.

Published within 24 hours of regular and out-of-cycle Microsoft patch releases, the Microsoft Update Analysis report provides a thorough examination of the patch content and the vulnerabilities addressed.

The criticality of each vulnerability is reviewed by researchers with expertise in emerging threats and attack techniques. The report provides an assessment of the circumstances that must be present for successful exploitation and anticipated exploit activity is discussed. The CTU team uses this additional context to provide expert recommendations on which patches should be the highest priority for your organization. Microsoft Update Analysis features:

• In-depth analysis of monthly or out-of-cycle Microsoft Updates within twenty-four hours
• Criticality assessments of each vulnerability addressed by the update
• Delivery via the SecureWorks Portal, XML feed and email

Delivered twice per month, this report highlights the previous two weeks of major issues and trends in information security. The report contains stories from public news sources and media outlets, with a focus on security issues affecting major industries. These stories help inform executive leadership of the issues shaping the future of information security and underscore the importance of a strong information security program.

CTU Support provides subscribers with direct access to CTU researchers for information regarding threats, vulnerabilities and advisories. When a request is submitted, a CTU researcher will respond within one business day. Direct access to this team enhances customers’ internal security capabilities by providing expert guidance and consultation as needed.

Dell SecureWorks’ technology and security experts correlate and analyze attack data from tens of thousands of monitored security devices and critical information assets worldwide, processing more than 38 billion events every day. From this visibility, as well as numerous public and private sources, Dell SecureWorks’ Attacker Database contains IP addresses and domain names of servers hosting exploits and malware, botnet Command and Control (C&C) servers, and other known malicious activity. XML feeds are updated daily, giving valuable context to your security team.

To determine the purpose and methods used by specific malware, customers may obtain Custom Malware Analysis services from our experts. Upon receiving a sample of the malware in question, a CTU researcher will analyze the malware using proprietary and public toolsets. Within one business day, they will provide a customized report detailing the composition of the malware and addressing additional customer information needs.