Immediate Insight

Real-Time IT Data Analysis

WHY IMMEDIATE INSIGHT?

Quickly identify issues impacting security and performance through multi-source data analysis.

IMMEDIATE INSIGHT:

• Tells you things you didn’t know about your data
• Is real time – view and search live data
• Is easy to use – natural-language searches, point and click
• Automatically enriches data to highlight non-obvious associations
• Greatly simplifies data acquisition – no parsing required

FEATURES:

• Real-time data discovery and analysis
• Data association, clustering and comparison anaytics
• Internal reputation engine
• Data tags for added custom context
• Pinboard of saved searches

The answers to many of today’s security and operational incidents are buried in your data. However, gathering and analyzing data across devices, systems and applications on an enterprise network is a time-consuming, costly undertaking - especially for short-staffed IT teams. Without a good understanding of this data, network threats and service issues can go undetected and unresolved.

 

FireMon Immediate Insight collects and correlates all IT data to help analysts and operations staff increase visibility into the data and reduce the time and effort spent on incident triage.

WHAT IS IMMEDIATE INSIGHT?

Immediate Insight brings Google-like simplicity and speed to data analysis and discovery. It merges machine learning, correlation and natural language in a simple, workflow-centric interface to reveal relationships in the data that users didn’t even know to look for. It transforms organizations from a ‘data as last resort’ mindset to the ‘data first’ practice necessary to enhance security, performance and operations.

Immediate Insight’s real-time analysis across data silos provides the timely and detailed operational visibility necessary to:

• Identify and investigate the suspicious.
• Search for indicators of breach and operational inefficiencies.
• Get real-time analysis of security data.
• Accelerate incident resolution and reduce escalations.
• Automatically connect and correlate data silos.
• Stage data for analysis by escalation teams.

SOLUTION OVERVIEW

GETTING THE DATA

Immediate Insight brings ease and flexibility to the data collection process so analysts can shift from gathering and preparing data for analysis to finding and solving issues.

• Automatically receive streams of structured and unstructured data.
• Import data on demand through drag and drop interface.
• Eliminate the need for parsing with natural-language technologies.

ANALYZING THE DATA

Out-of-the-box analytics and correlations automatically enrich and optimize data for real-time analysis, so users can see anomalies and non-obvious associations across large datasets and directly navigate huge volumes of data. Key features include:

• Summary view of common entities (i.e. users, applications, networks, etc.)
• Automatic groupings of similar data
• Trending arbitrary groups of data over time (new, missing, up/down)
• Local, learned context and reputation automatically applied as metadata

Find anomalies and non-obvious associations within the data in real time.

EXPLORING THE DATA

Targeted searches help users discover situations of interest, add context and take action when responding to security incidents, hunting for unusual activity or discovering opportunities to improve security and business processes – all without learning a query language. There are five default views into the search results: detailed events, entity associations, event clusters, comparisons and notes, tags, alerts.

Users can save searches to a PinBoard. For each pinned search:

• See volume and trends.
• Filter views by any criteria.
• Click through to see detailed data
• Natural-language access to powerful data analytics.

For each search, see volume and trends, filter views by any criteria and click through for more detailed data.

COLLABORATING IN THE DATA

The collaborative functions and workflow within the Immediate Insight solution eliminate the need to go to another system to share insights with others – creating a virtual tiger team without the costly physical formation. Key features include:

• Add custom context (tag)
• Follow users, social style – learn and contribute

Tag data, follow the user, share searches and more with the collaborative tools found in the software.

AUTOMATING ANALYSIS

The Workflow System and Data Router automate multi-step security or IT process analysis and create sophisticated action policies for each step in the process. Workflows are configured with a drag-and-drop interface, plain English events are written for each step and the Data Router acts on those events in real time. Steps of the workflow are recorded so they can be used for process improvement.