ThreatQuotient launches ThreatQ v5

ThreatQuotient has introduced v5 of the ThreatQ platform, launching capabilities needed today to support the security operations center (SOC) of the future, where data is the foundation. ThreatQ’s newest features include a unique DataLinq Engine for connecting disparate systems and sources to enable extended detection and response (XDR), Smart Collections for driving automation, and an enhanced ThreatQ Data Exchange for bi-directional sharing of data, context and threat intelligence.

The typical SOC team has access to dozens of technologies, feeds and third-party data sources. ThreatQ connects the dots, bringing this wealth of data together into a common work surface, providing data-driven security context that enables teams to be more thorough in their investigations, collaboration, response and reporting. The result is more efficient and effective operations that can be directly measured by time savings and FTEs gained, improved risk management, and greater confidence when detecting and responding to an event.

“First generation SOAR, TIP and XDR technologies have helped SOCs wage their battle against evolving attacks, but not without limitations; it’s time for security solutions to evolve as well. ThreatQuotient believes the foundation for the SOC of the future is data, which is why we doubled down on our DataLinq Engine in v5 of the ThreatQ platform,” said Leon Ward, VP of Product Management, ThreatQuotient. “Enabled by Smart Collections, organisations have a strong foundation today to get more out of their data. We look forward to releasing more market leading innovations in 2022, because all data is security data and needs to be incorporated effectively into the security lifecycle.”

The SOC of the future uses a data-driven approach to improve efficiency, has an open architecture to ingest any data sources free of limitations, and enables balanced automation for teams to translate data-driven context to drive response, either natively using machine automation or with tooling for human analysts. Key updates available in ThreatQ v5 that support the SOC of the future include:

•         DataLinq Engine that “connects the dots” across data from all sources, internal and external, in an organisation, including SEIM/SOAR, identity, feeds, cloud, ticketing, etc. so it can be analysed and understood prior to taking a manual or automated response. Actions can be taken through integrations with the tools security teams already use.

•         ThreatQ Data Exchange provides improved flexibility and control over data shared between ThreatQ systems. Teams with separate instances of ThreatQ can collaborate by sharing IOCs, adversary, TTPs, etc. with one another. This increased data exchange provides more context for teams to do their jobs.

•         Smart Collections provide improved analysis speeds by automatically and dynamically categorising data. This is done through a process in which teams define key criteria in advance that automate how intelligence culled through data is enriched, curated, prioritised and expired.

“Data equals context in security, and the fact that the data is often so widely spread throughout the typical organisation means integrations are critical to detection and response,” said Jason Passwaters, COO, Intel 471. “ThreatQuotient's open integration architecture makes bi-directional sharing easy between ThreatQ their DataLinq Engine and the Intel 471 TITAN Platform, which ultimately empowers our joint customers to make data-driven decisions and take the best course of action in response.”

“Data is critical to security because it gives the context needed to focus on relevant, high-priority issues. Ultimately, this focus empowers teams to work faster and more thoroughly when defending against evolving attacks,” said Michel Cazenave, President at Cyber Intelligence X sectors Alliance (CIX-A) and Regional CISO and CSO of PwC France. “ThreatQuotient's data-driven approach to security operations is perfectly aligned with the way top performing teams work and capabilities like the DataLinq Engine, Threat Library and Data Exchange help them to work more efficiently and better manage risk.”