01
Identify suspicious runtime activity
Runtime Security uses eBPF host observation to review execution, file and network activity in an intrusion detection (IDS) and host-based detection (HIDS) context.
WERANA / Services
Real-time threat detection
Understand what was detectedand the evidence behind it.
Review execution and network activity collected with eBPF, together with affected assets and the rules or indicators behind a detection.
Review workflow
See suspicious activity and why it was detected.
Review execution, traffic, and privilege changes in context to identify signals worth investigating.
- 01Execution & traffic
- 02Rules & indicators
- 03Detection evidence
02
Connect timing and affected assets
Review the occurrence time and affected assets alongside MITRE ATT&CK tactics, techniques, indicators (IOC) and detection evidence.
03
Operate detection for your environment
Review event Correlation, File Integrity Monitoring (FIM) and configuration-change detection against enabled rules and their required collection sources.
Environment & coverage
What can you review in your environment?
Review the applicable scope based on your assets, collection permissions, and existing security operations.
Security categories to compareIDS · HIDS · NIDS · IPS · HIPS · EDR · NDR · CWPP
Real-time threat detection
Coverage depends on supported operating systems, kernels, collection capabilities, and enabled rules.
What to discuss
- Supported operating systems, kernels, and eBPF collection
- Enabled rules, indicators, and targets
- Execution and traffic collection and retention
FAQ
Frequently asked questions
Is every collected event a threat detection?
Detection results identify collected activity matching enabled rules or indicators.
How do IDS, HIDS and NIDS differ from IPS and HIPS?
IDS detects signs of intrusion; HIDS focuses on host activity, while NIDS focuses on network traffic. IPS and HIPS also concern how attacks are prevented or blocked. This service describes eBPF host observation and detection using enabled rules and indicators. Executing a response command must be assessed separately from a network IPS blocking attacks in the traffic path.
What should we compare when evaluating EDR, NDR and CWPP?
EDR concerns endpoint detection and response; NDR concerns network detection and response; and CWPP concerns cloud workload protection. Compare supported operating systems and kernels, process, file and traffic collection, rules and response actions. A detection capability in one area does not establish the complete scope of each product category.
Start with the scope that fits your environment.
Tell us about your environment and security priorities. We will help review supported capabilities and collection requirements.