The application of artificial intelligence (AI) technology is changing the way security is managed in many important ways. For example, machine learning algorithms powering Secureworks Taegis XDR security analytics software to help detect both known and unknown threats.

The Taegis XDR product is designed to:

• Detect active threats in real-time
• Gain more trust in alerts
• Streamline collaboration on investigations
• Automate the proper response actions

However, AI can create additional unnecessary work if it is applied inexactly or applied in an inappropriate domain area. Secureworks takes a highly selective approach to the deployment of AI applications including real-time supervision of all machine learning algorithms to ensure accuracy. XDR automatically analyzes and correlates telemetry from endpoint devices, network traffic, and many other supporting cloud devices used in modern application environments. The product's integrated detectors use machine learning algorithms to constantly search data and systems to identify malicious activity and even subtle behavioral clues present in your environment. The result is that many routine changes in the application stack or program operations will not generate alter noise and reduce your threat visibility.

The XDR product has extensive integrations with products, endpoints, APIs, and more. Each integration pushes data to the XDR cloud dashboard that analyzes the information and displays results. For a more comprehensive overview, see the online documentation Secureworks Taegis XDR - At a Glance.

The XDR product is an Amazon Web Services (AWS) hosted offering accessible from any data center or edge location. The XDR platform supports multiple endpoint technologies and collectors to aggregate the information needed to make reliable and timely alerting decisions. We validated the implementation and features of two options for communication with AWS for this Design Guide:

• Secureworks Collector
• Red Cloak Endpoint Agents

The agents and collectors that are deployed in a customer's infrastructure must be able to send data to the Secureworks managed AWS service for analysis. This may require specific ports to be opened in the remote site's firewall to allow access to AWS. The Secureworks Red Cloak agents used in this validation are proxy-aware enabling traffic to be routed to AWS using a proxy server. This approach simplified our deployment and avoided having to open additional ports for each VM that had the Red Cloak agent installed.

The Secureworks Collector is an appliance with software that collects and aggregates security information from many sources in a data center. The Collector can be used to aggregate data from multiple virtual machines, servers, and other equipment hosted at a site and then forward that data to the Secureworks XDR service in AWS. The information gathered and forwarded by the Collector is sent in a secure channel to the XDR service for processing and display on the AWS-hosted service dashboard.

The benefit of this architecture is that only a single firewall port is required to be open for the Collector to communicate with the XDR service in AWS. Due to the security requirements of most environments, it is not feasible to configure access from every monitored device directly to AWS. The Secureworks collector addresses this problem for systems that run in a secured environment like the engineering lab used for this validation.

The increasing use of endpoint attacks by hackers trying to enter companies' infrastructures requires that security professionals focus specifically on detecting and shutting down those activities immediately. The Red Cloak solution is especially critical for catching attacks that do not use malware. Once inside a network, attackers often evade traditional endpoint security controls by leveraging compromised credentials and tools native to the target's environment, such as remote access services, endpoint management platforms, and other legitimate system tools.

To give organizations the earliest possible warning of compromise, the Red Cloak agent searches for forensic evidence of malicious activity while continuously collecting information about what is happening on the device, such as what programs are running, what commands are being performed, network connections, thread injection, memory inspection and more. The Red Cloak agent supports a large set of device monitoring options including both Windows and Linux operating systems. The agent can be installed on both virtual machines and servers that require enhanced monitoring.

The Red Cloak Endpoint Agent collects a wide variety of endpoint telemetry used for analysis to identify threats and their associated behavior signatures. The following is a partial list of the types of information gathered by the Red Cloak agent that is continuously captured and sent back to the Secureworks XDR service for analysis:

Because the solution can blend these multiple views of dynamic system activity beyond the obvious indicators such as IP addresses and domain names, it is constantly adapting to uncover the behaviors and techniques of cyber adversaries.