FireEye Releases General Network Threat Prevention Platform with IPS

FireEye said its network threat prevention platform with Intrusion prevention systems (IPS) will be available to customers worldwide starting June 2, 2014.

The product is available as an add-on license to the FireEye Network Threat Prevention Platform (NX series) appliances, giving customers a holistic view of multi-vector attacks that goes well beyond what conventional intrusion prevention system (IPS) tools offer.

The Network Threat Prevention Platform with IPS uses FireEye’s patented Multi-Vector Virtual Execution (MVX) engine technology to better protect systems from known and unknown threats while reining in false-positives.

With this new addition, security teams now get compliance and true security in a single box.

Network Threat Prevention Platform with IPS has been in beta for the past several months, including with Federica Mogherini, Italian Ministry of Foreign Affairs, who had this to say about the new platform add-on:

“We have chosen the FireEye Network Threat Prevention Platform with IPS because it is a solution that allows us to combine advanced threat protection with compliance-driven security needs. We will be able to provide our security team greater visibility into network threats and more effective data to act on by significantly reducing false-positives and -negatives.”

FireEye said it also heard two interesting anecdotes from other beta customers illustrating how the combination of the FireEye MVX engine with IPS greatly reduces the overhead on security:

A large university experienced 732 events per day which we were able to validate and confirm down to 32 being true positives.

One large health care provider experienced 1,400 events per day that we then pared down to just 40 as being true positives.

How does Network Threat Prevention Platform with IPS work? When network traffic triggers a signature-based alert, the MVX engine evaluates the traffic in a “real world” environment to confirm whether the threat is real, greatly improving the signal-to-noise ratio.

In addition to passing a true alert directly to the alert management system, as traditional IPS does, the MVX engine inspects the corresponding network traffic within instrumented, virtual-machine environments.

The MVX engine evaluates activity across the multiple avenues used in advanced attacks.

That analysis is integrated with host-based detection and other components of the broader FireEye platform, according to entry posted in FireEye’s Business of Security, Security Perspective, Technology and tagged advanced threat detection, compliance, FireEye by Srinivas Loke.