Core Product Offerings

1. The Bricata NDR Platform

The flagship offering is a comprehensive Network Detection and Response platform that combines three distinct detection methodologies to minimize false negatives and provide context to security alerts:

• Signature-Based Detection: Utilizing an optimized Suricata engine, the platform identifies known threats, malware communication patterns, and exploit attempts using a vast library of regularly updated threat signatures.
• Protocol Analysis and Metadata: Integrating the Zeek (formerly Bro) engine, Bricata extracts rich metadata from network traffic. This allows analysts to see exactly what happened during a connection, including file transfers, DNS queries, and HTTP headers, without needing to store massive amounts of raw packet data.
• Behavioral and Anomalous Detection: Bricata employs proprietary machine learning algorithms to establish a baseline of normal network behavior. It identifies deviations that may indicate zero-day exploits, insider threats, or data exfiltration attempts that do not yet have a known signature.

2. Bricata Sensors

Bricata deploys its technology through a series of high-performance sensors. These sensors can be implemented in several formats to suit diverse infrastructure needs: * Physical Appliances: High-throughput hardware designed for data centers and enterprise core networks, capable of inspecting traffic at speeds up to 100Gbps. * Virtual Appliances: Software-defined sensors that can be deployed in VMware or KVM environments to monitor traffic between virtual machines. * Cloud Sensors: Specialized instances for AWS and Azure environments, providing visibility into public cloud workloads and VPC traffic.

3. Central Management Console (CMC)

The CMC serves as the "brain" of the Bricata ecosystem. It provides a single pane of glass for security teams to manage hundreds of sensors across a global enterprise. Key features of the CMC include: * Unified Alerting: Aggregating alerts from all engines into a prioritized view. * Threat Hunting Interface: A dedicated workspace for analysts to query metadata and pivot between alerts and raw packet captures. * Policy Management: The ability to push global rule updates or specific tuning parameters to sensors based on their location or function.

Key Services and Functional Capabilities

Network Security Monitoring (NSM)

Bricata provides continuous monitoring of all network conversations. Unlike traditional logs, Bricataâ??s NSM capabilities provide a granular look at the content of the traffic, which is essential for identifying sophisticated "living off the land" attacks where hackers use legitimate tools for malicious purposes.

Full Packet Capture (PCAP)

When a high-priority alert is triggered, Bricata can be configured to perform smart packet capture. This provides the "gold standard" of forensic evidence, allowing incident responders to reconstruct exactly what an attacker did. To manage storage costs, Bricata allows for selective PCAP based on specific triggers or timeframes.

Threat Hunting and Forensic Analysis

The platform is built specifically to support proactive threat hunting. Security analysts can use the extracted metadata to search for Indicators of Compromise (IoCs) across the entire network history. This retrospective analysis is vital when a new vulnerability (like Log4j) is discovered, as it allows organizations to see if they were targeted before the vulnerability was publicly known.

Automated Response and Integration

Bricata integrates with broader security ecosystems via a robust API. It commonly feeds enriched data into Security Information and Event Management (SIEM) platforms like Splunk or IBM QRadar. Additionally, it can trigger automated actions in Security Orchestration, Automation, and Response (SOAR) tools, such as automatically shunting a malicious IP address at the firewall level upon detection.

Market Position and Target Use Cases

Bricata primarily serves mid-to-large enterprises, government agencies, and critical infrastructure providers. Its primary use cases include: * Detection of Lateral Movement: Finding attackers who have breached one workstation and are attempting to move to a database or domain controller. * Internal Compliance: Ensuring that sensitive data is not moving into unauthorized segments of the network (e.g., PCI-DSS or HIPAA compliance). * Hybrid Cloud Visibility: Providing a consistent security posture across on-premises data centers and cloud environments. * Reducing Alert Fatigue: By correlating multi-engine detections, Bricata reduces the noise generated by standalone tools, allowing analysts to focus on high-confidence threats.

Through its integration into OpenText, Bricata continues to be a cornerstone for organizations requiring high-fidelity network forensics and automated threat detection capabilities.