Starlight’s panoramic view provides high fidelity attack and anomaly visibility of compromised or targeted assets and external bad actors, and correlates data across the cybersecurity kill chain.

Admins can easily trace the attacks that have taken place on an asset and identify which bad actors have contributed to the compromise. Starlight also gives admins the ability to locate where bad actors are coming from. With the single click of a button an admin can drill down to see the details of security events and determine the reason of behind an event.

Starlight is the most open and easy to understand, so use, security analytics platform in the world with huge difference…

Starlight’s Advanced Threat Detection view provides full picture of attacks and anomalies within a selected time period and categorizes them across the cybersecurity kill chain. As an example, an admin can quickly identify how many login failures have occurred on an assets in comparison to how many of them are anomalous login failures (less than 1%) and critical (even less). This is useful because all login failures are not necessarily malicious. In this screen shot here, you will notice over 35 thousands login failures captured but only 29 of them are anomalous and only 2 of them are critical. By combining this hyper-precision and prioritization with open, contextual data, Starlight enables admins to make the right decision at the right time with peace of mind.

Starlight’s defense-in depth design enables admins to catch malware downloads and allows them to see which machines have downloaded known and zero day malware.

From this view admin can quickly identify where the malicious activity is coming from through geo-location awareness, along with visibility into other relevant information like the MD5 hash of a file, its name and reputation. Lateral movement can also be spotted quickly to see the propagation of malware within the environment.

Starlight provides separate views for communications that are anomalies within the environment breaks the views down into relevant detection categories.

It includes a view where admins can find high fidelity firewall alerts thanks to its industry first and only ML-Firewall (TM) component. Stellar Cyber innovated machine learning on firewall data, to get rid of firewall log noise to provide a cleaner view of what is important and needs attention.

Starlight innovated the machine learned IDS feature. ML-IDS is a new design when compared to traditional Intrusion Detection Systems.

By combining best of bread IDS technology with machine learning, Starlight dramatically improves the elimination of IDS noise and false positives.

Starlight provides a built-in case management system to enable workflows and ensure nothing gets lost during an investigation.

Admins can create cases from events, escalate  tickets to others, and close cases when results are determined.  All changes to cases are recorded for audit purposes as well.

Starlight also offers built-in integration with top tier security research partners to escalate a case for outsourced investigation.

Starlight delivers patent pending technology that turns the platform into a firewall controller.  Any piece of information that platform records can be used to trigger a firewall policy.  Administrators simply write a query and instruction the module to take firewall action if the query returns results.  An example of its use could be, an administrator wanting to block all traffic coming from North Korea that has a source IP address reputation of being a Brute-Forcer.

The firewalls that are currently supported are:  Palo Alto Networks, Fortinet, Checkpoint, Cisco, Hillstone, Sophos and AWS.