Security Operations – DCS Website

Breach & Attack Simulation

Picus Security Control Validation (SCV) is a BAS solution for the enterprises in Thailand.
Modern enterprises face increasingly sophisticated cyber-attacks. Breach and Attack Simulation (BAS) is now a key capability for security teams that need to continuously validate and improve their security controls, reduce cyber risk, and demonstrate compliance to management and regulators.

Picus SCV, powered by award winning Breach and Attack Simulation (BAS) technology, automatically and continuously tests the effectiveness of your existing security controls across network, endpoint, web and email. By simulating real-world attacker techniques in a safe and controlled way, Picus helps security teams in Thailand measure, monitor, and strengthen their cyber resilience.

Why enterprises in Thailand choose Picus SCV

Extensive Library of Real-World Threats: Continuously updated library of malware, exploits, and attacker techniques based on global and regional threat intelligence relevant to organizations in Thailand.
Actionable Mitigation Recommendations: Detailed, vendor-specific prevention signatures and detection rules to improve the effectiveness of your firewalls, IPS, EDR, Email, Web Security and SIEM.
Customizable Threats and Attack Scenarios: This powerful feature enables security professionals to chain together attack actions and upload custom payloads.
MITRE ATT&CK Mapping: All simulations mapped to MITRE ATT&CK, helping blue teams understand gaps across the full attack lifecycle.
Executive Reports and Dashboards: High-level risk and readiness scores for CISOs and management, plus detailed technical views for SOC and security engineers.
Benchmarking Capability: Compare your security scores with industry peers. Gain insights into the most simulated threats, threat templates, and popular ATT&CK tactics within your region, industry, and Picus community.

“Do you want to see how Breach and Attack Simulation can help organization in Thailand validate security controls and reduce cyber risk?”
Contact DCS team for a consultation or request a Picus SCV demo.

ASRM

Cortex XPANSE
The Cortex Xpanse Security Rating represents the overall hygiene of an organization’s externally facing attack surface and the risk of a breach originating from those assets, enabling organizations to proactively manage their security posture and mitigate risks in the ever-evolving threat landscape.Traditional security rating tools often provide incomplete data and assessments of attack surfaces, leading to difficulties in understanding the real-time security health and asset hygiene of an organization. Additionally, organizations struggle with effectively prioritizing and resolving high-risk incidents that impact their security ratings, which affect their cyber insurance premiums.The Cortex Xpanse Security Rating addresses these challenges by offering a real-time security rating driven by exploiting intelligence for the entire attack surface. This allows organizations to assess their security, health and hygiene, track risk trends over time, and compare their ratings with industry peers. By identifying and prioritizing high-risk incidents, organizations can work toward improving their security rating and overall attack surface protection.

Attack Surface Risk Management
With never-ending technological advancements, enterprises are rapidly expanding, but at a pace that outstrips the traditional controls employed to oversee them. According to ESG1, only 9% of organizations believe they actively monitor their entire attack surface. However, when factoring in dynamic elements such as dispersed teams and organizations, business transformation efforts, hybrid infrastructure environments, supply chain expansion, and even mergers and acquisitions, uncertainty increases.In a recent Ponemon Institute report, 69% of the small to medium-sized businesses queried2 stated that they were seeing an increase in targeted cyberattacks. On top of this, threat actors and deployed cyberattacks are only becoming more sophisticated. Through traditional, siloed attack surface management (ASM) solutions, organizations tend to have a harder time maintaining proper visibility of their attack surface, let alone properly managing it to effectively reduce risk.

Introducing Trend Vision One — Attack Surface Risk Management (ASRM)
ASRM is a next-gen solution that brings enhanced, proactive security to SecOps war rooms all the way up to the executive boardroom. Supported by our industry-leading research, our ASRM empowers security leaders and teams to discover and contextually evaluate overall organizational risk. In addition, it allows you to leverage advanced AI and ML models, which produce remediation recommendations to help you proactively mitigate risks and reduce the attack surface.

Deception Protection

Log Management

SIEM

		ArcSight SIEM Security Open Data Platform ArcSight Security Open Data Platform (SODP) by OpenText offers a future-ready data solution that enriches data in real time and supports open standards for better threat detection. Using security data connectors, SODP collects data and enriches it in real-time to give analysts organized information that can be acted upon instantly. With an intelligent Transformation Hub, built on a foundation of Apache Kafka, ArcSight Security Open Data Platform can ingest and broker data from any source, anywhere, seamlessly.

		SolarWinds SEM Thousands of resource-constrained IT and security pros rely on SolarWinds® Security Event Manager (SEM) for affordable and efficient threat detection, automated incident analysis and response, and compliance reporting for their IT infrastructure. Our SIEM solution combines log management, threat detection, normalization and correlation, forwarding, reporting, file integrity monitoring, user activity monitoring, USB detection and prevention, threat intelligence, and active response in a virtual appliance that’s easy to deploy, manage, and use. We’ve designed our SIEM to provide the functionality you need without the complexity and cost of most other enterprise SIEM solutions. SECURITY EVENT MANAGER AT A GLANCE Easy Collection and Normalization of Network Device and Machine Logs Security Event Manager comes with hundreds of out-of-the-box connectors to simplify the process of collecting, standardizing, and cataloging log and event data generated across your network. Our industry leading log compression rate allows more data to be stored with fewer resources required.Customizable Visualizations and Dashboard Quickly identify important or suspicious patterns in machine data with a wide variety of customizable visualizations and a flexible dashboard. Drill into interesting patterns with a click of a button and see the full list of related logs and their details. Powerful and Simple Searching for Forensic Analysis and Troubleshooting Security Event Manager is designed to allow users to quickly find important log data using simple keyword searches in both real-time event data as well as historical data at predefined or custom time periods. Out-of-the-box and user-defined filters also provide fast data refinement. Real-Time, In-Memory Event Correlation By processing and normalizing log data before it’s written to the database, Security Event Manager can deliver true real-time log and event correlation. Predefined and custom correlation rules allow Security Event Manager to automatically alert on possible security breaches and other critical issues. Out-of-the-Box Security and Compliance Reporting Templates Security Event Manager makes it easy to generate and schedule compliance reports quickly using over 300 report templates and a console allowing for customizable reports to meet your organization’s specific needs. Threat Intelligence Feed and Groups Correlation rules are enhanced with a fully integrated, regularly updating threat intelligence feed that automatically identifies and tags malicious activity from known bad IPs. Easily build groups containing values relevant to your environment, such as user and computer names, sensitive file locations, and approved USB devices. These groups can be auto-populated via correlation rules and can help simplify searching and reporting. Built-in Active Response Security Event Manager can do much more than trigger email alerts. SEM is designed to immediately respond to security, operational, and policy-driven events using predefined responses, such as quarantining infected machines, blocking IP addresses, killing processes, and adjusting Active Directory® settings. Enhanced, Real-Time File Integrity Monitoring Embedded File Integrity Monitoring (FIM) is designed to deliver broader compliance support and deeper security intelligence for insider threats, zero-day malware, and other advanced attacks. Leverage enhanced filter capabilities for finer tuning and significantly reduced the noise associated with lower priority file changes, increasing productivity and efficiency. USB Detection and Prevention Security Event Manager can help prevent endpoint data loss and protect sensitive data with real-time notifications when USB devices connect, the ability to automatically block their usage, and built-in reporting to audit USB usage. Log Forwarding and Exporting Security Event Manager forwards raw log data with syslog protocols (RFC 3164 and RFC 524 4) to other applications for further use. Additionally, users can export logs to a CSV file so the data can be shared with other teams and external vendors, uploaded to other tools, or attached to helpdesk tickets.

		Splunk Enterprise Do you want to get more value from your data? Splunk Enterprise collects data from any source, including metrics, logs, clickstreams, sensors, stream network traffic, web servers, custom applications, hypervisors, containers, social media and cloud services. It enables you to search, monitor and analyze that data to discover powerful insights across multiple use cases like security, IT operations, application delivery, industrial data and IoT. Additionally, with the power of machine learning baked in, you can make faster, more informed decisions across the organization.With Splunk Enterprise, everyone from data and security analysts to business users can gain insights to drive operational performance and business results. Whether you’re looking to troubleshoot IT, monitor your security posture and application development, or optimize marketing campaigns, Splunk Enterprise can help get you there.
		Splunk Enterprise Security Splunk Enterprise Security (ES) is a data-centric, modern security information and event management (SIEM) solution that delivers data-driven insights for full-breadth visibility into your security posture so you can protect your business and mitigate risk at scale. With unparalleled search and reporting, advanced analytics, integrated intelligence, and pre- packaged security content, Splunk ES accelerates threat detection and investigation, letting you determine the scope of high-priority threats to your environment so you can quickly act. Splunk ES is built on an open and scalable data platform that allows you to stay agile in the face of evolving threats and business needs.

SOAR

Threat Hunting Service

Threat Intelligence Service

Vulnerability Management

		Rapid7 InsightVM InsightVM lets you stay one step ahead of bad actors by providing clarity into where risk is present across your ecosystem, and visibility into the cross-functional operations needed to prioritize and remediate those vulnerabilities.With this deep and accurate understanding of your risk, you can better inform and align technical teams from prioritization through remediation, and track and see shared progress.
		Rapid7 Nexpose Vulnerabilities pop up every day. You need constant intelligence to discover them, locate them, prioritize them for your business, and confirm your exposure has been reduced. Nexpose, Rapid7’s on-premises option for vulnerability management software, monitors exposures in real-time and adapts to new threats with fresh data, ensuring you can always act at the moment of impact.

		Tenable Nessus Scarce resources, limited time, a constantly changing attack surface – it’s a challenge for security practitioners on the front lines to keep pace with attackers. You need a fast, easy way to proactively find and fix vulnerabilities.Nessus® Professional automates point-in-time assessments to help quickly identify and fix vulnerabilities, including software flaws, missing patches, malware, and misconfigurations, across a variety of operating systems, devices, and applications.
		Tenable Vulnerability Management: Discover, Assess and Prioritize Vulnerabilities Tenable Vulnerability Management is available as part of the Tenable One Exposure Management Platform or as a stand-alone product. Tenable Vulnerability Management gives you a risk-based view of your entire attack surface- from IT to cloud to OT and containers- so you can quickly identify, investigate, and prioritize vulnerabilities. You get immediate visibility so you can understand your risk and know which vulnerabilities to fix first.Powered by Nessus technology and managed in the cloud, Tenable Vulnerability Management provides the industry’s most comprehensive vulnerability coverage with the ability to predict which security issues to remediate first. Using an advanced asset identification algorithm, Tenable Vulnerability Management provides the most accurate information about dynamic assets and vulnerabilities in ever-changing environments. As a cloud-delivered solution, its intuitive dashboard visualizations, comprehensive risk-based prioritization, and seamless integration with third-party solutions help security teams maximize efficiency and scale for greater productivity.
		Tenable Security Center : See Everything. Predict What Matters. Managed On-Prem. With Tenable Security Center Plus. Changing IT landscapes and evolving cyber threats have made periodic scanning and compliance audits ineffective in protecting against modern cyberattacks. To keep your organization safe, you need a vulnerability management solution that gives you complete visibility into your attack surface so you can effectively manage and measure your cyber risk.Built on leading Nessus technology, Tenable Security Center Plus is a market leading vulnerability management platform that delivers the next generation of vulnerability management, on prem. Through advanced analytics, customizable dashboards, reports and workflows, Tenable Security Center Plus helps you master vulnerability management and reduce organizational risk.Leverage Predictive Prioritization combines data and threat intelligence across multiple sources to anticipate the probability of a vulnerability being exploited, paired with the criticality of your dynamic assets in an ever-changing environment. The result? – a lens to help view and prioritize vulnerabilities tied with their most critical assets giving you actionable insight for protecting your organization against a business impacting breach.Tenable Security Center Plus includes over 350 pre-built, highly customizable dashboards and reports to give you immediate insight into your security compliance, effectiveness and risk. You can continuously measure, analyze and visualize the effectiveness of your security program, based on high-level business objectives and underlying customizable policies that executives care about.

XDR (Exteded Detection and Response)

		Cisco XDR Cisco XDR changes the way security teams look at detection and response. Our cloud-based solution is designed to simplify security operations and empower security teams to detect, prioritize, and respond to the most sophisticated threats. Integrating with the broader Cisco security portfolio and select third-party offerings, Cisco XDR is one of the most comprehensive and flexible solutions on the market today.Designed by security practitioners for security practitioners, Cisco XDR helps analysts aggregate and correlate data from multiple sources into a unified view to streamline investigations, reduce false positives, prioritize alerts, and achieve the shortest path from detection to response.Built-in automation, orchestration, and guided remediation recommendations help analysts automate repetitive tasks and mitigate threats more effectively, freeing up time and resources to focus on other critical security tasks.The data-driven Cisco XDR approach allows SOC teams to define the most impactful events and focus remediation strategies there first, strengthening the organization’s overall security posture and increasing resilience.Benefits of Cisco XDR Unify visibility regardless of vendor or vector to avoid blind spots Gain visibility and identify threats across network, cloud, endpoint, email, and applications for effective security across multi-vendor, multi-vector environment. By correlating data from multiple disparate detection technologies into a unified view, Cisco XDR enables faster, more simplified investigations to streamline responses. Accelerate threat detection and response to act on what truly matters Correlate detections across multiple telemetry sources to prioritize threats by greatest risk. By leveraging AI and machine learning, Cisco XDR enables high-fidelity correlated detection, reduces clutter, and effectively aligns security risk with business risk. Automate responses with evidence backed recommendations to minimize impact. Remediate threats confidently using automation and guided response recommendations across all relevant control points. By compressing investigation time and accelerating responses, Cisco XDR levels-up SOC teams to build resilience. Deliver comprehensive threat detection and response actions with data-backed insights Detect complex threats sooner Cisco XDR offers the broadest range of built-in integrations across endpoint, email, network, cloud, firewall and more, as well as select third-party integrations for the most flexible, scalable and effective XDR strategy. Leverage telemetry from on-prem networks and public and private clouds to detect threats on managed and unmanaged devices and gain critical context when correlating events, including where attacks start and how they spread through the network. Talos threat intelligence strengthens detection capabilities, so analysts gain an unrivaled collection of actionable information to expose known and emerging threats with deeper context and awareness of real-world threat behavior. Prioritize threats by impact and act on what matters most, faster Risk-based prioritization helps SOC analysts focus on the alerts that pose the greatest threat, allowing them to take rapid and effective action. This unique approach provides a unified view of alerts, prioritized by real-world severity. Reduce the Mean Time to Respond (MTTR) with guided responses for identification, containment, eradication and recovery. That, combined with embedded response actions enable consistent, effective decision-making. Simplify and compress investigation times with unified context and progressive disclosure techniques. Cisco XDR shows analysts the information they need without inundating them with extraneous data leading to analysis paralysis. If needed, more information to enrich investigations is always just a click away Accelerate response times. Rapidly remediate threats with built-in response actions and orchestration. With Cisco XDR, SOC teams can leverage a range of pre-built and customizable orchestration workbooks to help shut down threats and mitigate risk with just a few clicks. Boost limited resources for maximum value by automating repetitive and time-consuming tasks and providing SOC teams with out-of-the-box best practices. When automation is not suitable, Cisco XDR provides guided response suggestions and recommendations to help SOC analysts take effective response actions. Quickly push response actions across a broad range of security tools through deep integrations with varying security control points, both built-in Cisco solutions and third-party. Take a proactive role in threat hunting by surveying across disparate alert logs as you learn of new tactics, techniques and indicators of compromise.

		Cortex XDR : Prevent, Detect, and Respond to the Stealthiest Threats You can now stop modern attacks with Cortex XDR – the industry’s first endpoint-based extended detection and response platform that integrates data from any source. Your SOC team can cut through the noise and focus on what matters most with intelligent alert grouping and incident scoring. Cross-data insights accelerate investigations so that you can streamline incident response and recovery. Finally, by harnessing the power of AI, analytics, and rich data, XDR allows you to detect stealthy threats. Cortex XDR delivers peace of mind with industry-leading endpoint security that achieved the highest combined protection and detection scores in the 2022 MITRE ATT&CK Evaluations. The Cortex XDR platform collects and analyzes all data, so you can gain complete visibility and holistic protection to secure what’s next. Block Attacks with Best-in-Class Endpoint Detection and Response The Cortex XDR agent offers unparalleled protection for exploits, malware, ransomware, and fileless attacks. It includes the broadest set of exploit protection modules available to block malware infections. It enables sharp detection with AI-powered analytics and threat insights. Finally, it allows you to remediate quickly and take control of affected machines.

		S1 Singularity XDR
		The cybersecurity threat landscape is evolving exponentially in both speed and scope. Meanwhile, most security teams struggle to keep pace with emerging threats with the resources they have at hand. These organizations often lack global visibility and context across their technology stacks, creating gaps in what they can see and detect. Simultaneously, analysts juggle point tools for each vector, forcing them to analyze data in isolation and manually investigate. Today’s security teams need a more proactive solution to identify, contain, and remediate emerging threats. SentinelOne Singularity XDR unifies and extends detection and response capabilities across multiple security layers, including endpoint, cloud, identity, network, and mobile, providing security teams with centralized end-to-end enterprise visibility, powerful analytics, and auto- mated response across a large cross-section of the technology stack.

		Vision One Trend Vision One delivers the broadest native XDR sensor coverage in the cybersecurity market. The platform’s native- first, hybrid approach to XDR and ASM benefits your security teams by delivering richer activity telemetry—not just detection data—across security layers with full context and understanding. This results in earlier, more precise risk and threat detection and more efficient investigation.

		Managed XDR (MDR) Service : Expert threat detection, investigation, and hunting Organizations are increasingly facing stealthy targeted attacks, designed to bypass existing security defenses. These attacks can monetize stolen intellectual property, encrypt essential data for ransom, or damage the flow of information in the case of nation state attacks. Advanced threat detection tools, such as extended detection and response (XDR), are effective methods for identifying and responding to attacker behavior. However, even with the right solution, security teams still struggle with constrained resources. They can gain tremendous value by leveraging a service to augment detection capabilities, add threat expertise/intelligence, and ensure proactive threat hunting and regular sweeping for indicators of compromise (IoC).Trend Micro is the only vendor that can use its native security stack to offer an integrated managed service across email, endpoints, servers, cloud workloads, and networks. Our managed detection and response service, Trend Micro™ Managed XDR, drives unparalleled improvements in security teams’ time-to-detect and time-to-respond, while minimizing the risks and impact of threats.”

		Falcon Overwatch Falcon OverWatch^TM is CrowdStrike’s managed threat hunting service, built on the CrowdStrike Falcon® platform. OverWatch provides deep and continuous human analysis, 24/7, to relentlessly hunt for anomalous or novel attacker tradecraft that is designed to evade standard security technologies.OverWatch is comprised of an elite team of cross-disciplinary specialists who harness the massive power of the CrowdStrike Threat Graph®, enriched with CrowdStrike threat intelligence, to continuously hunt, investigate and advise on sophisticated threat activity in customer environments. Armed with cloud-scale telemetry and detailed tradecraft on more than 130 adversary groups, OverWatch provides unparalleled ability to see and stop the most advanced threats.

		WatchTower As the global threat landscape evolves in complexity and scope, cybersecurity teams protect dynamic and dispersed attack surfaces from threat actors with changing motivations and techniques.SentinelOne WatchTower offers security teams the expertise and proactive protection they need, by detecting anomalous and hands-on-keyboard threat activity with behavioral threat hunting, machine learning models backed by global SentinelOne telemetry, and best-in-class threat intelligence.Overextended security teams can also dive deeper with WatchTower Pro to uncover and remediate hidden threats and security risks unique to your environment to offer you peace-of-mind with in-depth compromise assessments that enhance your team’s agility and mitigate their risks with attack surface mapping, dark web exposure reviews, and externally facing vulnerability risk reviews.