Cisco Cognitive Threat Analytics vs Splunk User Behavior Analytics comparison

Cognitive Threat Analytics (CTA) enhances web security with breach detection and analytics to stop threats in the network. Online threats have become increasingly sophisticated, targeted attacks are on the rise, and cybercriminals launch their campaigns through a variety of vectors. They can serve up malvertising and deploy exploit kits that install rootkits. They can establish a botnet presence within your infrastructure. Once cybercriminals establish a foothold, more than 90 percent of their threats use the web. There, they can establish channels for command-and-control communications and exfiltrate sensitive information. Analyzing more than 10 billion web requests daily, Cisco Cognitive Threat Analytics finds malicious activity that has bypassed security controls, or entered through unmonitored channels (including removable media), and is operating inside an organization’s environment. Cognitive Threat Analytics is a cloud-based product that uses machine learning and statistical modeling of networks. It creates a baseline of the traffic in your network and identifies anomalies. It analyzes user and device behavior, and web traffic, to discover command-and-control communications, data exfiltration, and potentially unwanted applications operating in your infrastructure.

Splunk User Behavior Analytics is a behavior-based threat detection is based on machine learning methodologies that require no signatures or human analysis, enabling multi-entity behavior profiling and peer group analytics for users, devices, service accounts and applications. It detects insider threats and external attacks using out-of-the-box purpose-built that helps organizations find known, unknown and hidden threats, but extensible unsupervised machine learning (ML) algorithms, provides context around the threat via ML driven anomaly correlation and visual mapping of stitched anomalies over various phases of the attack lifecycle (Kill-Chain View). It uses a data science driven approach that produces actionable results with risk ratings and supporting evidence that increases SOC efficiency and supports bi-directional integration with Splunk Enterprise for data ingestion and correlation and with Splunk Enterprise Security for incident scoping, workflow management and automated response. The result is automated, accurate threat and anomaly detection.