Sandia's tools for early detection of threats can lead to quick intervention—and minimized damage.
Sandia provides an array of visualization tools:
Sandia’s transactional logging and anomaly detection system allows real-time analysis of abnormal traffic patterns and creates an easily searchable log of all network sessions.
Additional capabilities include:
After observing suspicious traffic, the Adaptive Network Countermeasures (ANC) system injects deceptive packets into the network to confuse attackers.
Sandia offers traffic mapping tools (NetState, transactional logging) to facilitate attribution, and the ANC tool helps determine the “intent” of the attacker.
Sandia also gathers cyber evidence, performs application-specific reverse engineering and session regeneration, and maintains a malicious code testbed to aid forensics.