The document discusses advanced threat detection through integration with malware analytics services and appliances using sandbox technology. It also discusses automating the investigation and monitoring of indicators of compromise from industry peers, community sources, and commercial threat intelligence services on high-risk assets. The diagram shows the process of detecting threats from new indicators, searching for previous existence, starting monitoring, and driving workflows to investigate and remediate impacted systems.

7. Advanced Malware Identification – Identify advanced threats on high risk assets through
integration to malware analytics services and appliances using sandbox technology
Monitoring for Peer & Community Sourced IoCs – Automate the forensics investigation
and proactive monitoring on high risk assets of indicators of compromise sourced from
industry peers and community sources
Monitoring for Commercial Threat Intelligence Service IoCs – Automate the forensics
investigation and proactive monitoring on high risk assets of indicators of compromise
sourced from tailored commercial threat intelligence services

8. !
THREAT
DETECTED!
3
NEW INDICATORS
1
Search forensics data for
previous existence of indicator.
Start monitoring for indicator in
all new changes.
2
Drive workflow to investigate
and remediate system.
4

9. !
THREAT
DETECTED!
4
Indicators
Feed
2
Search forensics data for
previous existence of indicator.
Start monitoring for indicator in
all new changes.
3
Drive workflow to investigate
and remediate system.
5

10. Next Generation
Threat Prevention
Tripwire
Enterprise
AgentNEW BINARY
FOUND
1
SEND FILE/HASH
FOR ANALYSIS
2
!
THREAT
DETECTED!
3
NEW
ADVANCED
THREAT
DETECTED
4
Drive workflow to investigate
and remediate system.
5
UPDATE THREAT
PREVENTION RULES
6
Real-time blocking of command
& control, exfiltration, and
further infections.
7

16. tripwire.com | @TripwireInc