Security Breach Investigation with Packet Capture

When a breach occurs, there is a race against time to try and reconstruct how the attacker got in, and what they managed to compromise.

The window to do this is becoming vanishingly small, with breach notification regulations often requiring breaches to be notified to authorities within hours of the breach being discovered. Under GDPR, for example, companies trading in the Euro zone will have just 72 hours to tell authorities and affected parties that they have been breached.

The consequences of getting this wrong - by either under-reporting or over-reporting - can be severe. Lost customers, lost revenue, legal action and hefty penalties.

With access to packet history, data breaches can be precisely reconstructed - often down to the actual data which was exfiltrated - allowing the organization to be absolutely sure of the breach's impact before they notify authorities.

The EndaceProbe Analytics Platform records a 100% accurate history of Network Activity that allows you to retrieve packet-level detail surrounding a data breach for forensic analysis. Often if data was taken, this data can be reconstructed from the packets, so you can see exactly what was lost.