BACKGROUND IMAGE: stock.adobe.com

This content is part of the Conference Coverage: RSAC 2019: Coverage of the premiere security gathering
News Stay informed about the latest enterprise technology news and product updates.

Chronicle dives into security telemetry with 'Backstory'

Alphabet's Chronicle looks to give enterprises a leg up with a new service called Backstory, which will bring context and insight to vast amounts of security telemetry.

SAN FRANCISCO -- Alphabet's Chronicle looks to give enterprises an advantage with a service called Backstory that can parse and analyze vast amounts of security telemetry.

Chronicle, which Alphabet launched as a security startup in 2018, said the Backstory cloud service can assist organizations that produce large amounts of security telemetry but don't have the internal staff or resources to put all of the data into context. The data includes everything from endpoint and network proxy logs to DNS traffic. Chronicle claims the service can handle 50 petabytes of information in about a second.

During a press event here at RSA Conference 2019 Monday, Chronicle CSO and co-founder Mike Wiacek used the Democratic National Committee (DNC) breach in 2016 as an example of how Backstory can pick up signs in security telemetry that might otherwise be missed. The DNC hack saw Linux malware called X-Agent lurk on the DNC's network for several months after the breach was detected.

The X-Agent malware communicated with a specific domain, linuxkrnl.net. Wiacek said a simple check of that domain with Backstory would have revealed suspicious activity with the URL and informed the organization of every one of its devices that connected to that URL. But most organizations only keep "a few weeks of network traffic," so many enterprises and security analysts are essentially blind, the company said in a blog post.

Potential users like the sound of the service, but want more information.

"There's nothing out there like this right now, which makes it interesting," said Adam Kujawa, director of malware intelligence at Malwarebytes. "But you're essentially paying Chronicle to give them your data."

Backstory promises intelligence and privacy

Chronicle said enterprises' data "remains private -- it isn't scanned by or available to anyone for other purposes." Organizations can upload telemetry data to Backstory and store it in a private cloud instance built on Google's core infrastructure. The Backstory cloud service scans the security telemetry and runs it through Chronicle's analytics engine to normalize, correlate and index the data to give organizations actionable intelligence that's easy for organizations to understand.

In addition, several third-party cybersecurity vendors have partnered with the company around Backstory. Antivirus vendor Avast and email security vendor Proofpoint have embedded their threat intelligence feeds directly into the Backstory analytics engine and dashboard. Endpoint security vendor Carbon Black also integrated its endpoint detection and response data with Backstory.

The Backstory service serves as the official product launch from Chronicle. In September, Chronicle VirusTotal Enterprise, a version of the free security scanner that allows users and organizations to submit files and URLs for analysis. Alphabet subsidiary Google acquired VirusTotal in 2012, and Chronicle began operating the scanning service after the company was launched last year.

Chronicle's blog post said other services that allow organizations to upload their security data often charge based on the volume of data uploaded by customers. Chronicle said Backstory is "licensed differently" than other services, but the company didn't offer specific details on how the licensing plans work.

Dig Deeper on SIEM, log management and big data security analytics

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

How long does your organization retain security telemetry such as network logs?
Cancel

-ADS BY GOOGLE

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly.com

Close