Palo Alto Networks Advanced Threat Prevention - Subscription license renewal (1 year) - 1 device in HA pair
Price:
For pricing or to order this product:
Call our Sales Representatives
Mon-Fri 8am-6:30pm CST
E-MailAnswer within 2 hours
Availability:
10-14+ Days
This item will be shipped directly from the manufacturer.
Leadtime to shipment will be a minimum of 10-14 working days.
Call for further shipping details.
-
(888) 912-3151
or
E-Mail
Brand:
Palo Alto Networks
MPN:
PAN-PA-7050-ATP-HA2-R
Condition:
new
Returnable:
Yes
Palo Alto Networks Advanced Threat Prevention builds on the industry-leading Threat Prevention security service to protect your network by providing multiple layers of prevention and confronting both known and unknown threats at each phase of an attack. In addition to industry-leading IPS capabilities, Advanced Threat Prevention has the unique ability to leverage deep learning and machine learning models to block evasive and unknown command and control (C2) channels - completely inline - the last chance to stop an in-flight attack before a communication can be established. Providing the widest visibility, Advanced Threat Prevention detects and blocks threats on any and all ports instead of invoking signatures based on a limited set of predefined ports. Advanced Threat Prevention benefits from Palo Alto Networks' other cloud-delivered security subscriptions for daily updates that stop exploits, malware, malicious URLs, C2, spyware, etc. A necessity for every Palo Alto Networks NGFW, Advanced Threat Prevention can speed prevention of new unknown threats to near-real time when paired with other Palo Alto Networks subscriptions, including WildFire malware prevention service for unknown file-based threats, Advanced URL Filtering for web-borne attacks, DNS Security for attacks using the Domain Name Service, and IoT Security for unmanaged device visibility and context.
Palo Alto Networks Advanced Threat Prevention - Subscription license renewal (1 year) - 1 device in HA pair
General
Category:
- Online & appliance based services - advanced threat detection
Product Type:
- Subscription license renewal - 1 year
Licensing
License Qty:
- 1 device in HA pair
- Protect against known and unknown command and control
There's no silver bullet when it comes to preventing all threats from entering the network. After initial infection, attackers will communicate with the host machine through a C2 channel, using it to pull down additional malware, issue further instructions, and steal data. With the increasing use of tool sets such as Cobalt Strike as well as encrypted or obfuscated traffic, it is easier than ever for attackers to create completely customizable command-and-control channels that cannot be stopped with traditional approaches. - Unknown C2 prevention inline
Advanced Threat Prevention introduces inline deep learning for real-time enforcement for new and unknown command and control. Drawing on the unique dataset of malware from WildFire in addition to signals from soak sites and the Unit 42 research team, Advanced Threat Prevention leverages multiple deep learning and machine learning models running in the cloud. The models are aligned to key protocols, such as SSL, HTTP, unknown UDP, and unknown TCP. Specific models also identify C2 traffic from tools such as Cobalt Strike. As traffic traverses the firewall, a small prefiltered portion of traffic goes to the cloud for analysis, with a response sent back to the firewall to determine if the traffic should proceed. Based on these tuned models and integration with the NGFW, Advanced Threat Prevention provides real-time inline prevention of previously unknown C2. - Payload-based signatures
Palo Alto Networks goes beyond standard automation of C2 signatures based on URLs and domains. C2 protections home in on those unauthorized communication channels and cut them off by blocking outbound requests to malicious domains and from known toolkits installed on infected devices. Palo Alto Networks automatically generates and delivers researcher-grade signatures based on malicious traffic seen by WildFire at machine speed and scale. These signatures are payload-based and can detect C2 traffic even when the C2 host is unknown or changes rapidly. - Leverage best-in-class intrusion prevention
Threat-based protections detect and block exploit attempts and evasive techniques at both the network and application layers, including port scans, buffer overflows, remote code execution, protocol fragmentation, and obfuscation. Protections are based on signature matching and anomaly detection, which decode and analyze protocols and use the information learned to send alerts and block malicious traffic patterns. Stateful pattern matching detects attacks across multiple packets, taking into account arrival order and sequence and ensuring all allowed traffic is well-intentioned and devoid of evasion techniques. - Use custom signatures for emerging threats
Advanced Threat Prevention also provides flexible support for Snort and Suricata rule conversion, providing rapid protection for newly discovered vulnerabilities. This support, along with ongoing custom signature development, addresses a key use case and underlying goal for IPS in addition to completely eliminating the need for standalone IPS or IDS solutions. Namely, signature coverage for unconfirmed or emerging vulnerabilities acts as a stopgap before a verified update can be deployed to all of your organization's software and applications. With the conversion support, you can automatically convert, sanitize, upload, and manage Snort and Suricata rules, allowing you to take advantage of intelligence feeds while saving time and effort imposed by traditional signature-based IPS technologies. You can leverage exposed APIs to automate the process of applying new Snort rule coverage across your environment. - Protect against malware
Inline malware protection - through signatures based on payload, not hash - blocks malware before it ever reaches the target host. This includes known malware and future variants, even those not yet seen in the wild. The stream-based scanning engine protects your network without introducing significant latency, which is a serious drawback of network antivirus offerings that rely on proxy-based scanning engines. Stream-based scanning inspects traffic as soon as the first packets of the file are received, eliminating threats as well as the performance issues associated with traditional standalone solutions.
