The First Unified CNAPP and XDR Solution

Uptycs Unified CNAPP & XDR

If you’re struggling with a lack of transparency in your security stack, and questions like, “What containers in my environment are running this known vulnerable package?” or “How many servers have had the password rotated in the last 90 days?” Uptycs gives you the ability to get all the answers from the same console. With unified observability across endpoints, systems, providers and more, Uptycs empowers your security teams with actionable answers to close security observability gaps across your organization.

One UI and Data Model - Multiple Solutions

Uptycs Unified CNAPP and XDR is built for modern defenders who have a charter to close security observability gaps across their cloud-native infrastructure. Uptycs is composed of:

Telemetry sourced from across the cloud-native attack surface
A powerful analytics engine and data pipeline
Data summarizations and visualizations that solve for multiple solutions including CLoud Workload Protection (CWPP), Cloud Security Posture Management (CSPM), eXtended Detectino and Response (XDR), Insight, Inventory and Audit, Compliance and Governance.

Click components of the diagram below to explore Uptycs CNAPP and XDR further.

The Power of Structured Telemetry: How Our Data Pipeline Works

With the relevant query-based sensors and collectors in place, Uptycs Unified CNAPP and XDR immediately begins ingesting and analyzing telemetry — normalized in a tabular format — and gives you connected insights across all of your asset classes in the same place. Uptycs Unified CNAPP and XDR can be visualized as a data engineering pipeline with three stages; collect, aggregate, and analyze.

Collect

Collection Stage

In the collection stage, telemetry is captured via agent deployment to the host (osquery) or via native API integrations (kubequery, cloudquery) and transferred to Uptycs backend using an HTTP TLS connection. The telemetry can be bucketed into two broad areas based on the attack surface:

First Grouping: based on osquery’s ability to interface with operating system interfaces such as kaudit, eBPF on Linux, ETW on Windows, and OpenBSM or the security API framework on macOS. Osquery uses these interfaces to collect system call behavior and translate it into a tabular JSON format.
Second Grouping: cloudquery and kubequery use native API integrations to ingest data and translate it into a structured table format.

The tabular telemetry can be acted upon while it’s streaming — for real-time correlation and alerting — and once it's been aggregated and stored for reporting and ad hoc historical querying.

Aggregate

Aggregation Stage

The aggregation stage is where Uptycs’ speed and scale truly shines. Our eXtended Detection Network (XDN) applies scaling techniques, such as consistent hashing for horizontal scaling based on HTTP and TLS load balancing techniques to reliably spread the load and ingestion of the data. Uptycs backend can concurrently ingest a wide variety of structured telemetry from multiple interfaces. The XDN also facilitates cohort analysis.

Example: telemetry is in flight from a cohort of 1,000 database servers, and anomalous behavior is identified on one of the machines. The anomalous behavior on the single machine is converted into a real-time query that then evaluates the other 999 machines.

Analyze

Analysis Stage

In the analysis stage, Lambda analytics are used to analyze data while it’s in- flight for near real-time correlation. While in-flight, Uptycs correlates data with a variety of open source threat intel databases and independent research findings from the Uptycs Threat Research Team. Data is partitioned as a function of time and compressed so that the telemetry can be analyzed at scale.

This streaming analytics model allows Uptycs to take each row of structured data and correlate it using event and alert rules to generate signals. Billions of pieces of telemetry are narrowed to thousands of signals.
These signals are correlated into tens of detections, making it possible for humans and automation to see insights and make data-driven decisions as a part of a compliance requirement.

Explore Uptycs Unified CNAPP & XDR

Watch these short videos to see how Uptycs provides security observability across modern attack surfaces.

Cloud Infrastructure

Improve Your Cloud Security Posture

In this 2-minute video, see how IT and security teams gain instant insights for their entire cloud estate; inventory cloud assets and resources, identify non-compliant resources, and access evidence needed for remediation. Uptycs also analyzes cloud activity logs and flow logs so that you can enforce least-privilege policies, detect threats, and investigate incidents.

Containers & Kubernetes

Secure Your Containers & Kubernetes Environments

New technology needs a new kind of security. Watch this 2-minute video to explore how our unified CNAPP and XDR equips security and DevOps teams with the visibility they need at build time, runtime and while in production.

Endpoints & Servers

Unprecedented Observability for macOS, Linux, and Windows Fleets

Cloud-native security begins with modern productivity (laptops) and production (cloud-based servers) endpoints. With Uptycs, you’ll gain insight and visibility into your entire fleet, as well as the ability to extend those capabilities to compliance, detection, and investigation. See how in this 3-minute video.