Palo Alto Networks is teaming with NTT Data to allow the global IT services company to offer an enterprise security service with continuous threat monitoring, detection and response capabilities. Specifically, NTT Data’s new managed e…

IT Security Nachrichten networkworld.com 28.10.2024, 19:51 Uhr 2 Min. Lesezeit KRITIS / Energie Cloud & IT-Enterprise

↗ Quelle (networkworld.com)

Reagiere als Erste:r — dein Feedback zählt!

Palo Alto Networks is teaming with NTT Data to allow the global IT services company to offer an enterprise security service with continuous threat monitoring, detection and response capabilities.

Specifically, NTT Data’s new managed extended detection response (MXDR) service is based on Palo Alto’s Cortex Extended Security Intelligence and Automation (XSIAM) platform. Palo Alto’s Cortex XSIAM platform uses AI and other technologies to enable capabilities including security orchestration, automation, and response; attack surface management; user entity behavior analytics; and threat intelligence.

“Many organizations rely on fragmented security systems, making it harder to detect advanced threats, and react quickly,” said Sheetal Mehta, global head of cybersecurity, NTT Data, in a statement. NTT Data’s MXDR service offers 24×7 incident detection and response and AI-driven threat intelligence orchestration and automation, Mehta stated. The service is supported by a team of information security managers, threat hunters, digital forensic experts and certified security professionals.

NTT Data offers a wide range of IT services, and its competitors include Accenture, Infosys, IBM and Tata. For its enterprise security offerings, NTT Data partners with Fortinet, Cisco, Microsoft and others to provide services including firewalls, endpoint security, and cloud application protection. It has a long-standing partnership with Palo Alto, through which it offers services such as managed secure access service edge (SASE).

CTI Threat Relationship Graph6 Knoten / 5 Relationen

CVE / Incident Software MITRE ATT&CK CWE Weakness IoC

IR-PLAYBOOK-VULN-REMEDIATIONMEDIUM

Schritte anzeigen

SOC Incident Playbook: Vulnerability Remediation & Verification

Asset Inventory

Asset-Datenbank nach betroffenen Komponenten, Versionen und exposed Ports abfragen.

nmap -sV --script vuln -p- <target-network>

Exploit MonitoringSofort

SIEM-Regeln und IDS-Signaturen (Snort/Suricata) auf Angriffsversuche schärfen.

tail -f /var/log/suricata/fast.log | grep <cve>

Patch DeploymentSofort

Patch oder offiziellen Workaround gemäß Hersteller-Empfehlung einspielen.

Check Vendor Security Advisory Bulletin

1-Click Detection Engineering: Multi-Dialect SIEM Rules5 Formate

Regeln anzeigen

Syntax validiert (0 Fehler)

title: Detect Exploitation - NTT Data to offer Palo Alto-based threat detection, remediation service
id: fe785b04-cb2f-4a71-b8e8-0d7d6b458ee6
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

Syntax validiert (0 Fehler)

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "NTT Data to offer Palo Alto-ba" ascii wide
    condition:
        any of them
}

Syntax validiert (0 Fehler)

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("NTT Data to offer Palo Alto-based threat")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Syntax validiert (0 Fehler)

message: "*NTT Data to offer Palo Alto-based threat*"

Syntax validiert (0 Fehler)

CommonSecurityLog
| where Message has "NTT Data to offer Palo Alto-based threat"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

🎯

MITRE ATT&CK Matrix Navigator 14 Taktiken

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

💡 Tipp: Klicken Sie auf eine TTP, um Gegenmaßnahmen und SIEM-Erkennungsregeln anzuzeigen.Enterprise Matrix v14.1

🚀 Auf tsecurity.de entdecken

◀ VORHERIGER BEITRAG 1 Min

French ISP Free confirms data breach after hacker puts customer data up for auction

IT Security Nachrichten

NÄCHSTER BEITRAG 1 Min

Inform holt Bernd Heinrichs und Holger Robioneck ins Management - IT&Production

IT Security NachrichtenWeiterlesen ▶

Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen

Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich NTT Data to offer Palo Alto-based threat.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen

1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.

🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC

Schnell-Prompts für Analysten

⚠️ DEFANGED SANDBOX VIEW (tsecurity.de): Alle Netzwerkindikatoren und URLs wurden neutralisiert (2 Indikatoren entschärft). Nur zur defensiven Analyse!

Format: python

#!/usr/bin/env python3
# Exploit Title: PoC for Target
import socket, sys
target = '192[.]168[.]1[.]10'
url = 'hxxp://target[.]local/vuln'
s = socket.socket()
s.connect((target, 80))
s.send(b'GET / HTTP/1.1\r\nHost: target.local\r\n\r\n')