Measure Security Data Accuracy and Quality with Rapid7 Exposure Command

In this video, I'm going to demonstrate Rapid7's data transparency and confidence features as a part of our attack surface management capabilities in our Exposure Command platform. And so what we're going to do immediately is we're going to jump into our attack surface management capability. It's going to show us an entire inventory of all the assets and data that we're pulling in. Before I do that though, I want to show you the dashboards, kind of give you some data clarity into what's going on. So we're pulling in 226,000 raw asset records from a variety of different systems. This is your IT asset management system, your security tools, your vulnerability scanners, your endpoints, etc., etc., as well as ServiceNow and other business applications. And we got 226,000 raw asset events. Now our Tax Service capability will actually correlate and deduplicate those down to what it believes is the right number of assets in your environment. In that case, it's 61,000 different assets that we believe are unique. And then from there we're saying 46,000 are actually checking in and phoning home in the last 30 days. And we can break them down by different asset classes: workstation, server, hypervisor, IoT, containers, etc., as well as Windows and— I'm sorry, operating system families. So what we're going to do from here is we're actually going to show— go into the connectors area so we can see how we can further break down this information. So if we go pick on a particular connector that we're pulling data from, I'm going to use Azure Active Directory as an example. Example, I can actually see all the different data that we're pulling in, pulling application data, security scores, and devices, and so on and so forth. We're going to click on the devices because it has a lot of different pieces that we're pulling in, and we actually get a correlation score. 1 is a perfect score. So we're actually correlating decently well with a lot of other tools, but not perfectly. We also get completeness of the API information that we're pulling in. It'll actually tell you how much of the data is being populated for each field every time we actually pull in asset data, which is a very valuable feature for debugging and troubleshooting your data. So if you go on the right-hand side, we can see that there's 32,000 assets that are correlated across 3 data sources: Insight IDR, Azure, and Insight VM. However, we have a bucket of Insight VM applications that are not correlating with these other 2 sources. So that's 14,000 that are not. Perhaps you have different deployments. Maybe these are not assets that are in the cloud that Azure is seeing, but we're giving that visibility to tell you, hey, you're not being seen across. They're not correlating well with all your data sources. And you can continue to expand out the number of data sources that you want to get visibility into to show your true correlation, giving you better trust and confidence in the data. The last thing that I want to show as a part of these features is we're actually going to pick on a machine. We're going to go to this HubSpot machine. It's one of our production servers. It's got a lot of data sources. We see the source of the truth about this machine from ServiceNow, from inside VM, Intune, Defender, so on and so forth. A lot of different data sources. But we can actually dive in and see all the correlation information that we have about this data as well. And so in this case, we go to the General tab. We can see the full correlation, not just individual data source correlation. This will tell us where we got the MAC addresses or where we got conflicts between different, uh, data sources on significant pieces of data that allows us to troubleshoot and also see what decisions were made for the correlation. Again, giving you more trust and confidence in the data. The last thing that I want to show before I sign off here for you guys that I'm really excited about is our ability to show you a transparent data model that is easily configurable and tunable for your environment. So we're going to click on the gear up here and we're going to pull up our managed unified property. This is our unified correlation ingestion engine. So you're going to be able to see in the solution all the particular types that we support. So we have software, machines, network threats, mitigations, vulnerabilities, so on and so forth. We can actually click on machines and we can see every single data type that will populate if the source provides it. So you can see the asset type, the agent version, the business owner, the cloud account, all the stuff that we're pulling in from data sources. But the nice thing that we can do besides seeing what's supported, we can actually drill in any one of these features and decide who is the best source of truth for this information and re-correlate as a result. So maybe your security team relies on Azure AD as its source of truth over CrowdStrike. So you can drag that to the top and hit apply. It will recorrelate all the devices, all the machines around this business user property to give you the source of truth from Azure. And if Azure doesn't have it, it's the next one in the list and it goes down in order. So you get the best information based on the way that your security and IT teams see your environment. And this is done on a per-property basis. You can choose your preferred cloud provider or source, et cetera, et cetera, all the way down the list for any particular property. And we support thousands of properties. So highly configurable, tunable system that gives you great transparency into your attack surface with the correlation logic and reasoning why. So you can trust this tool and, uh, make the best visibility of your attack surface possible. Thank you.