In this guest blog post, Nikki Ralston, Product Marketing manager for Security Operations and AI at Check Point Software Technologies, details how Check Point’s Infinity XDR/XPR collaborates with Microsoft Defender for Endpoint to improve threat prevention for the entire organization.

The reality of modern threats is they are increasingly multi-vector and multi-phasic, so it’s natural that multiple tools are necessary. One problem is that, even though an individual tool may be excellent for a specific job, it works independently with little or no collaboration. This creates blind spots that persistent, sophisticated attackers will eventually discover and exploit.

A determined attacker will try many techniques on multiple vectors to gain initial access. Once they have a beachhead, they will quietly learn about your environment and move laterally, carefully avoiding detection by any of the siloed security tools. The only efficient way to overcome the vulnerability of siloes is collaboration.

AI eats data for breakfast

Endpoint protection (EPP) is one essential part of a robust cybersecurity technology stack. Microsoft Defender for Endpoint delivers detection and response capabilities across Windows, Linux, IoT, and other devices. EPP solutions analyze and produce vast amounts of rich data for detecting endpoint threats. But what if we told you this endpoint data could easily be leveraged to improve detection and prevention across endpoints, gateways, email, mobile, and more?

Any artificial intelligence (AI) tool is only as good as the data that feeds it. The “garbage in/garbage out” adage is especially true for AI-powered security tools. Your existing security and networking stack has a smorgasbord of large, rich, and varied data, the perfect diet to feed AI. Your existing gateway, endpoint, email, web, mobile, and network solutions already produce a massive amount of data, but if it all remains siloed, you only reap a fraction of the benefit.

By bringing all these data streams together to feed a unified analysis and AI engine, you gain cross-vector insight capable of revealing stealth attacks that would otherwise remain undetected. You already have a treasure trove of data; all you need to do is put it to work.

AI-powered, cloud-delivered threat prevention

Check Point Infinity XDR/XPR is a unifying platform that can ingest large amounts of diverse data from across security and network tools, analyze it all together, and uncover stealth multi-vector attacks that otherwise would remain undetected. Check Point Infinity XDR/XPR was recognized as an innovation and growth leader in the 2023 Frost Radar Extended Detection and Response Report.

Figure 1: Collaboration and intelligent event correlation across the security estate

An additional benefit to implementing XDR/XPR is gaining the AI Copilot, which works as a personal AI-powered security assistant capable of reducing up to 90% of the time needed to perform common security administration tasks. The new generative AI security solution harnesses automation and collaborative intelligence. Unlike other AI models that work in a silo, Infinity AI Copilot delivers broad platform support for a variety of use cases – helping manage security across the entire Infinity Platform. Infinity AI Copilot knows the customer’s policies, access rules, objects, logs, and product documentation, allowing it to provide contextualized and complete answers.

Check Point Infinity XDR/XPR consolidates data from events and alerts across the siloed tools in your security and IT estate, including Check Point native solutions, Microsoft Defender for Endpoint, and other third-party solutions, to feed AI-powered intelligent correlation, uncover stealth threats, and take automatic prevention actions when there is an attack.

Figure 2: Collaborative prevention blocks malicious access across all products

Check Point Infinity XDR/XPR is an open, comprehensive solution that integrates Check Point native products and integrates with many third-party solutions, including Microsoft Defender for Endpoint. This makes it easy to get started with XDR/XPR and quickly see results, without making any changes to your security stack.

Security operations teams that are currently inundated with an untenable volume of security event noise immediately appreciate how XDR/XPR cuts through that noise and makes their lives easier. Connecting Microsoft Defender for Endpoint with Check Point XDR/XPR is simple and allows vast amounts of event data to be fed into XDR/XPR, where intelligent AI-powered correlation engines can reduce up to 99% of incident noise so security professionals can focus on the 1% that are high/critical. This allows human analysts to focus their time and skills where they are most effective and keep the organization safe.

Figure 3: 99% incident noise reduction

Better Together: Infinity XDR/XPR on Azure Marketplace and Microsoft Defender for Endpoint

No matter which endpoint solution is currently in your security stack, Microsoft Defender for Endpoint, Check Point Harmony Endpoint, or another leading solution, adding Infinity XDR/XPR from the Azure Marketplace will quickly uncover and prevent cyberattacks by correlating events across your entire security estate – endpoints, network, mobile devices, email, and the cloud.

Customers can easily purchase Check Point Infinity XDR/XPR on the Azure Marketplace and may be able to apply Microsoft Azure Consumption Commitment (MACC) toward this solution.

Next steps to get started with infinity XDR/XPR:

Request a demo
Start 30-day free trial of Infinity XDR/XPR
Purchase on Azure Marketplace

​Microsoft Tech Community – Latest Blogs –Read More