Proofpoint closes acquisition of Tessian.

Request a demo
Request a demo
Request a demo
Request a demo
Request a demo

Unlock Email Security Visibility Within Splunk

Seema Shah • Thursday, May 11th 2023
Unlock Email Security Visibility Within Splunk

Tessian Cloud Email Security intelligently prevents advanced email threats and protects against data loss, to strengthen email security and build smarter security cultures in modern enterprises.

Security teams are deploying an increasing number of security tools to defend against the rapidly evolving threat landscape and protect against data loss. Each security tool generates granular insights into a business’s cyber risks, events and incidents. Security teams at large enterprises typically manage 64 security tools on average, which leads to high overhead and little room for active investigation. Even with a comprehensive security stack, teams face increased need to gain consolidated visibility and improve their business’s cyber security posture. It is no surprise that a third of security teams (33%) feel as though they are being drained of time because of administrative tasks and 70% of SOC teams feel emotionally overwhelmed. 

Cybersecurity has become a boardroom issue and needs to be communicated effectively to stakeholders throughout the business. Security teams find themselves spending over half their time producing reports across a number of different security tools in an effort to paint an accurate picture of their cyber security controls and their contribution to risk reduction. 

Drowning in data? 

The true value of a well curated security stack is amplified through consolidation of data from separate applications focused on specific security problems to form a holistic picture of an organization’s investment in the protection of their core assets and customers’ data. 

Today Tessian has released an native application for Splunk® Enterprise and Splunk Cloud customers which allows security teams to ingest data from the Tessian Cloud Email Security Platform into their Splunk instance, enabling them to gain further visibility of security events across multiple tools in one place. As a well-established leader in Security Information and Event Management (SIEM) Splunk empowers organizations to collect, analyze, and visualize data at scale. 

When customers consolidate Tessian’s email security data with other solutions within Splunk Enterprise and Splunk Cloud, it enables the streamlining of processes and workflows and provides a more contextualized and complete risk profile of their environment, down to the employee level. 

The Tessian Splunk integration allows security events and more to be ingested into Splunk Enterprise and Splunk Cloud, and facilitate the following crucial use cases:

Advanced threat analysis for email based attacks 

Email continues to be one of the most significant risks in any organization. In 2022 phishing and business email compromise cost an organization, on average, $4.9 million per yearten times the cost of DDOS and ransomware attacks combined. 

Customers can leverage Tessian event data within Splunk Enterprise and Splunk Cloud to correlate email-based threats with other security events across an organization. Splunk collects and analyzes data from any source set up by the security teams, including network traffic, system logs, and endpoint security solutions, to create a comprehensive view of security threats. This holistic approach enables security teams to identify patterns and trends in cyber-attacks and potential risks for data loss, which can help to prevent future incidents and will accelerate diagnostics of the extent of any attack.

Unified and Customizable Reporting 

The ability to efficiently monitor, analyze and correlate every data point associated with a security event in one place is instrumental to enabling security teams to take a more proactive approach to tackling the issue of advanced threats and data loss on email. A unified view of cyber risk driven by clear reporting not only saves a security teams’ time but also improves cyber risk management. 

The customizable dashboard building experience of the Splunk platform provides visibility into email security events, enabling security teams to quickly identify and analyze threats, whilst factoring in insights from other security tools. The dashboards and data views can be customized to meet specific business needs such as team, business or compliance KPIs, drive boardroom conversations and tactical decision making. Tessian customers have used the Splunk platform to triage email security events, prioritizing key actions for team members to efficiently and effectively manage their operations. 

Ultimately, the Tessian Splunk Integration allows security teams to: 

  • Gain a unified view of email security data within the context of data from many different security tools to provide holistic picture of threats to the business
  • Save security teams hours on manual reporting, giving them time to focus on actions and investigations 
  • Mature the reporting process with customized dashboards for risk committees, insider threat programs and executive teams 
  • Build Tessian data into security operations workflows, automating threat team notifications, incident reviews and user follow ups

By combining the Tessian Cloud Email Security Platform which protects against advanced threats and data loss on email, with Splunk software’s analysis and automation capabilities, security teams can significantly raise the efficiency of their threat and risk management processes.

Seema Shah Product Marketing Manager II