SIFT: Scalable Incident-response and Forensics Toolkit

The current state-of-the-art in machine data aggregation and processing is designed around centralized architecture, but this approach has failed to provide adequate scaling capabilities to operate efficiently in a large enterprise network. Enterprise computer networks, including the SOCOMs, need dramatic improvements in network monitoring and threat detection. ATC-NY will design and develop Scalable Incident-response and Forensics Toolkit (SIFT), an incident response and monitoring software solution that enhances the efforts cyber defense analyst. SIFT leverages distributed processing to provide scalable data analysis in real-time to prevent malware from establishing a foothold on the network. SIFT is a next-generation cyber defense technology that provides security and scalability not possible with current machine-generated data analysis tools. SIFT is able to solve the shortcomings of existing defense technologies and at the same time provide new features to improve the state of the art in cyber security.