An illustrative blog discussing the Pyramid of Pain and how it relates to the Iceberg of Inspection. Deep File Inspection can uncover TTPs and other indicators to supplement prevention, detection, and threat hunting within your network.
Join the Hunt.
Prevent. Detect. Hunt.
InQuest is a cybersecurity services and solutions company founded in 2013 by a well-versed team hailing from both the public and private sectors. Our platform is purpose-built by SOC analysts for SOC analysts and network defenders. With cloud and on-premise capabilities in threat prevention, breach detection, threat hunting and data leakage discovery. We've automated much of the typically mundane tasks of the SOC analyst resulting in analyst level scrutiny of data-in-motion at carrier class speeds as well as data-at-rest, all the while reducing frustration, and in-turn, allowing precious human time to be spent where it matters.
Join the HuntRecommended Reading
Retrospective Analysis Fueled by Deep File Inspection (DFI™)
The purpose of this whitepaper is to detail the functionality and benefits of the InQuest platform, specifically it's Deep File Inspection (DFI™) and RetroHunting™ capabilities. Fundamentally, DFI empowers defenders with a new dimension of data while RetroHunting exposes a new dimension of time.
Read MoreLatest Event
InQuest @ Rocky Mountain Cyberspace Symposium 2020
FEB 03 - 06 2020
COLORADO SPRINGS, CO
Industry, DoD and Academic experts will discuss the evolution, and our increasing dependency, on cyber security for our national security and wellbeing. They will also share how they and their organizations are playing a part in advancing national cyber security progress in this area over the next 10 years, and offer their predictions on what the next decade will bring.
More EventsInQuest Insider
Newsletter
The Iceberg of Inspection is the perfect visual for understanding the incorporation of threat intelligence within your security operations center (SOC). Considering only 10% of the iceberg is visible above water, many of the actionable indicators are hidden below sea level.
Deep File Inspection (DFI) can uncover the network artifacts, tools, and TTPs that are tied to the attacks targeting your organization. These additional indicators of compromise (IOCs) can be leveraged to empower your threat hunting and artifact pivoting throughout your analytical workflow.
Get the Insider
Here's what our customers are saying
Prior to having InQuest, file decompression, decoding and post-processing were all manual steps that were very time consuming for us. Now that we're using InQuest, all of those steps are automated and it has given us the ability to apply these steps to not only files we think are suspicious, but all files received by our users.
Having the ability to search historically based on file content is like having our own internal VirusTotal Retrohunt.
The threat score calculation and assignment being performed by InQuest's engine makes it easy for us to sift through the legitimate sessions and focus on the real threats targeting our users.
InQuest provides a complete network forensics picture, from session details such as header information to file details such as the hash, size, type and even the raw file.
The data loss prevention coverage InQuest provides for data-in-transit is second to none.
The InQuest platform is unlike any other network-based security system we've seen. The performance of their native capture engine and analytic capabilities are unparalleled in terms of the throughput it can support and the number of files it can dissect and analyze.
The third-party integrations with multiav and sandbox solutions are seamless. We have never had a security platform that made it so easy to automate all of our static and dynamic file analysis efforts.
Over half of our customer’s traffic is encrypted and InQuest is the first security platform we’ve seen with a specific focus on using SSL related indicators of compromise to detect the bad guy’s infrastructure.
The threat intelligence InQuest is able to gather and disseminate via their reputation and threat feeds has alerted us to numerous customer compromises. They are truly at the cutting edge when it comes to identifying threat actor infrastructure as it is deployed.
It’s pretty amazing that they are able to support capturing, reassembling, processing, storing and inspecting content at speeds over 10Gb without dropping traffic all in a 1U box.
We’ve been customers for several years now and up until the recent acquisition of their appliances we were running their collectors on 4U boxes with flash storage cards. As a result of that acquisition, we went from having to deal with three different vendors to one vendor, reduced our rackspace footprint as well as our power consumption which all resulted in a huge cost savings for us. Kudos to InQuest!
Through their data orchestration and workflow, they’ve made it really easy for us to establish repeatable workflows from within their UI. That has saved our SOC analysts a considerable amount of time and has enabled them to pivot through data from numerous systems all from a single pane of glass.
