Cisco Talos

Malware defense services

Cisco Talos offers superior threat intelligence and malware defense, detecting exploits, files, and anomalies. This results in blocking over 95 million malicious samples and stopping over 3 million threats each month, providing exceptional protection.

Cisco Talos antivirus software

Cisco Talos antivirus software provides robust malware detection and safety verification. The software performs deep file analysis and pattern matching (including regex, bytes, hashes, and fuzzy hashes) for classification and sends suspect files sent to Cisco Secure Malware Analytics for sandboxing.

Products leveraging Cisco Talos antivirus software

• Cisco Secure Firewall: Uses Talos AV for deep file analysis and signature matching on network traffic.
• Cisco Secure Endpoint: Employs Talos AV for endpoint file scanning and classification based on hashes and patterns.
• Cisco Secure Web Appliance: Leverages Talos AV to scan web traffic for malicious files.
• Cisco Secure Email Threat Defense: Uses Talos AV as part of its layered defense to analyze email attachments.
• Cisco Secure Malware Analytics: Acts as the sandboxing destination for suspect files identified by Talos AV components in other products.
• Splunk Attack Analyzer: Incorporates Talos AV data for enhanced threat analysis.

Cisco Talos malware protection

Cisco Talos malware protection guards endpoints and systems using threat intel and machine learning (ML). The software delivers layered defense using file dispositions, behavioral analysis, Cloud IoCs, and classifiers to monitor activity in real time, match patterns, and detect misuse of land binaries (lolbins).

Products leveraging Cisco Talos malware protection

• Cisco Secure Firewall: Integrates Talos malware protection intelligence for network-level defense against malicious software and behaviors.
• Cisco Secure Endpoint: Heavily relies on Talos malware protection for endpoint defense using file dispositions, behavioral indicators (including Cloud IoCs and classifiers), and detection of lolbin abuse.
• Cisco Secure Web Appliance: Uses Talos malware protection intelligence to identify and block malicious software encountered in web traffic.
• Cisco Secure Email Threat Defense: Employs Talos malware protection techniques as part of its advanced threat defense for email.
• Cisco Secure Malware Analytics: Provides deep analysis capabilities that complement Talos malware protection findings from other products.
• Cisco Multicloud Defense:  Leverages Cisco Talos Intelligence for FQDN and URL lookups, providing robust threat intelligence to enhance security across multicloud environments.
• Splunk Attack Analyzer: Integrates Talos malware protection insights for comprehensive attack analysis.
• Catalyst SD-WAN: Incorporates Talos Malware Protection for securing SD-WAN environments.

Email security services

Cisco Talos safeguards email security across hybrid, cloud, and on-premises environments. By monitoring 80 million emails daily and employing real-time intelligence and machine learning, Talos thwarts more than 300,000 malicious emails daily, including phishing and business email compromise (BEC) attempts.

Cisco Talos Email filtering

Backed by AI models that crawl emails for information, Cisco Talos Email Filtering service provides protection from threats based on sender reputation and various atomic indicators, including the reputation of available URLs within email headers and text.

Products leveraging Cisco Talos Email filtering

• Cisco Secure Email Threat Defense: Enhances filtering capabilities using Talos intelligence for advanced protection.
• Cisco Secure Network Analytics: May leverage email-related metadata and reputation from Talos for broader network visibility.
• Cisco XDR: Integrates Talos Email Filtering data as a source for cross-platform threat detection and response.
• Cisco Webex: Uses Talos filtering intelligence to protect communications shared through Webex platforms.
• Cisco Enterprise Security (Splunk ES): Incorporates Talos email reputation and filtering data for security monitoring and analysis within Splunk.
• Splunk SOAR: Uses Talos email filtering intelligence to enrich incidents and automate response actions related to email threats.

Cisco Talos Email Threat Protection

Gain advanced protection from brand impersonation, phishing, and BEC threats using such Cisco Talos Email Threat Prevention services as rapid Domain-based Message Authentication, Reporting, and Conformance (DMARC) verification and trusted email behavior models.

Web security services

Cisco Talos delivers comprehensive threat intelligence for web security. Deep threat research helps ensure proactive defense, stopping threats before they have a chance to impact. As a result, more than 400 million malicious URLs are blocked each month and more than 5 billion are blocked annually.

Cisco Talos DNS security

DNS threats such as tunneling, domain-spoofing, and domain-generated-algorithms (DGAs) in malware through AI-led convolutional neural network models as well as malware reverse engineering to understand Command and Control Infrastructure (C2) communications.

Products leveraging Cisco Talos DNS security

• Cisco Secure Firewall: Can enforce DNS security policies based on Talos intelligence, blocking malicious domains at the network edge.
• Cisco Secure Connect: Integrates Talos DNS Security for protecting remote connections.
• Cisco Umbrella: Primary product using Talos DNS Security to block requests to malicious domains, IPs, and URLs at the DNS layer, preventing connections to threats.

Cisco Talos web filtering

Achieve compliance goals and protect users and your organization from visiting untrustworthy and high-risk sites through domain, IP, and URL filtering based on reputation and categories that are updated using the latest machine-learning models.

Products leveraging Cisco Talos web filtering

• Cisco Secure Firewall: Uses Talos Web Filtering intelligence for policy enforcement based on URL categorization and reputation.
• Cisco Secure Access: Leverages Talos Web Filtering for secure access control based on web content categories and risk.
• Cisco Secure Endpoint: Can utilize Talos Web Filtering data to block connections to malicious sites initiated from endpoints.
• Cisco Umbrella: Core product using Talos Web Filtering for enforcing acceptable use policies and blocking access to malicious or inappropriate sites based on Talos reputation and categorization.
• Cisco Secure Web Appliance: Dedicated appliance utilizing Talos web filtering for granular control over web access.
• Cisco Multicloud Defense:  Leverages Cisco Talos Intelligence for FQDN and URL lookups, providing robust threat intelligence to enhance security across multicloud environments.
• Cisco Meraki: Integrates Talos Web Filtering for content filtering capabilities within the Meraki platform.
• Catalyst SD-WAN: Uses Talos Web Filtering to secure direct internet access and enforce policies across the SD-WAN fabric.

Network security services

Cisco Talos provides robust network defense through real-time threat intelligence, delivering over 2500 Snort rules annually to combat emerging threats like malware and zero days. Talos creates coverage in less than 24 hours for high-profile and critical vulnerabilities, including stopping over 108,000 strikes in behavioral protections. Snort's extensive coverage targets active exploits, campaigns, and actors, ensuring rapid and comprehensive security.

Prevent network intrusion

Block known and unknown attacks by using the latest in exploit prevention, including SnortML, for zero-day protection.

Products leveraging Cisco Talos network intrusion prevention (Snort):

• Cisco Secure Firewall: Primary platform integrating Talos Network Intrusion Prevention (Snort engine) for deep packet inspection, threat detection using signatures and rules, and automated blocking of network attacks.
• Cisco Cyber Vision: Utilizes Talos threat intelligence, potentially including network intrusion signatures, for visibility and threat detection in industrial control systems (ICS) environments.
• Cisco Secure Endpoint: While primarily endpoint-focused, may leverage network-level IOCs or context derived from Talos IPS findings.
• Cisco Security Cloud Control: Manages policies for devices like Cisco Firewall, which utilize Talos Network Intrusion Prevention.
• Cisco Meraki: Meraki security appliances incorporate intrusion detection and prevention capabilities powered by Talos/Snort.
• Catalyst SD-WAN: SD-WAN solutions can integrate Talos network intrusion prevention for threat protection within the WAN fabric.