Skip to main content
LevelBlue USM Anywhere provides five essential security capabilities in a single SaaS platform, giving you everything you need to detect and respond to threats and manage compliance. As a cloud-based security solution, you can scale your threat detection and response capabilities as your hybrid environment changes.
The USM Anywhere cloud security management platform receives continuous updates from the LevelBlue Labs™ Security Research Team. This team analyzes the different types of attacks, emerging threats, suspicious behavior, vulnerabilities, and exploits that they uncover across the entire threat landscape. USM Anywhere supplements the Security Research Team with data from LevelBlue Labs™ Open Threat Exchange® (OTX™). OTX is the largest and most authoritative crowd-sourced threat intelligence exchange in the world. Here is a brief description of the essential functions that USM Anywhere provides:
  • Asset Discovery is an essential security capability of USM Anywhere, which discovers assets in your environment, detects changes in assets, and discovers malicious assets in the network.
  • Vulnerability Assessment, which is done in authenticated state, identifies vulnerabilities or compliance by comparing the installed software on assets with a database of known vulnerabilities. Vulnerability scans can be performed manually or scheduled to be performed periodically.
  • Intrusion Detection monitors network traffic for malicious activity, monitors system log messages, and monitors user activity. Intrusion detection for USM Anywhere consists of network-based intrusion detection (NIDS) components. HIDS can be used to spot problems on host endpoints, and can include file integrity monitoring, rootkit and registry checks. NIDS passive sniffing interfaces can analyze network payload data to monitor for potentially malicious activity.
  • Behavioral Monitoring identifies suspicious behavior and potentially compromised systems. USM Anywhere provides continuous monitoring of services run by particular systems. Data used for behavioral monitoring and analysis is collected from network devices and user behavior. USM Anywhere has access to logs in the cloud (Azure: Monitor, AWS: CloudTrail, S3, ELB) and VMware logs.
  • SIEM and Log Management correlates and analyzes security event data and respond. USM Anywhere SIEM draws intelligence from different sources including the LevelBlue Labs Threat Intelligence Subscription and OTX. Correlation rules, created by the Security Research Team, are used to identify patterns associated with malicious activity. OTX threat data provides IP reputation information and OTX pulses, which consist of Indicators of Compromise (IOCs) that identify a specific threat.
All of USM Anywhere’s various security operation features and functionality are accessible from the USM Anywhere web UI.
⌘I