AI-powered intelligence layer that performs threat prediction by correlating signals from multiple collectors across your infrastructure. Augur receives BGP routing data from Pulse, network flow telemetry from Flux, and DNS patterns from Pythia, combining these signals with external threat intelligence to generate actionable predictions.
Key Features
Multi-Signal Correlation
Augur integrates three primary signal sources to build comprehensive threat intelligence. Pulse provides BGP routing anomalies and topology data. Flux delivers network flow patterns and traffic behaviors. Pythia contributes DNS query analysis and domain reputation. The correlation of these diverse signals enables detection of complex threats that single-source monitoring cannot identify.
External Intelligence Integration
Beyond internal signals, Augur incorporates external threat intelligence feeds from open source intelligence and commercial providers. This contextual enrichment using domain reputation data, IP reputation scores, and known attack indicators enhances prediction accuracy.
Threat Prediction Attributes
Generated threat predictions include confidence scores indicating likelihood, time-to-impact estimates for response prioritization, affected asset identification, and threat classifications by type and severity. These attributes enable Aegis to make informed decisions about policy deployment.
Canary-Based Early Warning
Canary systems deployed across infrastructure provide early warning of attack precursors. These sensors detect reconnaissance activity, scanning patterns, and initial compromise attempts, feeding this intelligence to Augur for correlation with other signals.
Contextual Enrichment
Augur enriches threat predictions using topology data from Pulse and domain reputation from Pythia. This context helps distinguish false positives from genuine threats and enables more precise policy targeting.
Machine Learning and Adaptation
Continuous Learning
Augur receives enforcement telemetry from xfw about actual attack outcomes, enabling continuous refinement of machine learning models. This feedback loop ensures that threat predictions improve over time based on real-world results.
Model Validation
Threat models validate against observed attacks to measure prediction accuracy. This validation process identifies model drift and enables retraining with new attack patterns, ensuring that Augur adapts to evolving threat landscapes.
Correlation Engine
The correlation engine analyzes patterns across time and signal sources to identify attack campaigns, coordinated threats, and multi-stage attacks that might appear benign when viewed in isolation.
Threat Detection Capabilities
DDoS Prediction
By correlating routing anomalies from Pulse with traffic patterns from Flux, Augur predicts DDoS attacks before they reach peak intensity. This advance warning enables preemptive policy deployment through Aegis and xfw.
BGP Hijacking Detection
Pulse routing data combined with DNS resolution patterns from Pythia enables detection of BGP hijacking attempts that might otherwise appear as legitimate routing changes.
Malware C2 Detection
DNS patterns from Pythia indicating DGA domains or suspicious beaconing, combined with connection patterns from Flux, reveal command-and-control communications even when attackers attempt to blend with legitimate traffic.
Data Exfiltration Prevention
Unusual DNS tunneling patterns from Pythia combined with anomalous outbound traffic from Flux indicate data exfiltration attempts that require immediate response.
Attack Campaign Identification
Correlation across multiple signals and time periods reveals coordinated attack campaigns targeting infrastructure, enabling comprehensive defensive responses rather than piecemeal reactions to individual incidents.
Integration
Augur operates as the intelligence layer within the Perforlabs Predictive Defense Fabric. It receives signals from Pulse, Flux, and Pythia collectors, generates threat predictions with detailed attributes, and sends these predictions to Aegis for automated policy deployment. Enforcement telemetry from xfw feeds back to Augur for continuous model improvement, creating a closed-loop system that becomes more effective over time.
Deployment Options
Augur is available in two deployment models to meet different operational requirements:
- On-premises deployment provides complete control and data sovereignty, enabling organizations with strict compliance requirements to maintain all intelligence processing within their own infrastructure
- Managed service offers expert operation with continuous monitoring, freeing security teams from operational overhead while maintaining the benefits of advanced threat prediction
Use Cases
- Security operations centers requiring advanced multi-source threat detection
- Healthcare organizations protecting patient data with predictive defense
- Government agencies defending critical infrastructure from nation-state threats
- Financial institutions preventing fraud and data breaches through early warning
- Service providers protecting customer infrastructure at scale