Cisco Talos

Malware Defense Integrations

Talos detects and blocks millions of malicious activities every day, finding threats and exploits within files, behavioral anomalies, and more.

Cisco Talos Antivirus Integration

Cisco Talos Antivirus, also known as ClamAV, delivers foundational malware protection through deep file analysis and industry-leading signature detection. As an open-source solution embedded across Cisco's security, networking, and collaboration products, Talos Antivirus provides robust protection against known malware threats, making it a trusted choice for enterprises, service providers, and individuals worldwide. 

Products leveraging Talos Antivirus

• Cisco Secure Firewall: Uses Talos AV for deep file analysis and signature matching on network traffic.
• Cisco Secure Endpoint: Employs Talos AV for endpoint file scanning and classification based on hashes and patterns.
• Cisco Secure Web Appliance: Leverages Talos AV to scan web traffic for malicious files.
• Cisco Secure Email Threat Defense: Uses Talos AV as part of its layered defense to analyze email attachments.
• Cisco Secure Malware Analytics: Acts as the sandboxing destination for suspicious files identified by Talos AV components in other products.
• Splunk Attack Analyzer: Incorporates Talos AV data for enhanced threat analysis.

Cisco Talos Malware Protection

Cisco Talos Malware Protection delivers advanced protection for endpoints and systems against a wide range of malicious software. This integration goes beyond traditional reputation-based blocking by leveraging behavioral analysis of telemetry, Secure Malware Analysis sandboxing. The experience of Talos threat-intelligence analysts combines with the speed of AI coverage generation for high-confidence protection at speed.  

Products leveraging Cisco Talos Malware Protection

• Cisco Secure Firewall: Integrates Talos Malware Protection for network-level defense against malicious software and behaviors.
• Cisco Secure Endpoint: Relies heavily on Talos Malware Protection for endpoint defense coverage of file dispositions, behavioral indicators (including Cloud IoCs and classifiers), and LOLBins abuse detection.
• Cisco Secure Web Appliance: Uses Talos Malware Protection to identify and block malicious software encountered in web traffic.
• Cisco Secure Email Threat Defense: Employs Talos Malware Protection as part of its advanced threat defense for email.
• Cisco Secure Malware Analytics: Provides deep analysis capabilities to complement cross-product Talos Malware Protection findings.
• Cisco Multicloud Defense: Leverages Talos Malware Protection for FQDN and URL lookups, for robust security across multicloud environments.
• Splunk Attack Analyzer: Integrates Talos Malware Protection insights for comprehensive attack analysis.
• Cisco Catalyst SD-WAN: Incorporates Talos Malware Protection for securing SD-WAN environments.

Email Security Integrations

Talos proactively protects customers from possible email threats. Robust machine learning systems identify potentially malicious emails: phishing, scams, business email compromise (BEC), emails containing exploits or botnets, and more.

We also categorize and characterize malicious activity when an email observable is marked "Untrusted."

Cisco Talos Email Filtering

Cisco Talos Email Filtering provides verdicts and categorization for mail-source reputations to Cisco email security products. Talos Email Filtering examines URLs and file attachments in emails, as well as IP and domain reputations of senders, to block malicious, unwanted, and inappropriate emails. The Talos research team has the experience of experts in over 40 languages to review and classify messages to identify spam, ham (desired emails), phishing, and more.

Products leveraging Cisco Talos Email Filtering

• Cisco Secure Email Threat Defense: Enhances filtering capabilities using Talos intelligence for advanced protection.
• Cisco Secure Network Analytics: May leverage email-related metadata and reputation from Talos for broader network visibility.
• Cisco XDR: Integrates Talos Email Filtering data as a source for cross-platform threat detection and response.
• Cisco Webex: Uses Talos filtering intelligence to protect communications shared through Webex platforms.
• Cisco Enterprise Security (Splunk ES): Incorporates Talos email reputation and filtering data for security monitoring and analysis within Splunk.
• Splunk SOAR: Uses Talos Email Filtering intelligence to enrich incidents and automate response actions related to email threats.

Cisco Talos Email Threat Protection

Cisco Talos Email Threat Prevention provides industry-leading brand impersonation, business email compromise, and phishing attack detection. Talos-built AI tools analyze traffic trends and anomalies in Cisco's vast telemetry database to detect and prevent attackers pretending to be trusted brands (Brand Impersonation) or targeting high-value employees with carefully crafted phishing attempts (Business Email Compromise). Talos blocks these customized attacks and provides detailed logs on all attempts and actions taken.

Web Security Integrations

Cisco Talos delivers comprehensive threat intelligence for web security. Deep threat research helps ensure proactive defense, stopping threats before they have a chance to impact. As a result, more than 400 million malicious URLs are blocked each month and more than 5 billion are blocked annually.

Cisco Talos DNS security

Cisco Talos DNS Security protects organizations from DNS-based threats, including malware delivery, data exfiltration, DNS tunnelling, command-and-control (C2) communications, and access to phishing domains. It does this by detecting obfuscated data hidden in DNS packets, the core of internet communication. 

Advanced AI-driven detection, including Domain Generation Algorithm (DGA) analysis, proactively identifies and predicts malicious domains, stopping threats before they impact your organization. This type of protection is the first of its kind.

Products leveraging Cisco Talos DNS security

• Cisco Secure Firewall: Can enforce DNS security policies based on Talos intelligence, blocking malicious domains at the network edge.
• Cisco Secure Connect: Integrates Talos AI DNS Security for protecting remote connections.
• Cisco Umbrella: Primary product using Talos DNS Security to block requests to malicious domains, IPs, and URLs at the DNS layer, preventing connections to threats.

Cisco Talos Web Filtering

Cisco Talos Web Filtering allows organizations to block access to malicious, risky, or inappropriate web content. Leveraging a vast database of domain, IP, and URL reputations and categories, this integration enables Cisco products to prevent users from visiting harmful sites and enforce acceptable use policies. Talos leverages the power of Cisco telemetry to help organizations protect users anywhere they access the internet. 

Products leveraging Cisco Talos Web Filtering

• Cisco Secure Firewall: Uses Talos Web Filtering for policy enforcement based on URL categorization and reputation.
• Cisco Secure Access: Leverages Talos Web Filtering for secure access control based on web content categories and risk.
• Cisco Secure Endpoint: Can utilize Talos Web Filtering data to block connections to malicious sites initiated from endpoints.
• Cisco Umbrella: Core product using Talos Web Filtering for enforcing acceptable use policies and blocking access to malicious or inappropriate sites based on Talos reputation and categorization.
• Cisco Secure Web Appliance: Dedicated appliance utilizing Talos web filtering for granular control over web access.
• Cisco Multicloud Defense: Leverages Talos Web Filtering for FQDN and URL lookups, providing robust threat intelligence to enhance security across multicloud environments.
• Cisco Meraki: Integrates Talos Web Filtering for content filtering capabilities within the Meraki platform.
• Cisco Catalyst SD-WAN: Uses Talos Web Filtering to secure direct internet access and enforce policies across the SD-WAN fabric.

Network Security Integration

Cisco Talos delivers advanced, real-time network protection for Cisco customers by monitoring and analyzing traffic at the packet level. 

Cisco Talos Network Intrusion Prevention

By drawing from decades of comprehensive rule-based detection, Talos Network Intrusion Prevention (also known as Snort) identifies and blocks malicious traffic—vulnerability exploitation attempts, malware traffic, SQL injections, and reconnaissance and exfiltration traffic—all before new or emerging threats can compromise systems, applications, or devices. Through integrations with products within Cisco's security portfolio, Talos Network Intrusion Prevention provides proactive, adaptable defense for organizations of any size. 

Products leveraging Cisco Talos Network Intrusion Prevention (Snort):

• Cisco Secure Firewall: Primary platform integrating Talos Network Intrusion Prevention for deep packet inspection, threat detection using signatures and rules, and automated blocking of network attacks.
• Cisco Cyber Vision: Utilizes Talos threat intelligence—potentially including network intrusion signatures—for visibility and threat detection in industrial control systems (ICS) environments.
• Cisco Secure Endpoint: While primarily endpoint-focused, may leverage network-level IOCs or context derived from Talos Network Intrusion Prevention findings.
• Cisco Security Cloud Control: Manages policies for devices like Cisco Firewall, which utilize Talos Network Intrusion Prevention.
• Cisco Meraki: Meraki security appliances incorporate intrusion detection and prevention capabilities powered by Talos/Snort.
• Cisco Catalyst SD-WAN: SD-WAN solutions can integrate Talos network intrusion prevention for threat protection within the WAN fabric.