Snippet 3: Bastille Integrations

A look at Bastille’s integration with Cisco SecureX and other security platforms. Investigators pivoting on a device in SecureX can jump into Bastille to see where that device has physically been, its location heat map, and its facility timeline, then pull that RF context back into SecureX for cross-correlation.

Key Takeaways

• Bastille integrates with Cisco SecureX so investigators can add RF context to a device under investigation
• The wired and Wi-Fi views differ: Bastille supplies the wireless-side visibility the Ethernet view lacks
• Operators can see a device’s historical locations, heat map, and facility timeline from within the security console
• Similar integrations exist for Demisto, Phantom, Splunk, and Kibana, so RF data flows into the wider security stack

Video Transcript

Let me show you another integration we have with Cisco's SecureX stack. So this is a threat hunting tool that is marketed as a single pane of glass to take all your cybersecurity information and put it together. So it's a Cisco product, but we've got a Bastille integration into it. So the workflow is an investigator, may want to investigate a certain IP address. And so they click on. They'd search for that in this SecureX product. And what we've got here, though, is a Bastille integration.

So you'll see in a second, as I click on that endpoint and I look at the various interfaces of that endpoint, the Ethernet Interface still doesn't see. But for the Wi-Fi Interface, Bastille does see that interface. And so we can click this context menu and get over to Bastille and see historically where this device has been, which network is connected to, where it's been in the zone. We can see the Bastille device dashboard of a heat map of this device's location. We can see a timeline of when it's been in the facility.

And then finally, we can click this Investigate. And now Cisco is communicating with Bastille's APIs to pull all of the scene information from this device that Bastille knows about into SecureX, where it can be cross-correlated. So we have the same sorts of integrations with systems like-- source systems like Demisto and Phantom, SIEM systems like Splunk and Kibana. So I think it's really important to emphasize, security is a team sport, so you got to make sure all of your security stack communicates with each other.

And that's one of the things we really focus on at Bastille is not just providing you the best RF visibility, but also making sure you can get that RF data into your other systems.