Athena XDR collects data from both Sangfor’s native devices and a wide range of third-party sources. It includes hundreds of built-in rules for parsing logs from known third-party devices and uses GenAI and machine learning to intelligently standardize logs from unknown sources.

Once standardized, the data is processed through Athena XDR’s detection rules and engines for correlation analysis and advanced threat detection. All logs are accessible in the log center to support regulatory compliance.

Athena XDR leverages three-layers of threat detection capabilities.

The first layer uses rule matching, threat intelligence, IOAs and IOCs (including custom rules), and detection engines to identify suspicious or malicious activity.

The second layer applies correlation analysis across multiple data sources, assessing attack outcomes and classifications to generate clearer, more actionable alerts.

The third layer leverages AI—such as attack chain analysis, graph computation, and behavioral analysis—to consolidate alerts into a smaller number of high-confidence security events.

This multi-layered detection significantly improves accuracy and reduces alert noise, allowing users to focus on high-risk threats.

When investigating an incident, analysts need to validate the threat, understand the attack path, and assess its impact. Athena XDR simplifies this process by visually mapping correlated evidence into an attack chain for clear, intuitive analysis.

Analysts can trace the attacker’s movements, from initial intrusion to lateral movement, and actions taken on compromised hosts. Each alert includes detailed forensic data to support accurate threat analysis.

For long-dwelling threats like APTs, Athena XDR uses machine learning and graph-based analytics to continuously correlate alerts over time, building a complete picture of the incident. This intelligent processing helps analysts recognize potential attack patterns in real time and respond with greater speed and confidence.

Athena XDR features the innovative Operations GPT—a 24/7 virtual security assistant that automatically analyzes alerts and incidents detected by the system. It begins by determining whether alerts are false positives, then provides clear, natural-language explanations of legitimate threats.

It also performs automated forensic analysis to check if similar alerts have occurred across other assets or if the affected host has experienced related incidents over time.

Finally, it delivers expert-level recommendations to the SOC team for remediation and response. By simulating the work of experienced analysts, Operations GPT reduces workload and skill demands, boosting operational efficiency.

Athena XDR uses GenAI to automatically trace security incidents back to their root causes, visually presenting key forensic evidence such as malicious file executions, command-line scripts, and C&C domain names.

From these findings, it proactively hunts for related threats—identifying other potentially compromised assets linked to the same malicious entities.

This automated process replicates tasks typically performed by L3 security analysts, allowing organizations to investigate and hunt threats with minimal manual effort. As a result, SOC teams can save up to 80% of their time and resolve incidents in minutes.

Athena XDR features built-in Security Orchestration, Automation, and Response (SOAR) functionality that allows organizations to respond swiftly and effectively to complex attacks. It support flexible integration with a wide range of security tools, including Sangfor products and third-party solutions like EDRs, firewalls, NAC, threat intelligence platforms, email gateways, and instant messaging apps. Its modular application package (APP) design also allows for rapid integration with additional devices, expanding its automation reach.

With over 30 pre-built playbooks addressing common threat scenarios, organizations can automate responses right out of the box. Users can also create custom playbooks using an intuitive drag-and-drop interface, making advanced security automation both accessible and highly effective.