The information on the anomalies view does not persist through time as Lumu’s continuous analysis may deem certain behaviors as suspicious or not using more recent information. If a potential anomaly catches your eye, it is advised to save the data for safekeeping in the way you prefer.

It's crucial to note that this isn't an operational view, but it does offer insights into your network's behavior. You can be certain that Lumu analyzes your company's network metadata on a 24/7/365 basis, providing an early advantage against adversaries attempting to gain a foothold. Rest assured, should any of these anomalies escalate into a confirmed compromise, Lumu will promptly generate an incident for your organization and trigger an automated response through your cybersecurity stack.

Here, you will find instances of suspicious network activity detected from endpoints likely employing dynamic resolution techniques like domain generation algorithms (DGAs) for malware command and control (C&C).

By clicking on each instance, you will have access to a radar chart that will give you context on the frequency of the contacts and the IP and label of the affected endpoint. You can use this information to check on the potentially affected device, ensure that everything is working as intended, and gain peace of mind for everyone involved. 

Under the radar chart, you will find a list of the Top Domains that contacted the endpoint in question, along with the number of contacts for each domain.

You will also find a summary of the contacts involved in this anomaly, including the time of the occurrence and additional details that you can gain access to in the form of a JSON file.

 

You can choose to visualize these anomalies as a graph, allowing you to see a map of the detected anomalies and their connections. This can provide you with extra insights, such as understanding how potential lateral adversary movement occurs.

For organizations with an in-house threat-hunting team, Anomalies serve as a foundation for hypothesis-driven and AI-based investigation, aligning with established methodologies for threat hunting.

For instance, if an endpoint in your network exhibits anomalies by attempting to access a suspicious domain and initiating contact with other organization endpoints, suggesting potential lateral movement, this information can aid the threat-hunting team in formulating hypotheses for potential compromise and guide the hunt for underlying threats. 

While Lumu may not have officially confirmed this anomaly as an incident, if your familiarity with the network and insights from Lumu Analytics trigger concerns, conducting tests to validate or negate the hypothesis can offer a valuable advantage against a potential, yet undetected, adversary. Alternatively, it can provide reassurance that the situation doesn't indicate a compromise 

For organizations without an in-house threat-hunting team, Lumu automates the threat-hunting process by generating an incident and triggering an automated response through the cybersecurity stack once a threat actor is detected.