Comprehensive software reviews to make better IT decisions

An Evaluation of Gurucul's Identity Security Analytics Platform

Source: Gurucu, Analyst Briefing Deck, Published 2024

Gurucul was established in 2010, with its inception deeply rooted in identity security analytics. From the outset, Gurucul positioned itself as a pioneer in what would later be known as user and entity behavior analytics (UEBA), an evolution of user behavior analytics (UBA). While UBA only tracks end-user behavior patterns, UEBA also monitors nonuser entities, such as service accounts, servers, routers, and Internet of Things (IoT) devices, for anomalous behavior or suspicious activity that might indicate security threats or attacks. This early focus allowed Gurucul to develop specialized solutions for identity-related security challenges long before those solutions became industry standards.

Focus on Access and Activity

Gurucul's REVEAL platform emphasizes the critical interconnection between access rights and activity logs to evaluate user risks and threats. By examining the aggregate of accounts linked to each user and scrutinizing their activities, Gurucul provides a holistic view of user behavior. This approach integrates identity data with security analytics, enabling organizations to understand potential risks by seeing how identities interact with various systems and data.

For example, Gurucul can provide IP telemetry that includes:

• Geolocation data, including longitude, latitude, city, and country.
• ISP-level information.
• Detection of rare cloud ISPs and patterns of sign-in attempts from unusual locations.

This telemetry helps in identifying suspicious activities and potential breaches by analyzing the IP data in detail.

Source: Gurucul, Product Demo, 2024

Risk Scoring Mechanism

At the core of Gurucul's security analytics is its risk scoring system, which assigns a risk score ranging from 1 to 100 to each monitored identity. The Gurucul risk engine calculates this score using real-time machine learning algorithms that consider multiple contexts like user behavior deviations, access patterns, locations, and devices. This nuanced scoring helps identify identities that might pose a security threat based on activities and unusual behavior.

Gurucul extends its analytics by incorporating people analytics into risk profile scoring. This involves looking at HR-related events and external factors such as personal life changes or financial status, which could influence an individual's behavior. By considering these elements, Gurucul's system can provide a more layered risk assessment, potentially predicting behaviors that might lead to insider risk.

To share a common use case, Gurucul can feed risk scores to Okta workflows (or other identity systems) to take specific actions based on the risk score. This integration allows for dynamic risk-based policies in Okta. For example, if a user's risk score exceeds a certain threshold, Okta can enforce multifactor authentication (MFA) or disable the user's account. This can be done either manually by triggering a playbook or automatically through predefined playbook triggers.

Source: Gurucul, Product Demo, 2024

Real-Time Protection vs. Detective Control

REVEAL is designed for real-time protection rather than merely being a detective control. It can respond immediately to detected threats, employing its security orchestration, automation, and response (SOAR) capabilities. Moreover, its integration isn't limited to Microsoft's ecosystem; it works with a broad spectrum of identity infrastructures including cloud applications, SaaS, Linux, and traditional systems like Active Directory or EntraID.

The items in the dashboard are clickable. The user experience is designed to be intuitive, allowing users to drill down into details by clicking on specific elements. For example, clicking on a user flagged for a high-risk score will provide more detailed information about the anomalies associated with that user. The dashboard is customizable, enabling users to create and modify widgets and dashboards according to their needs.

Source: Gurucul, Product Demo, 2024

Connectors and Multicloud Support

The platform boasts hundreds of out-of-the-box connectors for seamless integration with diverse identity systems. Furthermore, Gurucul supports multicloud environments, enabling deployment across services like AWS, Azure, and Google Cloud and ensuring comprehensive coverage for organizations with varied IT architectures.

There are more than 450 different integrations with various vendor products. To ingest the data and make it actionable, Gurucul typically uses cloud-to-cloud, API-based integrations for SaaS platforms and can also accept data from on-premises systems. This allows them to pull in data from various sources, such as email platforms (e.g. Outlook, Proofpoint), identity systems (e.g. EntraID, Ping), and other security tools, which are then analyzed and contextualized to provide actionable insights.

Gurucul handles custom integrations by enabling customers to build their own ad hoc integrations or by developing these integrations itself, typically within 48 hours. This flexibility is due to Gurucul’s intelligent data fabric, which allows for quick and efficient integration development.

Source: Gurucul, Product Demo, 2024

Solving Identity Management Challenges

Gurucul's identity analytics platform addresses the fragmentation in identity management by unifying identity governance, access management, and privileged access across different environments. This holistic approach helps mitigate the complexities of managing identities in modern, distributed IT systems, enhancing security through better visibility and control.

The primary goal of Gurucul's identity analytics is to preemptively identify risks and threats, offer actionable insights, and facilitate proactive security measures. By weaving together various identity contexts, Gurucul aims to prevent security breaches and ensure that identities are managed with both security and efficiency in mind.

Source: Gurucul, Product Demo, 2024

Enhanced Access Certification

Gurucul enriches the access certification process by providing contextual data, which helps managers make informed decisions rather than rubber-stamp access requests indiscriminately. To prevent rubber-stamping by reviewers, Gurucul provides the following features:

• Risk-Based Campaigns: Gurucul encourages the use of risk-based campaigns to focus reviewers' attention on high-risk entitlements, reducing the number of items in need of manual review. This approach helps highlight the most critical access that requires human attention.
• Autocertification: Low-risk entitlements can be autocertified based on predefined thresholds, allowing reviewers to concentrate on high-risk items. This significantly reduces the workload and ensures that only the most important entitlements are reviewed manually.
• Detailed Metadata: Gurucul provides detailed metadata, including entitlement descriptions and the last certification action, to give reviewers more context about each entitlement. This additional information helps reviewers make informed decisions rather than rubber-stamp access requests.

In addition, the platform monitors privileged access by identifying and responding to unusual activity patterns. For example, if a user with high-level access interacts with systems in an atypical manner, Gurucul can trigger notifications or workflows to verify the legitimacy of such actions.

Source: Gurucul, Analyst Briefing Deck, 2024

Modular Architecture

REVEAL offers a modular product structure, where organizations can select specific functionalities like access certification, identity threat detection and response (ITDR), or UEBA based on their needs. This modularity ensures that the platform can be tailored to fit into existing security frameworks without unnecessary complexity.

The platform and different functionalities can be activated based on SKU and licensing. The underlying architecture remains the same, and the data resides in a unified data lake where analytics are run. The specific functionalities and modules, such as ITDR, can be controlled and activated as part of the licensing.

Gurucul can be deployed either on-premises or in cloud environments, supporting multicloud scenarios with full feature parity. This flexibility is crucial for businesses undergoing changes like mergers or acquisitions, where integrating diverse IT systems is often a challenge.

Return on Investment (ROI)

The ROI for implementing Gurucul's solutions can be significant:

• Speed of Deployment: A proof of concept can be established in roughly four weeks, with live deployment shortly thereafter.
• Immediate Value: Organizations might see benefits within the first quarter post-implementation, based on the deployment of specific use cases.
• Efficiency and Cost Reduction: The platform helps reduce time spent on certification, managing privileged access more effectively, and identifying unused access for cost savings.

Source: Gurucul, Analyst Briefing Deck, 2024

Our Take

Gurucul’s REVEAL platform stands out as a modular identity security analytics platform primarily focused on ITDR. It provides a unified approach to threat detection, investigation, and response, integrating various modules, like identity and access analytics, into one cohesive system. This modularity allows for the activation of different functionalities based on licensing, ensuring that organizations can scale and customize their security solutions without disrupting their business. Unlike competitors such as CrowdStrike, which have limited scope and focus mainly on on-premises Windows Active Directory, Gurucul extends its reach to include Linux and other identity providers like EntraID, Ping Identity, and various MFA solutions, offering broader and more comprehensive coverage of identity threats. Moreover, Gurucul's dashboard provides an immediate overview of identity monitoring, reducing alert fatigue through a risk-based prioritization system that automatically escalates high-risk alerts for immediate analyst attention.

The platform's integration capabilities are extensive, supporting over 450 different connectors to ingest and analyze data from diverse sources, making this information actionable through cloud-to-cloud APIs or on-premises data collection. Gurucul recommends integration with systems like email platforms, identity systems, and MFA solutions to enhance security measures. It also offers detailed IP telemetry for spotting unusual activities by location and ISP and supports action orchestration, such as challenging users with MFA or disabling accounts based on risk insights. Beyond ITDR, Gurucul aids in identity lifecycle management by integrating with IGA solutions like SailPoint, while also providing its own access certification interface to enhance review processes. This interface offers contextual data to prevent automatic, uninformed approvals, fostering more strategic decision-making in access management.

Want to Know More?

Develop a Comprehensive IAM Improvement Strategy | Info-Tech Research Group

Best Identity Threat Detection and Response (ITDR) SoftwareReviews