EINSTEIN 2

E97783

EINSTEIN 2 is a U.S. federal intrusion detection system that monitors government network traffic for known cyber threats as part of the broader EINSTEIN cybersecurity program.

All labels observed (3)

Label Occurrences
EINSTEIN 1 1
EINSTEIN 2 canonical 1
EINSTEIN 2.0 1

How this entity was disambiguated

Statements (43)

Predicate Object
instanceOf cybersecurity system
federal intrusion detection system
abbreviation E2
architectureRole sensor layer of the EINSTEIN program
associatedWith National Cybersecurity Protection System
basedOn network intrusion detection technology
country United States
dataTypeMonitored network flow data
packet header information
deploymentModel centralized monitoring at internet access points
designedFor real-time network monitoring
detects known cyber threats
malicious network traffic signatures
distinguishedFrom EINSTEIN 3 Accelerated
linked to: EINSTEIN 3
focus known threat signatures rather than zero-day attacks
followedBy EINSTEIN 3
goal early detection of cyber intrusions
improving situational awareness of federal network security
implementedBy US-CERT
United States Computer Emergency Readiness Team
monitors U.S. federal government network traffic
traffic entering federal networks
traffic leaving federal networks
operatedBy DHS Office of Cybersecurity and Communications
U.S. Department of Homeland Security
owner U.S. federal government
partOf EINSTEIN program
linked to: EINSTEIN
policyConcern privacy and civil liberties
predecessor EINSTEIN 1
linked to: EINSTEIN 2
purpose intrusion detection
monitoring known cyber threats
protecting federal civilian executive branch networks
regulatoryFramework FISMA
Federal Information Security Management Act
relatedTo CDM program
Continuous Diagnostics and Mitigation program
scope federal civilian executive branch agencies
securityDomain intrusion detection
network security
targetUser federal civilian agencies security operations centers
technologyType network perimeter monitoring system
threatIntelligenceSource US-CERT signatures and indicators of compromise
uses signature-based detection

How these facts were elicited

Referenced by (3)

Full triples — surface form annotated when it differs from this entity's canonical label.

EINSTEIN 2 predecessor EINSTEIN 1
linked to: EINSTEIN 2
EINSTEIN hasVersion EINSTEIN 2.0
linked to: EINSTEIN 2