Sqrrl

Sqrrl was a cybersecurity firm that specialized in threat hunting, ultimately acquired by Amazon in 2018. The company originated from technology developed for the United States National Security Agency (NSA).

Sqrrl was established in 2012 by a team that included key figures behind the creation of Apache Accumulo, a highly scalable, sorted, distributed key/value store. The founding team's deep expertise in big data infrastructure, honed within the intelligence community, was foundational to the company's technology. This background allowed them to build a platform capable of handling the massive datasets required for effective cybersecurity analysis. The company secured a total of $19.2 million in funding across three rounds from investors such as Accomplice, Matrix Partners, Rally Ventures, and Spring Lake Equity Partners.

The core of Sqrrl's business was its Threat Hunting Platform, designed for security analysts to proactively search for and neutralize advanced cyber threats within their networks. This platform integrated several key technologies. It utilized link analysis to visually map relationships and connections between different data points, helping analysts to uncover complex attack patterns. The system also incorporated User and Entity Behavior Analytics (UEBA) to model normal user behavior and detect anomalies that could indicate a malicious actor. The platform's architecture was built for multi-petabyte scalability, enabling it to process and analyze vast amounts of security data from various sources like logs, network traffic, and endpoint data. This allowed organizations to retain long-term data for comprehensive forensic investigations. The business model centered on selling this platform to enterprises and government agencies, enabling their security operations centers to move beyond reactive defense to a more proactive 'hunting' posture.

In January 2018, Amazon acquired Sqrrl, and its technology and team were integrated into Amazon Web Services (AWS). Specifically, the Sqrrl team's expertise was pivotal in the development and launch of Amazon Detective, a security service that simplifies the investigation and analysis of potential security issues within a customer's AWS environment. This acquisition provided AWS with advanced threat detection and data analysis capabilities, leveraging the core principles originally developed at Sqrrl.

Keywords: threat hunting, big data security, link analysis, UEBA, cybersecurity analytics, Apache Accumulo, security operations, threat detection, network security, data forensics