Netskope BEAM: Open Source Detector for Supply Chain Compromise

Netskope Threat Labs introduces BEAM, an open-source tool to detect software supply chain compromises by analyzing existing HTTP/HTTPS traffic (e.g., PCAP/HAR) without endpoint agents. BEAM identifies applications via user-agent parsing and LLM assistance, enriches traffic with app context, and scores behavior using pre-trained models (XGBoost) while enabling bespoke models via unsupervised methods (TensorFlow, Isolation Forest, One-Class SVM). A demo shows BEAM flagging anomalous Box client behavior (communication to an unusual domain) with high confidence, and the project is available on GitHub for immediate use.