WithSecure™
Elements EDR - Endpoint Detection and Response

Broad Context Detection

O broader context de ataques direcionados torna-se imediatamente visível em uma linha do tempo com todos os anfitriões impactados, eventos relevantes e ações recomendadas.

A solução utiliza análise de comportamento em tempo real, reputacional e de grandes dados com aprendizagem de máquina para colocar automaticamente as detecções em um contexto mais amplo, incluindo níveis de risco, importância do hospedeiro afetado e o cenário de ameaça prevalecente. Leia mais de nosso whitepaper “Broad Context Detection”

Assista ao vídeo para mais detalhes

Event Search

With this built-in feature you can view, search, and explore the event data collected from your company endpoints that are related to any Broad Context Detections.

Event Search for Threat Hunting

This advanced feature is used to explore and interact with all the raw event data collected from the endpoints. Its sophisticated filtering capabilities lets your cyber security experts at SOC execute proactive threat hunting to detect and stop the most sophisticated hidden threats. Event Search for Threat Hunting is an optional component of WithSecure™ Elements Endpoint Detection and Response.

Elevate to WithSecure™

Some detections require deeper threat analysis and guidance by specialized cyber security experts. For these tough cases, the solution has a unique built-in “Elevate to WithSecure” service. It offers professional incident analysis of methods and technologies, network routes, traffic origins, and timelines of Broad Context Detection™ to provide expert advice and further response guidance whenever under attack.

Watch the video for more detail

Automated Response

Automated response actions can be used to reduce the impact of targeted cyber attacks by containing them around the clock whenever risk levels are high enough. This automation is designed specifically to support teams only available during business hours, also taking the criticality of detections into account.

Watch the video for more detail

Host isolation

Stopping breaches as early as possible is paramount, and with Host isolation, this can be achieved. When a breach is detected the host affected can be automatically or manually isolated from the network, stopping the attacker from using the host.

Meanwhile, the host can be investigated by IT Security specialists for evidence about the breach. Even if the host is otherwise isolated, it can still be centrally managed from the Management portal.

Watch the video for more detail