Описание

Proofpoint Threat Response is the threat management platform to automate incident response by surrounding security alerts with rich contextual data to create actionable intelligence, confirming system infections, and enforcing protections automatically or with the push of a button. By collecting and analyzing security event context and turning it into rapid response, the platform closes the gap between detection and protection by containing threats and preventing infections from spreading.

Key selling points

• Reduced manual collection of data from external sites
• Automated collection of IOC data from suspected systems saves time and speeds response
• Infection confirmation saves countless hours by comparing system PC data with detection forensics
• Consistent analysis insures consistent response
• Visual monitoring of incidents and processed threats
• Integrated views accelerate decisions
• Automated lifecycle management of users, hosts, IPs, and URLs on enforcement devices
• Instant audit trail of response actions boosts the ROI of existing infrastructure
• Reduces dependency on custom coded software modules
• Automatic incident creation and incident management tracking reduces manual entry requirements
• Gain up-to-the-minute reports of targeted users, systems, groups, and departments

Product features

• Infection confirmation by Automatic IOC Verification
  Threat Response collects and analyzes Indicators of Compromise (IOC) data to provide a richer snapshot of the detected threat. IOC data include a list of recent changes on the system (registry and modified files), active processes, and open network connections. This information is compared to changes reported by malware analysis systems and other events that have been received by the system to provide insight into the health of the client.
• File analysis
  Using VirusTotal, files can be checked not only once, but over time, to detect how many of 50+ anti-virus engines detect malicious signatures or properties in files dropped, downloaded, or unpacked during a potential infection. The analysis yields actionable intelligence which enables prioritization that Threat Response puts into action.
• Contain the threat
  To stop the bleeding, changes at the network level can yield immediate protection: stopping infections from spreading from one system to another; stopping control signals from reaching malware and stopping sensitive data from reaching external sites. Threat Response automates containment using your existing enforcement devices to close the gap between threat detection and protection in real-time.