Cisco Advanced Malware Protection для борьбы с вредоносным кодом
•
2 likes•1,169 views
Новое решение Cisco Advanced Malware Protection (AMP) для борьбы с вредоносным кодом
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Cisco Advanced Malware Protection для борьбы с вредоносным кодом
Similar to Cisco Advanced Malware Protection для борьбы с вредоносным кодом (20)
More from Cisco Russia
More from Cisco Russia (20)
Cisco Advanced Malware Protection для борьбы с вредоносным кодом
- 1. Cisco Advance Malware Protection Алексей Лукацкий Бизнес-консультант по безопасности 30.05.2014 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 1
- 2. Сегодняшнее Malware – это не просто программа Это криминальное предприятие, которое прячется в обычном сайте Сложно обнаружить точечными решениями © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2
- 3. Всеобъемлющая безопасность требует Защиту брешей Обнаружение брешей Общую информацию 82,000 новых угроз в день 180,000+ ежедневно экземпляров Трояны виновны в 8 из 10 инфекций в 2013 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 3 Source: http://www.pcworld.com/article/2109210/report-average-of-82-000-new-malware-threats-per-day-in-2013.html
- 4. У нас есть самый лучший инструмент для защиты I00I III0I III00II 0II00II I0I000 0110 00 Коллективная информация 10I000 0II0 00 0III000 II1010011 101 1100001 110 100I II0I III00II 0II00II I0I000 0II0 00 Sourcefire VRT® (Vulnerability Research Team) 1100001110001III0 I00I II0I III00II 0II00II 101000 0110 00 110000III000III0 I00I II0I III0011 0110011 101000 0110 00 101000 0II0 00 0III000 III0I00II II II0000I II0 180,000+ примеров файлов в день FireAMP™ Community, 3+ млн Advanced Microsoft и Industry Disclosures Snort и ClamAV Open Source Communities Honeypots Sourcefire AEGIS™ Program Частные и открытыеThreat Feeds Динаминческий анализ безопасности Cisco Обновления каждые 3-5 мин Cisco® SIO WWW Email Endpoints Web Networks IPS Devices 1.6 млн сенсоров 100 TB данных в день 150 million+ конечных точек 600+ инженеров, техников и исследователей 35% мирового почтового трафика 13 млрд web запросов 24x7x365 операций 40+ языков © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 4
- 5. Cisco AMP предоставляет три выгоды 3 Адресует весь континуум атак Перед Во время После 2 Более полная защита Контент Сеть Endpoint Точечное обнаружение Ретроспективная безопасность Cisco Collective Security Intelligence 1 Лучший подход © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5
- 6. Cisco AMP предоставляет лучший подход Точечное обнаружение Ретроспективная безопасность Репутация и поведенческий анализ Постоянная защита Уникальный Cisco AMP © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 6
- 7. Cisco AMP защищает с помощью репутационной фильтрации и поведенческого анализа Point-in-Time Protection Continuous Protection Репутационная фильтрация Поведенческий анализ Cisco Collective Security Intelligence File Reputation & Behavioral Detection Unique to Cisco AMP Retrospective Security Динамический анализ Машинное обучение Нечеткие отпечатки Продвинутая аналитика Точная сигнатура Индикаторы компрометации Корреляция потоков © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 7
- 8. Репутационная фильтрация построена на трех функциях Reputation Filtering Behavioral Detection Dynamic Analysis Анализ и отправка в облако неизвестной сигнатуры 1 Сигнатура неизвестна и файл разрешен 2 Сигнатура неизвестна и отправляется в облако 3 Сигнатура известна и заблокирована 4 Machine Learning Fuzzy Finger-printing Collective Security Intelligence Cloud Advanced Analytics One-to-One Signature Indications of Compromise Device Flow Correlation © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 8
- 9. Репутационная фильтрация построена на трех функциях Collective Security Intelligence Cloud Dynamic Analysis Отпечаток файла распознан и заблокирован 1 Доступ вредоносному файлу запрещен 2 Полиморфная форма того же файла пытается попасть в систему 3 Сравниваются отпечатки двух файлов и обнаруживается похожесть Полиморфному отпечатку запрещен доступ в систему 5 Machine Learning Fuzzy Finger-printing Advanced Analytics One-to-One Signature Indications of Compromise Device Flow Correlation 4 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 9
- 10. Репутационная фильтрация построена на трех функциях Меттаданные неизвестного файла отправляются для анализа 1 Метаданные распознаны как возможный malware 2 Файл сравнивается с известным malware и подтверждается как malware Вторые неизвестные метаданные отправляются в облако 4 Метаданные похожи на известный хороший файл, возможно, что все чисто Файл сравнивается с известным чистым файлом и подтвержден, как чистый Dynamic Analysis Machine Learning Fuzzy Finger-printing Advanced Analytics One-to-One Signature Indications 3 5 6 of Compromise Collective Security Intelligence Cloud Machine Learning Decision Tree Possible malware Device Flow Correlation Possible clean file Confirmed malware Confirmed clean file Confirmed malware Confirmed clean file © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 10
- 11. Поведенческий анализ использует четыре функции Анализ неизвестного файла. Найдены следы дублирования 1 Эти следы дублирования отправляются в облако 2 Неизвестный файл имеет следы системы передачи 3 4 Они тоже отправляются в облако Действия показывают, что файл – это, возможно, malware 5 Dynamic Analysis Machine Learning Fuzzy Finger-printing Advanced Analytics Indications of Compromise Device Flow Correlation Collective Security Intelligence Cloud © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 11
- 12. Поведенческий анализ использует четыре функции Dynamic Analysis Machine Learning Неизвестный файл отправляется в облако, где выполняется в «песочнице» Два файла – malware, один -- чистый 2 Вредоносные сигнатуры загружаются в облако и отправляются всем пользователям Advanced Analytics Indications of Compromise Device Flow Correlation 1 3 Collective Security Intelligence Cloud Collective User Base © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 12
- 13. Поведенческий анализ использует четыре функции Dynamic Analysis Advanced Analytics Indications Compromise Получает информацию о неидентифицированном ПО 1 Collective Security Intelligence Cloud Получает контекст из Collective User base 2 Collective Анализ файла 3 исходя из контекста Идентифицирует файл как malware 4 Device Flow Correlation User Base © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 13
- 14. Поведенческий анализ использует четыре функции Dynamic Analysis Advanced Analytics Device Flow Correlation Collective Security Intelligence Cloud Корреляция потоков следит за IP: 64.233.160.0 потоками стройств 1 Два неизвестных файла связываются с одним IP, один отправляет, а второй получает информацию 2 Один отправляет данные наружу сети, другой получает данные 3 Коллективная безопасность распознает IP как вредоносный 4 Неизвестные файлы записываются как malware 5 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 14
- 15. Cisco AMP предоставляет лучший подход Точечное обнаружение Ретроспективная безопасность Репутация и поведенческий анализ Постоянная защита Уникальный Cisco AMP © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 15
- 16. Cisco AMP защищает с помощью ретроспективной безопасности © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 16
- 17. Зачем нужна постоянная защита Breadth and Control points: Continuous feed IPS Devices 1000111010011101 1100001110001110 1001 1101 1110011 0110011 101000 0110 00 0001110 1001 1101 1110011 0110011 101000 0110 00 0111000 111010011 101 1100001 110 WWW Email Endpoints Web Network Поток телеметрии Отпечатки и метаданные Ввод-вывод файл и сеть 0100001100001 1100 0111010011101 1100001110001110 1001 1101 1110011 0110011 101000 0110 00 Информация о процессе Постоянный анализ © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 17
- 18. Зачем нужна постоянная защита Who What Where When How Event History Collective Security Intelligence Контекст Применение Постоянная защита © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 18
- 19. Cisco AMP защита с помощью ретроспективной безопасности Поведенческий Траектория анализ компрометации Охота на бреши Ретроспектива Составление Attack Chain © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 19
- 20. Ретроспективная безопасность построена на… Behavioral Trajectory Indications Анализ, когда мы впервые увидели файл 1 of Compromise Breach Hunting Retrospection Attack Chain Weaving Постоянный анализ файла для проверки диспозиции 2 Непревзойденный обзор пути, действий и связей ПО или его части 3 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 20
- 21. Ретроспективная безопасность построена на… Ретроспективные возможности с помощью: File Retrospection records the trajectory of the software from device to device 1 File Retrospection 2 Process Retrospection 3 Ретроспектива связей Process Ретроспектива Retrospection связей monitors Какое приложение the I/O activity выполняет of all devices действия on the system Составление Attack Chain Анализ данных, собранных процессами File, Process and Communication Retrospection для предоставления нового уровня информации Behavioral Trajectory Indications of Compromise Breach Hunting Retrospection Attack Chain Weaving © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 21
- 22. Ретроспективная безопасность построена на… Поведенческие индикаторы компрометации использует рестроспективу для проверки систем на подозрительную Неизвестный файл приходит в сеть Behavioral Trajectory Indications of Compromise Breach Hunting Retrospection Attack Chain Weaving активность 1 Копируется на много машин 2 Дублирует контент с жесткого диска 3 Отправляет контент на внешний IP 4 Используя мощь Составления Attack Chain, AMP может распознать шаблоны и активность файла и определить действия просмотрев среду вместо сигнатуры или отпечатка © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 22
- 23. Ретроспективная безопасность построена на… Неизвестный файл загружается на устройство 1 Определяется отпечаток и отправляется в облако 2 3 4 Behavioral Trajectory Indications of Compromise Неизвестный файл переходит от устройства к устройству Траектория автоматически пишет время, метод, точка входа, влияние на системы и распространенность файла Аналитика определяет, что файл вредоносный и уведомляет все устройства Breach Hunting Attack Chain Weaving Траектория позволяет определить распространение инфекции 5 Collective Security Intelligence Cloud Mobile Mobile Computer Network Virtual Machine Mobile Computer Mobile Virtual Machine © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 23
- 24. Ретроспективная безопасность построена на… Behavioral Trajectory Indications Compromise Breach Hunting Drive #1 Drive #2 Drive #3 Computer Неизвестныей файл попадает на устройство 1 Файл перемещается по устройству, выполняя разные операции 2 В то же время траектория пишет действия и причины действий для файлов на машине 3 Данные позволяет найти корень инфекции 4 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 24
- 25. Ретроспективная безопасность построена на… Behavioral Trajectory Indications Compromise Breach Hunting Охота на бреши – это возможность использовать индикаторы, генерируемые поведенческим IoC для отслеживания определнного поведения в среде 1 После идентификации поведенческого IoC ищется дополнительное сходство где-нибудь еще 2 Эта функциональность позволяет быстро искать профиль поведения, а не отпечатки и обнаружить файлы, которые вредоносные и неизвестные 3 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 25
- 26. Cisco AMP предоставляет три выгоды 3 Адресует весь континуум атак Перед Во время После 2 Более полная защита Контент Сеть Endpoint Точечное обнаружение Ретроспективная безопасность Cisco Collective Security Intelligence 1 Лучший подход © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 26
- 27. Полная защита среды с помощью AMP Cisco Advanced Malware Protection AMP Защита Вектор угроз Email и Web Сети Устройства Метод Идеально для Контент Лицензия для ESA и WSA New or existing Cisco Email or Web Security customers Сеть Отдельное решение -или - Включите AMP на FirePOWER устройствах IPS/NGFW заказчики Хост Установка на устройства Windows, Mac, Android, VMs © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 27
- 28. Понимание разных платформ • Обнаружение и блокирование malware, проходящего через email или web трафик • Receive полные отчеты, URL/Message tracking и коррекцию • Add-on на устройства AMP Для контента • Идентификация точки входа, распространение, протокол, пользователей и хост • Полная картина вредоносной активности в сети • Контроль в сети устройств BYOD AMP Для сетей • Найти инфекцию, проследить путь, проверить поведение • Быстро избежать повреждений и риска повторной инфекции • Найти индикаторы компрометации на уровне сети и узлоа AMP Для Endpoint © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 28
- 29. Защита сетей • Сетевая платформа использует индикаторы компрометации, анализ файла и в этом примере траекторию файла для того, чтобы показать, как вредоносный файл перемещается сети Сеть Endpoint Контент © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 29
- 30. Защита Endpoints • Платформа показывает траекторию, гибкий поиск и контроль атак. В это примере malware отправлен в карантин. Сеть Endpoint Контент © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 30
- 31. Защита Web и Email • AMP для контент защищает от Web и Email угроз в том числе и с помощью ретроспективных предупреждений, когда malware обнаружено. Network Endpoint Content © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 31
- 32. Полная защита среды с AMP Каждая опция развертывания предлагает полную защиту в рамках одного вектора угрозы Адресует вектор угроз Так как инфекция распространяется, защита по одному или двум векторам может оаказаться недостаточной Предотвращает заражение Развертывание AMP для Content, Network и Endpoint вместе – это наиоболее оптимальная опция для полной защиты, карантина и коррекцииn Работает вместе © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 32
- 33. Cisco AMP предоставляет три выгоды 3 Адресует весь континуум атак Перед Во время После 2 Более полная защита Контент Сеть Endpoint Точечное обнаружение Ретроспективная безопасность Cisco Collective Security Intelligence 1 Лучший подход © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 33
- 34. Начните сейчас 1 2 3 4 5 Определите, хотите ли Вы использовать возможности PoV (Proof of Value) Определите временной диапазон и значение для POV Определите требования к HW и SW Определитесь с длительностью PoV Назначьте встречу © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 34
- 35. Thank You © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 35
- 36. How Cisco AMP Works: Network File Trajectory Use Case © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 36
- 37. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 37
- 38. An unknown file is present on IP: 10.4.10.183, having been downloaded from Firefox © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 38
- 39. At 10:57, the unknown file is from IP 10.4.10.183 to IP: 10.5.11.8 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 39
- 40. Seven hours later the file is then transferred to a third device (10.3.4.51) using an SMB application © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 40
- 41. The file is copied yet again onto a fourth device (10.5.60.66) through the same SMB application a half hour later © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 41
- 42. The Cisco Collective Security Intelligence Cloud has learned this file is malicious and a retrospective event is raised for all four devices immediately. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 42
- 43. At the same time, a device with the FireAMP endpoint connector reacts to the retrospective event and immediately stops and quarantines the newly detected malware © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 43
- 44. 8 hours after the first attack, the Malware tries to re-enter the system through the original point of entry but is recognized and blocked. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 44
Editor's Notes
- My name is <your name> and I’m with Cisco. I’ve been here __ years. Thanks for taking the time to meet with me about Advanced Malware Protection <click>
- When it comes to today’s threats, technology addresses malware as a single detectable entity. But in reality, today’s advanced malware is a criminal enterprise built on multiple pieces of software coordinating and working together. The real problem is the multiple pieces of malware, and their relationships, are often hidden amongst all the file analysis and file detection that is going on point-in-time. The real relationships that exist in these entities get lost in the noise of network traffic and can be easily missed by conventional point-in-time methods. <click>
- Comprehensive security requires three things, 1) Breach Protection, 2) Breach Detection and 3) Collective Intelligence. <click> First, we have to be able to stop the bad things we know about from getting into your environment. It’s a first line of defense and it’s the cornerstone of traditional security. <click> We also have to be able to find and fix the problems we already recognize and know how to remediate. We all know that detection isn’t 100% effective, there will always be infections. Because of this we have to have a method for detecting the things that get through point-in-time defense. <click> Finally, and most crucial for today’s advanced malware, comprehensive security must be able to find active compromises going on that are not known to be malware and would not be recognized by point in time engines. We must have the ability to find the things we don’t know about, even though they are already in our systems and we don’t know how to look for them. <click>
- In order to deliver against these three requirements effectively, it requires cloud back-heavy lifting. There are multiple inputs that you’ll need to process in order to get the kind of intelligence and insight you need to deliver security effectively, for both point-in-time AND continuous monitoring capabilities. Notice that this slide looks familiar from other vendors, but the numbers behind it are what allow Cisco to truly deliver this kind of protection. Cisco is processing 35% of the world’s email traffic. With millions of sensors giving us input, we are able to mine that data for insight into vendor relationships and run reputations against it. Combine that with intelligence from the Vulnerability Research Team, which is constantly being built by their relationships with all the big vendors – Microsoft, Adobe, and Apple, and consists of nearly 200,000 unique files that are processed and executed virtually every single day, to discover artifacts or indications of compromise that would otherwise go undetected. The global network of honeypots and more, and the kind of intelligence that feeds through our research team, allows you to gain the capabilities that only we can deliver with continuous monitoring. It’s all delivered through our cloud platform, call it the Collective Security Intelligence, which allows you to take advantage of IPS rule, firewall category, and all the other advanced analytics that we can push out across the protection continuum. <click>
- 5
- There are two types of protection that are essential for complete security: point-in-time and retrospection. The truth is you NEED both. <click> Consider point-in-time plan A. You’re going to spend time up front, targeting the assets of your environment and quantifying your areas of weakness. You’ll use tools like vulnerability assessment and management tools, you’ll use patch management, VPN firewalls, things like that. Even IPS, those are tools that you use for the point-in-time detection piece. Our point-in-time detection lattice is built on 7 features, providing both file reputation and behavioral detection. Lets take a look at each of these seven features. <click>
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- There are two types of protection that are essential for complete security: point-in-time and retrospection. The truth is you NEED both. <click> Consider point-in-time plan A. You’re going to spend time up front, targeting the assets of your environment and quantifying your areas of weakness. You’ll use tools like vulnerability assessment and management tools, you’ll use patch management, VPN firewalls, things like that. Even IPS, those are tools that you use for the point-in-time detection piece. Our point-in-time detection lattice is built on 7 features, providing both file reputation and behavioral detection. Lets take a look at each of these seven features. <click>
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- Building on the level of scope provided by file trajectory, Device Trajectory provides robust time window analysis into system processes to understand root cause history and lineage with the ability to expand or contract the time window and filter to quickly pinpoint the exact cause of compromise. In the animation: The unknown file is transferred to this particular device <click> The files move around, executing different commands on the device <click> Device Trajectory records those individual actions executed by that file on that particular device <click> That data is leveraged to trace back the root of the infection and contribute to profiling different malware signatures <click>
- 25
- 26
- Cisco’s Advanced Malware Protection solutions utilize big data analytics to continuously aggregate data and events across the extended network - networks, endpoints, mobile devices and virtual environments - to deliver visibility and control against malware and persistent threats across the full attack continuum – before, during and after an attack. We leverage continuous analysis, and real-time security intelligence to deliver detection, tracking, analysis, and remediation to protect the enterprise against malware and targeted, persistent attacks: As you may be familiar, we offer Advanced Malware Protection for Content, Networks and Endpoints: Cisco’s AMP can be easily added on to existing web and email security appliances with the flip of a switch to give you retrospective security on your gateway Cisco’s Advanced Malware Protection for FirePOWER can be an integrated software-enabled subscription added to any FirePOWER NGIPS or NGFW appliance or as a dedicated Advanced Malware Protection Appliance. FireAMP offers Advanced Malware Protection for Endpoints, using the same big data analytics, protecting against malware for Windows-based systems, mobile devices in both physical and virtual environments. <click> IF MORE DETAIL NEEDED: AMP for FirePOWER: Detection and blocking of malware infected files attempting to enter or traverse the network Continuous analysis and subsequent retrospective alerting of infected files in the event malware determination changes after initial analysis Tracking of malware that has entered the network; identifying point of entry, propagation, protocols used, users and host affected Correlation of malware related events with broader security events and contextual data to provide comprehensive picture of malicious activity Identification and control of BYOD devices on the network FireAMP Malware blocking and continuous analysis Defend endpoints and remote workers against sophisticated malware – from the point of entry through propagation, to post-infection remediation Detection & blocking of malware, confirmation of infection, trace its path, analyze its behavior, remediate its targets and report on its impact Tracking malware proliferation and activity Indications of compromise Root cause analysis Outbreak control Impact reporting
- Each platform has slightly different functionality. AMP for Content gives you the ability to: Detect and block malware attempting to enter through email or web gateways Receive extensive reporting, URL/Message tracking and remediation prioritization Easily add-on to an existing appliance or in the cloud AMP for Network lets you: Identify point of entry, propagation, protocols used, users and host affected Receive a comprehensive picture of malicious activity with contextual data Control of BYOD devices on the network AMP for Endpoint enables you to: Find an infection, trace its path, analyze its behavior Mitigate damage quickly and eliminate of the risk of reinfection Locate indications of compromise at both the network and system level <click>
- In this screenshot you can see an example of the detailed reporting provided by AMP for Networks. The Network platform uses indications of compromise, file analysis, and in this example, file trajectory to show how files move across systems to help in remediation. <click> This screenshot is from a Use Case that can be covered later in the deck.
- In this screenshot you can see an example of the detailed reporting provided by AMP for Endpoint. The Endpoint platform has device trajectory, elastic search and outbreak control which in this example, is shown quarantining recently detected malware on a device that has the FireAMP connector installed. <click> This screenshot is from a Use Case that can be covered later in the deck.
- In this screenshot you can see an example of the reporting provided by AMP for Content which protects against web and email threats by issuing retrospective alerts known malware or websites where malicious reputations are detected. <click>
- Each deployment option offers extensive protection across its particular threat vector but since infections are designed to spread, protecting against one or two attack vectors is insufficient for today’s threats. Deploying AMP across Content, Network and Endpoint is the best available means of complete environment protection, quarantine and remediation <click>
- 33
- <click>
- This use case gives a great view of a file being introduced, retrospective events occurring, quarantining, and future events being blocked. This is a great illustration of the correlation between end-point and network data. <click>
- This is the actual program view, showing the path of a file across multiple devices. By hovering over an event you can see details like where the file came from originally, when was it downloaded, what type of even it is, the program name. All this information is just a mouse hover away. <click>
- Here we see the first event, a file with an unknown disposition is present on IP: 10.4.10.183 <click>
- It enters the network by being transmitted from 10.4.10.183 to 10.5.11.8 and the file still has a disposition of unknown. We did not know it was bad. But we do know that it was introduced by a user using downloading this file over HTTP using the application Firefox a web-browser. That file then sat on 10.5.11.8. <click>
- After a period of inactivity, the file transmits down to machine 10.3.4.51 over SMB, the application protocol listed in the grey box. So it starts transmitting using internal Microsoft file-sharing protocols. This file has not yet been identified as malware and so its disposition is still unknown. <click>
- The file copies itself onto a fourth machine a half hour later using the same application protocol. <click>
- At 6:14, We see a retrospective event turn up. So it appears for 4 machines at the same time. Our disposition thus far has gone from something we think is unknown to now known malware. So we've alerted each of these four machines and the defense center, that malware has been found in the environment to enable the user to track how that file propagated the around the network and understand the scope of the breech. <click>
- This machine here, 10.5.11.8, we can see that it has the fire app, endpoint connector installed. We know this because immediately after that retrospective event was raised the endpoint quarantined file. So by having the connector on the endpoint you have the ability to clear up and remediate and quarantine that infection on the end-point near in real time <click>
- Later the file once again tried to move around the network. This time once again, by someone trying to send the file over HTTP using the application Firefox. This time, because the file is now known to be malware, this transmission was blocked. <click>