Endpoint protection platforms (EPPs) have evolved beyond traditional antivirus software to offer advanced threat detection and response capabilities. Many EPPs also offer threat-hunting or SOC services to provide organizations with real-time visibility into security incidents and remediation recommendations.
Among the EPP providers that offer these services are the following, and, obviously, this is just a sample but, hopefully, also a good start:
CrowdStrike Falcon Complete
Kaspersky Endpoint Security has an Endpoint Detection and Response
McAfee (Trellix) Endpoint Security Managed Detection and Response (MDR)
Palo Alto Networks Unit 42 MDR Service for Cortex XDR
Symantec (Broadcom) Endpoint Protection Managed Endpoint Detection and Response
Trend Micro Apex One Managed XDR
VMware Carbon Black MRDR
Sophos MDR is interesting in that it leverages other providers' cybersecurity technologies including telemetry from AWS, Check Point, CrowdStrike, Darktrace, Fortinet, PAN, and others.
Yes, there are endpoint protection platforms that offer threat-hunting or SOC (Security Operations Center) services, and Custodian360 is one of them.
Endpoint protection platforms (EPPs) are security solutions that are installed on endpoint devices to detect, prevent, and respond to cyber threats. Threat-hunting is a proactive approach to cybersecurity that involves actively searching for threats and vulnerabilities that might have evaded traditional security measures. SOC services involve monitoring and analysing security events to identify and respond to security incidents.
Custodian360 is a comprehensive endpoint protection platform that offers both threat-hunting and SOC services. It uses a combination of signature-based and behavior-based detection to detect and respond to cyber threats in real-time. The platform has a built-in threat-hunting engine that continuously scans endpoints for signs of compromise, and it also has a team of expert analysts who perform manual threat-hunting to identify and respond to advanced threats.
Custodian360's SOC services include 24/7 monitoring and analysis of security events, incident response, and forensic investigation. The platform also provides detailed reporting and analytics to help organisations understand their security posture and identify areas for improvement.
In summary, Custodian360 is an endpoint protection platform that offers threat-hunting and SOC services, making it an ideal solution for organisations that want comprehensive protection against cyber threats.
There are several endpoint protection solutions available that can provide protection for endpoints running on Linux, Windows, and MacOS. Among them are Symantec (Broadcom) Endpoint Protection, Trend Micro Apex One, McAfee (Trellix) Endpoint Security, Kaspersky Endpoint Security for Business, ESET Endpoint Security, Palo Alto Networks Cortex XDR and, perhaps surprisingly (but then again, not) Microsoft Defender for Endpoint. (This is not an exhaustive list).
However, the devil is in the details regarding which versions of an OS and what kind of hardware requirements a given solution supports. You need to closely check the specifics of the range of devices you have with what a given vendor covers. It's also important to note that for agent-based solutions, the minimum processor requirements may allow you to install the product, but if you're just getting by in that regard, there could be issues with computer performance.
Symantec supports a fairly broad range of Linux and Windows Embedded versions, but does not support application control on Mac, Windows Servers, Windows Embedded, Linux, or mobile devices.
Trend Micro Apex One's agents support support from macOS High Sierra 10.13 to macOS Monterey 12, on Apple M1, Apple M2, or Intel® Core processors. To protect Linux file, web, and application servers with Trend Micro, you'll need its ServerProtect product.
McAfee handles Windows 8.1, 10, and 11, and offers limited customer service if you try running it on Windows 8.0 and 7.x. For macOS it goes as far back as Mac OS X 10.10 and through to macOS 12 (Monterey). For Linux it offers limited coverage: Ubuntu 16.04, Ubuntu 18.04, and Ubuntu 20.4.
With Kaspersky Endpoint Security for Business you get Windows, of course, and pretty extensive Linux coverage, with nine 32-bit OSs covered, and literally dozens of 64-bit Linux flavors. Mac coverage is included in the Advanced and Select versions of Kaspersky ESB (and you also get Android and iOS).
ESET Endpoint Security will work with Windows 7 - 11 (although some features are not supported on ARM processors) macOS 10.12 and up, and a couple of 64-bit Linux systems: Ubuntu Desktop 18.04 LTS and RHEL Desktop 7.
PAN Cortex XDR supports Windows 8 - 11 as well as macOS as far back as 10.13 with its 7.5-CE release. Subsequent 7.x releases cover later macOS versions (with 7.7.3 and later handling macOS 13.x). Cortex XDR only supports 64-bit Linux and you have to install a supported kernel module version, but it does cover a good selection of the main Linux offerings including CentOS, Debian, Oracle, RHEL, openSUSE, and Ubuntu.
Microsoft Defender for Endpoint has coverage for macOS 11 (Big Sur), 12 (Monterey), and 13 (Ventura), although Big Sur requires some additional configuration. It also protects more recent versions of RHEL, CentOS, Ubuntu, Debian, and Oracle Linux. Android (6.0 and higher) and iOS (11.0 and higher) are also available.
As for legacy systems, it's best to explicitly ask the vendor if they cover the particular hardware/OSs you have. For example, older versions of Symantec Endpoint Protection 14 cover Windows as far back as Vista, and Windows Server as far back as Windows Server 2008 (RTM, SP1, SP2).
We’re launching an annual User’s Choice Award to showcase the most popular B2B enterprise technology products and we want your vote!
If there’s a technology solution that’s really impressed you, here’s an opportunity to recognize that. It’s easy: go to the PeerSpot voting site, complete the brief voter registration form, review the list of nominees and vote. Get your colleagues to vote, too!
If you’re weighing your options for endpoint security solutions, there are many options out there. However, solutions vary greatly in terms of how effectively they can protect your network. I want to help you make the best decision possible, so here are some questions to ask before buying an endpoint security solution, and why they are important.
1) Does the solution employ Foundational Tech...
Hi dear community members,
This is our latest community digest. It helps you catch up on recent contributions by community members. Comment below with your feedback and suggestions!
What are the Top 5 cybersecurity trends in 2022?
What are the main benefits of modern IT Asset Discovery tools?
Post an educational article from your Home feed and receive 20 point...
Hi community members,
Spotlight #2 is our fresh bi-weekly community digest for you. It covers cybersecurity, IT and DevOps topics. Check it out and comment below with your feedback!
What are the pros and cons of internal SOC vs SOC-as-a-Service?
Join The Moderator Team at IT Central Station (soon to be PeerSpot)!
Share your experience with other peers by ans...
One of the fastest growing vendors in the Endpoint Security market, Cylance has built its reputation on the back of proactive and preventive antivirus technology based on artificial intelligence, machine learning, and algorithmic science. Headquartered in Irvine, California and
with offices around the world, Cylance was founded by a team of security industry professionals and scientists with the goal to “redefine the endpoint standard of protection by preventing threats from ever executing.”
Bottom Line: Cylance’s signatureless anti-malware provides an alternative to traditional, signature-based technology, and benefits from easy deployment and management, low-performance impact, and high detection rates against new threat variants. The company is a good pick for companies of all sizes looking to shore-up existing defenses, or for an alternative to traditional anti-malware. The most valuable feature is the ability to respond to zero-day and unknown threats.
Cylance’s AI and Machine Learning ensures that all types of malware and PUP (Potential Unwanted Programs) are detected and your endpoint devices are fully protected, even with day zero threats.
Some words about ransomware first.
Ransomware has become much more targeted these days, so that ordinary users are less likely to suffer from it.
Also, avoid the free tools as with the degree of sophistication and the way they target companies, most of them will not remove the ransomware.
Finally, also think about protecting mobile devices as these now has email clients, VPN tools and access to corporate applications. Therefore, go for those protecting mobile phones also.
I have seen many interesting products proposed in this forum. Adding the following 3:
2. AVG Antivirus paid version
3. Trend Micro Antivirus RandomBuster
This application addresses the ransomware issue through a bait mechanism - fake files are placed in pre-selected strategic locations around a system and are then observed for any malicious behaviors or attack attempts.
In 2020, the most significant ransomware threats is still “WannaCry.” WannaCry is a type of malicious software (malware) that encrypts files on a targeted computer and demands money from its victims in exchange for ransom. It was first identified in May 2017 when it infected more than 230,000 computers across 150 countries within one day.
In October 2019, security researchers at Avira reported that WannaCry had already compromised over 1 million computers worldwide since its release two years earlier. This number suggests that the virus continues to be an ongoing and very real threat to businesses and individuals across the globe - even three years later.
The biggest cause of worry with WannaCry is how well it spreads itself quickly across networks - both inside organizations as well as via external providers like banks or other third-party service companies they may use. To make matters worse, this type of ransomware has been combined with other forms of malware or viruses such as Emotet and Trickbot to create highly potent cybercriminal toolkits capable of taking down entire systems without any user interaction necessary; all it takes is just a single click on an infected file sent by phishing email for everything else to unfold eventually leading up to ransom requests for payment in cryptocurrency such Bitcoin or Etherium in order for full access back into their own systems again post-infection.
Furthermore, due to its wide distribution capability via multiple attack vectors such as unpatched remote desktop protocol servers (RDPs), malvertising campaigns on social media platforms (such Facebook or Twitter), malwares hidden within seemingly innocent attachments like images/documents etc., more recent variants have become much harder to detect even after putting preventive measures like antivirus solutions into place against them. All these factors contribute heavily towards why WannaCry remains one of the biggest threats not only this year but also possibly going forward beyond 2020 too if proper steps are not taken soon enough by enterprise organizations around the world who haven’t upgraded their security posture yet
SentinelOne is my recommended solution.
The SentinelOne Endpoint Protection Platform (EPP) unifies prevention, detection, and response in a single purpose-built agent, powered by machine learning and automation. It is not reliant on hash signatures or an internet connection. SentinelOne provides prevention and detection of attacks across all major vectors and rapid elimination of threats with a fully automated real-time response without human intervention.
SentinelOne can also detect and protect against zero-day, file less and lateral movement attacks.
SentinelOne has not been breached and offers upto $1,000,000 warranty if it cannot roll back a ransomware attack.
Please contact me at email@example.com for more information, a demonstration, or a quote.
OK a real tricky answer. There are so many out there now and all seem to have one or the other upper hand on the ransomware arena. It all depends on their back end system finally - How they analyse and how fast they analyse (even if in the wild) . And most importantly how fast u can get tech support - Try out Crowdstrike, Checkpoint, Sophos, McAfee, TrendMicro. Remember this - you need to be more specific with your actual physical scenario to get a better answer. This one is very generic in purpose.
Cortex XDR de Palo Alto Networks is the best solution in the market, because it has protection methods multiples, like are Local Machine Learning/IA, Static Analysis, Dynamic Analysis, Network Profiling, Baremetal, Exploits Protection (By technical or method, no by exploit), Kernel Protection, Behavior Anomaly Protection, etc. Best score in the Mitre att&ck Evaluation.
There are several good ones and it depends on budget, integrations needed, staff levels, etc. Crowdstrike Falcon is great if you can afford it. Price reflects "set it and forget it" type of EPP. No need to hire FTE to manage it and comes with 24x7x365 SOC. If you can manage, SentinelOne offers great detections and incident response capabilities (it is really an EDR). S1 has a ransomware rollback feature in case it gets through initial detections (can restore encrypted files if needed) and provides up to 1 million in ransom costs to back up their confidence. If you are a Checkpoint shop and want to leverage some of their other features (Cloudguard SaaS, Endpoint Encryption, etc.) then their Sandblast agent also offers great detections and a rollback feature of their own. Palo Alto traps is decent if you are a PAN shop but can get heavy on admin overhead. Same with Cisco AMP. We do not sell traditional A/V anymore because of polymorphic threats and zero day. Must have behavioral analytics and anomaly detection capabilities.