Cybereason DFIR solution contains cyber attacks in minutes

Brandon Rochat, Cybereason Sales Director, Africa.

---

Cybereason, the XDR company, has launched Cybereason DFIR (Digital Forensics Incident Response), a solution designed to automate incident response (IR) investigations by incorporating nuanced forensic artefacts into threat hunting, reducing remediation time by enabling security analysts to contain cyber attacks in minutes.

Today, many organisations find themselves vulnerable to breaches because security analysts lack the tools to quickly investigate and remediate all aspects of a threat. By offering incident response solutions driven by forensics, Cybereason can extend deeper value to defenders.

With the Cybereason MalOp Detection Engine augmented by Cybereason DFIR, security analysts can leverage the industry’s most comprehensive detections from root cause across every impacted asset.

With forensics data added to the MalOp, security analysts have instant visibility into a wider range of intelligence sources to enable rapid decisions and remediate threats more efficiently. Cybereason DFIR includes the following capabilities:

• Forensic Data Ingestion: Feed a treasure trove of forensic data to the MalOp Detection Engine for deeper insights, enrichment and contextualisation.
• Live File Search: Search for any suspicious file in the environment based on a wide variety of search criteria without the need for prior collection.
• IR Tools Deployment: Streamline cumbersome IR investigations and work seamlessly with similar DFIR tools by deploying them via the Cybereason Sensor.
• ExpressIR: IR partners and large customers with internal DFIR teams can deploy a pre-provisioned IR environment to begin the investigation within hours of an incident.

Cybereason Sales Director for Africa, Brandon Rochat, says Cybereason DFIR enhances the performance of the Cybereason XDR Platform in its customers' environments. “It enables security analyst teams to detect, identify, analyse and respond to sophisticated threats before adversaries can inflict harm.

"And when needed, conduct a thorough post-mortem analysis of a complex incident. The merging of our powerful Cybereason XDR Platform with Cybereason DFIR provides the industry with the most powerful tools available,” he adds.

Anything connected to the internet is part of an organisation’s attack surface, yet defenders are forced to use multiple siloed solutions producing uncorrelated alerts to try to find and end these complex malicious operations.

Now, defenders can leverage Cybereason DFIR to centralise DFIR investigative work and end sophisticated attacks with the only solution on the market to deliver:

Comprehensive response: Cybereason DFIR has a number of tailored remediation actions analysts can perform directly from the investigation screen. The solution empowers analysts to reduce mean-time-to-detect and mean-time-to-remediate. Cybereason DFIR also allows defenders to contain attacks by executing commands directly on the host in question with remote shell and real-time response actions.

Uncover advanced adversaries: Fully reveal sophisticated adversaries and analyse complex TTPs by tracing the attacker path back to root cause. Defenders will have a better understanding of the full scope and timeline of an incident using enriched forensics to identify all impacted systems and users. Security analysts can investigate relevant files and forensic artefacts of interest through wide-ranging criteria to collect files as needed.

Fully supported technology: With a shortage of Tier III qualified security analysts, many security teams are understaffed and lack in-house IR expertise. Cybereason automates most aspects of a DFIR investigation and up-levels the capabilities of Level 1 and 2 analysts to perform complex forensic tasks. In addition, the Cybereason Services Teams fully support investigations, breach recovery, forensic audits and deep-dive analysis.