Story image

Symantec announces new endpoint response tools

31 Jan 2019

Cybersecurity company Symantec has announced a new managed endpoint detection and response (MEDR) service and enhanced EDR 4.0 technology.

These advancements improve attack discovery and incident response using AI-driven analytics and automation to quickly discover and stop sophisticated cyber attacks.

Enterprise IT and Security Ops teams are increasingly challenged to investigate and respond to advanced and emerging threats with available resources and staff. 

Symantec’s MEDR service harnesses the power of EDR 4.0 to improve incident response, threat hunting and forensics, giving teams investigation expertise and threat intelligence from a team of Symantec SOC analysts.

Symantec MEDR detects attacks and examines suspicious activity for faster incident validation and response.

A combination of Symantec EDR 4.0, the SOC technology platform, and the Global Intelligence Network, allows Symantec analysts to provide 24x7 expertise.

Managed threat hunting, remote investigations, and endpoint containment enable security teams around the world to stay ahead of threats.

Features include:

  • Industry- and region-specific analysts provide 24x7 coverage across six global SOCs.
  • Managed threat hunting provides detection for zero-day and unknown threats.
  • Industry best practices including MITRE ATT&CK framework help to quickly identify critical indicators of attack.
  • Rapid containment of compromised endpoints using pre-authorised measures.
  • Custom and emerging threat reports, business reviews, and 24x7 coverage.

“Many customers can’t find enough cybersecurity experts to meet demand. Our MEDR service provides access to Symantec’s SOC analysts and machine learning techniques to reduce the burden on staff and shrink the time it takes to investigate incidents,” says Symantec enterprise products EVP and GM Art Gilliland.

“For organisations with robust security response teams, EDR 4.0 is now available on any device, anywhere, before or after an attack occurs to provide comprehensive detection and response.” 

Symantec’s EDR 4.0 continuously updates AI-driven detection engines using threat research from Symantec’s elite team of researchers and global telemetry from 175 million endpoints to train analytics to detect new attack patterns.

EDR 4.0 is now available on any device, anywhere, before or after an attack. 

New features include: 

  • Advanced attack detections to help thwart “living off the land” fileless attacks.
  • Automated playbooks to quickly initiate investigations.
  • MITRE ATT&CK framework enrichment to expose gaps in the attack lifecycle.
  • Advanced pre- and post-breach comprehensive EDR tools.
  • Flexible deployment options for Symantec Endpoint Protection (SEP) and non-SEP endpoints for macOS, Linux, and Windows.

“Many organisations are struggling with threat detection and incident response because of both the volume and sophistication of attacks and an expanding attack surface. They also face many challenges including the volume of alerts and a continued reliance on manual processes,” says Jon Oltsik ESG senior principal analyst. 

“With a critical shortage of skilled investigators available, security teams need smart tools and services that can help them deal with the scale and speed of the modern threat environment, making it easier to identify and fix impacted endpoints.

“To improve IR processes, cybersecurity professionals must eschew legacy approaches and embrace the right tools and services,” Oltsik says.

Aerohive launches guide to cloud-managed network access control
NAC for Dummies teaches the key aspects of network access control within enterprise IT networks and how you can secure all devices on the network.
Sungard AS named DRaaS leader by Forrester
It was noted for its disaster-recovery-as-a-service solution’s ability to “serve client needs at all stages of their need for business continuity.”
Gartner: The five priorities of privacy executives
The priorities highlight the need for strategic approaches to engage with shifting regulatory, technology, customer and third-party risk trends.
Thycotic debunks top Privileged Access Management myths
Privileged Access encompasses access to computers, networks and network devices, software applications, digital documents and other digital assets.
Veeam reports double-digit Q1 growth
We are now focussed on an aggressive strategy to help businesses transition to cloud with Backup and Cloud Data Management solutions.
Paving the road to self-sovereign identity using blockchain
Internet users are often required to input personal information and highly-valuable data from contact numbers to email addresses to make use of the various platforms and services available online.
Veeam releases v3 of its MS Office backup solution
One of Veeam’s most popular solutions, Backup for Office 365, has been upgraded again with greater speed, security and analytics.
Too many 'critical' vulnerabilities to patch? Tenable opts for a different approach
Tenable is hedging all of its security bets on the power of predictive, as the company announced general available of its Predictive Prioritisation solution within Tenable.io.