Key takeaway
MDR combines automated protection with investigation and response by security analysts.
Contents
The brief brings together unknown-object containment, monitoring, incident investigation and proactive threat hunting within MDR. It focuses on supporting security teams facing high alert volumes and remote working.
Containing unknown objects
ZeroDwell Containment isolates unknown objects in a virtualized environment at runtime. This is intended to restrict their interaction with the underlying system.
From monitoring to investigation
The brief describes collecting and correlating telemetry from endpoints, networks and cloud environments, and producing reports. File, user and application data support incident investigation; proactive hunting looks for signs of hidden attacks.
SOC support and the Utah example
The described service includes round-the-clock security operations centre (SOC) support, incident response specialists and digital forensics. The brief also points to a separate Utah state government customer story.