Advanced threat detection, focused investigation and effective response
What are the benefits of Bitdefender EDR security?
- Bitdefender EDR integrates our industry-leading machine-learning, cloud-scanning and sandbox analyzer to detect activity that evades traditional endpoint prevention mechanisms.
- Full visibility on the techniques, tactics and procedures (TTPs) being used to attack your systems.
- Comprehensive search capabilities for specific indicators of compromise (IoCs), MITRE ATT&CK techniques and other artifacts to discover early stage attacks.
Focused investigation and response
- Easy-to-follow built-in response workflows enable you to respond efficiently, limit lateral spread and stop ongoing attacks.
- Threat visualizations focus your investigations, help you understand complex detections, identify the root cause of attacks and maximize your ability to respond directly.
- Automated alert prioritization with one-click resolution capabilities.
- Easy-to-deploy, low overhead agent with cloud-delivered management.
- Unique human and endpoint risk analytics supply actionable advice to improve your security posture and reduce risk.
- Flexible, scalable and upgradeable to the full Bitdefender endpoint protection platform and to managed detection and response (MDR).
What are the features of Bitdefender EDR security?
- Industry-leading threat detection technology – Detects advanced threats including file-less attacks and other zero-day threats in real-time. Complements existing endpoint security solution to strengthen detection.
- Cyber Threat Analytics – Cloud-based event collector continuously distils endpoint events into a prioritized list of incidents for additional investigation and response.
- Event Recorder – Continuous endpoint event monitoring that feeds events to threat analytics to build threat visualizations of the events involved in an attack.
- Sandbox Analyzer – Automatically executes suspicious payloads in contained virtual environment. The threat analytics module then uses this analysis to make decisions on suspicious files.
Investigate and Respond
- Indicators of Compromise (IoC) Lookup – Query the events database to uncover threats. Uncover MITRE ATT&CK techniques and indicators of compromise. Up to the minute insight into named threats and other malware that may be involved.
- Visualization – Easy-to-understand visual guides, enriched with context and threat intelligence, highlight critical attack paths, easing burdens on IT staff. Helps identify gaps in protection and incident impact to support compliance.
- Detonation – Operator-instigated sandbox investigation helps you make informed decisions on suspicious files.
- Blocklist – Stop the spread of suspicious files or processes detected by EDR to other machines.
- Process Termination – Instantly terminate suspicious processes to stop potential live breaches.
- Network Isolation – Block connections to and from endpoint to stop lateral movement and further breaches while investigating incidents.
- Remote shell – Execute remote commands on any workstation for immediate reaction to ongoing incidents.
Report and Alert
- Determine Risk – Continuously analyses human and endpoint risk using hundreds of factors to uncover and prioritize configuration risks to all your endpoints. Helps identify and provides guidance on mitigating user, network and system risks.
- Real-time dashboards – Deliver insights into the security posture of your environment.
- Comprehensive reports – Provide the information you need to measure impact on the business.
- Notifications – Configurable dashboard and email notifications.
- SIEM Integration and API Support – Supports further integration with Splunk and other tools.
How does Bitdefender EDR Security work?
Bitdefender EDR is a cloud-delivered solution built on the Bitdefender GravityZone cloud platform. EDR agents are deployed on all your organization’s endpoints. Each EDR agent has an event recorder that continuously monitors the endpoint and securely sends insights and suspicious events to the GravityZone cloud.
In Gravity Zone, the Threat Analytics module collects and distills endpoint events into a prioritized list of incidents for additional investigation and response. It sends suspicious files for detonation in the Sandbox Analyzer then uses the sandbox verdict in EDR’s incident reports. The EDR real-time dashboard can be accessed from any device to enable administrators to see alerts and visualizations, then investigate and respond effectively to threats.