Identification of infected terminals and scope of influence

• Identify infected terminals based on Network Security/Server Email detection information. Identify terminals with the same threat at the same time
• Detection of potentially infected devices using Mandiant intelligence information
• Detection of potentially infected devices using 3rd party, proprietary IOC information

Infection status confirmation, investigation, and isolation

• Status display of threat progress whether malware was sent to the actual terminal or whether it was infected
• Automatically collect activity history such as process startup, communication history, file creation, modification, and deletion on the terminal agent side. Investigation is possible retroactively to the event occurrence time

Detect/block unknown malware and exploits

Four different engines provide defense in depth for endpoints: Malware Protection, Malware Guard, Exploit Guard, and IOC.

Search for the operation status of administrator terminals and the spread of damage

• Investigate whether or not processes of malware file names and hash values obtained from outside are running
• Proactively search for malware and malicious behavior by attackers
• Analysis and tracking of damage spread for all devices