Cybereason EDR

Cybereason EDR is an endpoint detection and response platform that monitors endpoint events to detect and remediate cybersecurity threats. The platform uses behavioral analysis and machine learning to identify malicious operations (MalOps) by correlating data across all endpoints in real-time. The solution provides cross-machine correlation capabilities that enable a 1:200,000 analyst-to-endpoint ratio. It detects threats by analyzing enterprise-wide datasets against machine learning models to identify subtle indicators of malicious behavior that may not be visible when examining individual machines. The platform aggregates multiple threat intelligence feeds and uses machine learning to rank their historical accuracy for specific threat types and adversary groups. This approach helps determine which threat intelligence sources to prioritize for investigation and response. Cybereason EDR offers remediation capabilities through an interface that allows analysts to kill processes, quarantine files, remove persistence mechanisms, prevent file execution, and isolate machines. The platform presents attack information as interactive visual representations with automated timelines showing correlated events. The solution uses a single lightweight agent deployed across endpoints. It monitors endpoint events including processes, files, network connections, and registry changes. The platform provides investigation capabilities without requiring analysts to craft complex queries. The Cybereason Nocturnus research team contributes detection strategies by identifying Indicators of Compromise (IOCs) and Indicators of Behavior (IOBs) derived from network-wide analysis.