GravityZone Business Security Enterprise

Endpoint Detection and Response (EDR) - gives you a comprehensive event correlation component that is able to identify advanced threats or in-progress attacks, by bringing together device intelligence across your enterprise network.

HyperDetect - contains machine learning models and stealth attack detection technology against threats such as: zero-day attacks, advanced persistent threats (APT), obfuscated malware, fileless attacks (misuse of PowerShell, Windows Management Instrumentation etc.), credential stealing, targeted attacks, custom malware, script-based attacks, exploits, hacking tools, suspicious network traffic, potentially unwanted applications (PUA), ransomware.

Fileless Attack Protection - is designed to detect and block fileless malware at pre-execution, that works by scanning the content at a deeper level by employing the AMSI integration.

Incidents - offers you a centralized view of security events and provides context and detailed information to help you investigate and respond to potential incidents quickly.

Endpoint tags - helps you easily identify and take actions on managed endpoints, such as assigning policies based on specific rules or filtering items in the Network page.

Live Search - enables you to retrieve information about events and system statistics directly from online endpoints using OSquery, an operating system instrumentation framework that uses the SQLite query language.

Cross-endpoint correlation - detects advanced attacks across multiple endpoints in hybrid infrastructures (workstations, servers or containers, running various OS) and brings together device intelligence across your enterprise network.

Autonomous response recommendations - combines automated response actions with guided recommendations for fast incident response across endpoints.

Custom Rules for EDR - provides you the framework to create and manage custom rules to include or exclude specific behaviors from triggering incidents.Custom Rules