FireEye Endpoint Security

To prevent common malware, Endpoint Security uses a signature based endpoint protection platform (EPP) engine. To find threats for which a signature does not yet exist, MalwareGuard uses machine learning seeded with knowledge from the frontlines of cyber attacks. To deal with advanced threats, endpoint detection and response (EDR) capabilities are enabled through a behavior-based analytics engine. Finally, a real-time indicators of compromise (IOC) engine that relies on current, frontline intelligence helps find hidden threats. This defense in depth strategy helps protect vital information stored on customer endpoints. Even with the best protection, breaches are inevitable. To ensure a substantive response that minimizes business disruption, Endpoint Security provides tools to:

• Search for and investigate known and unknown threats on tens of thousands of endpoints in minutes
• Identify and detail vectors an attack used to infiltrate an endpoint
• Determine whether an attack occurred (and persists) on a specific endpoint and where it spread
• Establish timeline and duration of endpoint compromises and follow the incident
• Clearly identify which endpoints and systems need containment to prevent further compromise

Primary Features

• Single agent with three detection engines to minimize configuration and maximize detection and blocking

• Single integrated workflow to analyze and respond to threats within Endpoint Security

• Fully integrated malware protection with antivirus (AV) defenses, machine learning, behavior analysis, indicators of compromise (IOCs) and endpoint visibility

• Triage Summary and Audit Viewer for exhaustive inspection and analysis of threats

Additional Features

• Enterprise Security Search to rapidly find and illuminate suspicious activity and threats

• Data Acquisition to conduct detailed in-depth endpoint inspection and analysis over a specific time frame

• End-to-end visibility that allows security teams to rapidly search for, identify and discern the level of threats

• Detection and response capabilities to quickly detect, investigate and contain endpoints to expedite response

• Easy-to-understand interface for fast interpretation and response to any suspicious endpoint activity