|
Home > Corporate Home > Incident Response
Incident Response with EnCase® Enterprise
"In our Clear Choice Test, we found that with this aggregation of incident-response and forensic capabilities not yet seen in competing products, EnCase® Enterprise can . . . establish relationships between open ports, open files, network connections, hidden files or processes and malicious activity"
— Sam Stover, Network World
The EnCase® Enterprise provides incident response capabilities, allowing you to investigate meaningful alerts, establish intrusion profiles to zero in on all contaminated computers, and restore your network's security with little or no disruption. EnCase® Enterprise can be customized to address your unique incident response (IR) needs.
The solution's compromise assessment capabilities also allow you to audit your network proactively to understand what is running and how that picture deviates from your existing policies.
ONLY ENCASE® SOLUTIONS CAN DO ALL THIS. . .
- Scan for running processes on multiple machines simultaneously, across multiple operating systems — up to 30,000 machines per hour.
- Capture a complete picture of volatile data including open ports, active processes, open files, live Windows registry, network users and network interfaces.
- Allows full compliance with the NIST Computer Security Incident Handling Guide.
- Analyze system data across time to achieve a detailed analysis and determine the exact impact of a computer attack.
- Preview computers over the network to determine whether relevant evidence exists:
- Unallocated/allocated space
- Deleted files
- File slack
- Volume slack
- File system attributes
- CD ROMs/DVDs
- Mounted FireWire amd USB devices
- Mounted encrypted volumes
- Mounted thumb drives
- Find and remediate zero-day events and other malicious code — identify and destroy hidden processes and hooks used by rootkits.
- Create logical evidence files and preserve associated metadata on an individual-file basis — eliminating the need to capture entire hard drives.
|
|