Endpoint Policy Question

Cosmic

Hello! I have two major questions:

Firstly, does setting Advanced Threat Control to Aggressive do anything? I understand that it operates at a greater deal of aggressiveness, but would it possibly prevent more malware?

Secondly, does EDR provide a form of preventative protection? I saw in a Incident Report a detection given by the EDR for 'possible ransomware process'. Is this only for viewing Incidents - or does it actually provide another layer of remedying threats?

Andrei_S Enterprise

Hello @Cosmic ,

1. When setting the Advanced Threat Control to Aggressive you are increasing the sensitivity of detection. Basically, Advanced Threat Control will require fewer signs of malware-like behavior to report a process. This will lead to a higher number of applications being reported and, at the same time, to an increased likelihood of false positives (clean applications detected as malicious).
   
2. Endpoint Detection and Response (EDR) is an event correlation component, capable of identifying advanced threats or in-progress attacks. EDR is a sensor which monitors endpoints to uncover suspicious activity and provide this data to be used by the other product modules. For example with EDR you can see all incidents from your environment, how it started and propagated through your system and you can take appropriate measures to mitigate these risks. Another example is the Risk Management Dashboard which provides a list of risks associated with your environment and ways to mitigate them.
   
   To understand a how EDR helps you can check the Interactive Demo from https://www.bitdefender.com/en-us/business/products/endpoint-detection-response where a incident is described in a step by step manner and you can see how EDR helped correlated to correlate the events and assisted with detection and prevention of a malware.

Kind Regards,

Andrei