Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1046505" data-attributes="member: 99014">Here is the moment to say that with my policy, Harmony Endpoint blocks malicious connections system-wide. It can block connections to many categories (most of them are parental control) but it also blocks connections to malicious and suspicious sites.The blocking components are 3.First one is the web filter which relies on ThreatCloud. It blocks known malicious domains and suspicious ones that look like machine-generated. It also uses DNS (whois) data analysis to take a decision in real time.Second is the anti-bot. It blocks connections to known C&amp;C. It is similar to web filter, but because these are domains contacted by malware, admins should treat such detections with extreme urgency, the system is probably infected. And a message “Your computer communicates to a known malicious domain. It is probably infected with malware” appears. In such cases, I recommend users to start running scans (including with tools like Norton Power Eraser) unless they are doing malware testing/research.Anti-Bot also exhibits IPS capabilities, blocks exploits and lateral movement based on Deep Packet Inspection and Protocol analysis. It also analyses behaviour and reputation of programmes (it is an extension to Behavioural Guard).Third is the Zero Phishing Real time analysis. Web Filter will block known phishing pages, Zero Phishing will analyse characteristics to block the unknown.</blockquote>

[QUOTE="Trident, post: 1046505, member: 99014"] Here is the moment to say that with my policy, Harmony Endpoint blocks malicious connections system-wide. It can block connections to many categories (most of them are parental control) but it also blocks connections to malicious and suspicious sites. The blocking components are 3. First one is the web filter which relies on ThreatCloud. It blocks known malicious domains and suspicious ones that look like machine-generated. It also uses DNS (whois) data analysis to take a decision in real time. Second is the anti-bot. It blocks connections to known C&C. It is similar to web filter, but because these are domains contacted by malware, admins should treat such detections with extreme urgency, the system is probably infected. And a message “Your computer communicates to a known malicious domain. It is probably infected with malware” appears. In such cases, I recommend users to start running scans (including with tools like Norton Power Eraser) unless they are doing malware testing/research. Anti-Bot also exhibits IPS capabilities, blocks exploits and lateral movement based on Deep Packet Inspection and Protocol analysis. It also analyses behaviour and reputation of programmes (it is an extension to Behavioural Guard). Third is the Zero Phishing Real time analysis. Web Filter will block known phishing pages, Zero Phishing will analyse characteristics to block the unknown. [/QUOTE]

Verification