Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1113788" data-attributes="member: 99014">ThreatCloud is well documented with all the videos and posts, ThreatCloud is mainly the engines that they blog about and the feeds.IPS is not available in Harmony Endpoint, it is only on the gateways.The anti-ransomware and anti-bot are all based on the Endpoint Forensics Recorder. This engine is everything and anything in CP products, capturing all new objects and events, and passing them to the relevant engines. From there, Anti-Ransomware (just a branding really) takes events only and runs them through over 50 local decision trees responsible for ransomware identification. In addition, it backs up and restores files after encryption (which is how it differs from EFR/Behavioural Guard).Anti-Bot takes both events/behaviours and objects. It contains network signatures that include port and protocol, bot-related behaviours and the ThreatCloud repository with bot servers. When bot is detected, Anti-Bot returns this information to the EFR, EFR pulls the activity logs and starts undoing whatever it can undo.</blockquote>

[QUOTE="Trident, post: 1113788, member: 99014"] ThreatCloud is well documented with all the videos and posts, ThreatCloud is mainly the engines that they blog about and the feeds. IPS is not available in Harmony Endpoint, it is only on the gateways. The anti-ransomware and anti-bot are all based on the Endpoint Forensics Recorder. This engine is everything and anything in CP products, capturing all new objects and events, and passing them to the relevant engines. From there, Anti-Ransomware (just a branding really) takes events only and runs them through over 50 local decision trees responsible for ransomware identification. In addition, it backs up and restores files after encryption (which is how it differs from EFR/Behavioural Guard). Anti-Bot takes both events/behaviours and objects. It contains network signatures that include port and protocol, bot-related behaviours and the ThreatCloud repository with bot servers. When bot is detected, Anti-Bot returns this information to the EFR, EFR pulls the activity logs and starts undoing whatever it can undo. [/QUOTE]

Verification