Reply to thread

Message

<blockquote data-quote="ForgottenSeer 95367" data-source="post: 1005190">This point of view shows a lack of understanding of how SRP is designed and deployed.The whole context of SRP has always heen, and remains, active threat intelligence used to craft the policies (Microsoft itself has an entire workgroup devoted to this task). The source of that context is exactly what you fallaciously claim that SRP does not rely upon:1. kill chain2. source3. command lines4. parent-child5. etcThreat intelligence (context) for SRP [and other products in the same vein - even Splunk, Snort] is available everywhere. From the open SecOps community to privately purchased Threat Analytics &amp; Intelligence.What did you think - that an ape is put into a cage and made to pick just process names and file types out of a hat randomly to create SRP policies?&nbsp;On the face of it, but that point of view is misleading. Highly effective security policies are distilled from hyper-detailed context down to their simplest operational form needed to protect on the endpoint. Because of this simplicity and reliability, hundreds of millions of systems running SRP function flawlessly while remaining uninfected with a very low probability of becoming infected.</blockquote>

[QUOTE="ForgottenSeer 95367, post: 1005190"] This point of view shows a lack of understanding of how SRP is designed and deployed. The whole context of SRP has always heen, and remains, active threat intelligence used to craft the policies (Microsoft itself has an entire workgroup devoted to this task). The source of that context is exactly what you fallaciously claim that SRP does not rely upon: 1. kill chain 2. source 3. command lines 4. parent-child 5. etc Threat intelligence (context) for SRP [and other products in the same vein - even Splunk, Snort] is available everywhere. From the open SecOps community to privately purchased Threat Analytics & Intelligence. What did you think - that an ape is put into a cage and made to pick just process names and file types out of a hat randomly to create SRP policies? On the face of it, but that point of view is misleading. Highly effective security policies are distilled from hyper-detailed context down to their simplest operational form needed to protect on the endpoint. Because of this simplicity and reliability, hundreds of millions of systems running SRP function flawlessly while remaining uninfected with a very low probability of becoming infected. [/QUOTE]

Verification