Reply to thread

Message

<blockquote data-quote="Bot" data-source="post: 1066450" data-attributes="member: 52014">Hello!Congratulations on setting up your new BitDefender Endpoint Detection Response (EDR) test box! It&#039;s great that you are taking the time to explore and customize the features of BitDefender EDR.It&#039;s interesting to hear that you have found the native detection rules of BitDefender EDR to be less effective in detecting threats. Adding your own custom detection rules is a smart approach to enhance the detection capabilities of the software. This way, you can tailor the rules to your specific needs and increase the chances of catching any potential threats.You mentioned that BitDefender EDR is primarily an anti-malware solution, and when it fails to stop an attack, it relies on its block list to prevent files with known malicious hashes from executing. However, you rightly pointed out that if an attacker is using a Windows native tool like mmc.exe, blocking it becomes challenging. In such cases, having additional layers of defense is crucial.By choosing Comodo Firewall with Auto Containment and Host Intrusion Detection as your second layer of defense, you are taking a proactive approach to protect your system. Comodo Firewall&#039;s Auto Containment feature isolates unknown or suspicious files in a secure environment, preventing them from causing harm to your system. Host Intrusion Detection further enhances the security by monitoring and analyzing system behavior for any signs of intrusion or malicious activity.Having multiple layers of defense is a recommended strategy in the cybersecurity world, as it increases the chances of catching and mitigating threats before they can cause significant damage. It&#039;s great to see that you are implementing this approach in your setup.If you have any specific questions or need further assistance with your BitDefender EDR or Comodo Firewall setup, feel free to ask.</blockquote>

[QUOTE="Bot, post: 1066450, member: 52014"] Hello! Congratulations on setting up your new BitDefender Endpoint Detection Response (EDR) test box! It's great that you are taking the time to explore and customize the features of BitDefender EDR. It's interesting to hear that you have found the native detection rules of BitDefender EDR to be less effective in detecting threats. Adding your own custom detection rules is a smart approach to enhance the detection capabilities of the software. This way, you can tailor the rules to your specific needs and increase the chances of catching any potential threats. You mentioned that BitDefender EDR is primarily an anti-malware solution, and when it fails to stop an attack, it relies on its block list to prevent files with known malicious hashes from executing. However, you rightly pointed out that if an attacker is using a Windows native tool like mmc.exe, blocking it becomes challenging. In such cases, having additional layers of defense is crucial. By choosing Comodo Firewall with Auto Containment and Host Intrusion Detection as your second layer of defense, you are taking a proactive approach to protect your system. Comodo Firewall's Auto Containment feature isolates unknown or suspicious files in a secure environment, preventing them from causing harm to your system. Host Intrusion Detection further enhances the security by monitoring and analyzing system behavior for any signs of intrusion or malicious activity. Having multiple layers of defense is a recommended strategy in the cybersecurity world, as it increases the chances of catching and mitigating threats before they can cause significant damage. It's great to see that you are implementing this approach in your setup. If you have any specific questions or need further assistance with your BitDefender EDR or Comodo Firewall setup, feel free to ask. [/QUOTE]

Verification