Binary Defense M-EDR-505 Vision Managed Endpoint Detection & Response

Overview

Binary Defense Vision is our fully-managed Endpoint Detection & Response solution that deploys out to all endpoints (laptops, workstations, and servers) within your environment. Binary Defense Vision uses behavior based detection techniques to watch for and alert on real time attacks. Binary Defense Vision is: Lightweight – Less than 0.01% CPU usage (less than opening up a notepad file). Quick and easy to deploy – Vision doesn’t conflict with other software or agents. Managed by our 24/7/365 Security Operations Center – Security analysts are always monitoring your Binary Defense Vision instance. This means that you have a team solely focused on cyber security watching your endpoints and servers every second of every minute of every day. Binary Defense Vision also has a feature called “containment mode.” If our analyst should see an alert flagged by Vision or catch abnormal behavior on a specific endpoint/server-upon approval-we are able to put that machine in containment mode, which takes it completely off the network. This will give the client the opportunity to remediate the issue (wiping the machine, incident response, etc.) without causing further damage to their network infrastructure. Once the issue has been resolved, we can put the machine back on the network. “Active Threat Hunting” with Binary Defense Vision is a great way to be proactive in looking for potential threats in the environment. This is something that can be done by the client’s team or can be done by our security analysts. Active Threat Hunting with Vision gives clients the ability to observe their environment during off-peak hours to look for potential threats that may be lurking on the network but aren’t necessarily an active threat triggering an alert.
One of the best differentiators Binary Defense Vision provides to the client’s endpoints and servers is the deception capability through honeypotting. A combination of ports, files and credentials are put on each endpoint in ways that make them very attractive to attackers. If the attackers ends up using the credentials, we know they are on the network and can catch them. When an alarm/alert is flagged in Binary Defense Vision, our SOC analysts are provided all the raw log data behind what triggered the alarm, exact origin of the threat, reference links on the type of alarm as well as potential remedies for this specific type of threat. The analyst will perform the analysis required in order to provide actionable intel to set the client up for immediate success. Binary Defense Vision’s interface was designed to be very easy to use and learn. Most, if not all, of the backend work is done by Binary Defense to minimalize the amount of effort needed from the client.