Actions Available from the BlackfishID Platform
Security and Incident Response
Kill process: Terminates a malicious process running on the endpoint, preventing its spread or further damage.
Quarantine: Isolates a suspicious file or process within the system to prevent access or execution until its threat level is determined.
Isolate device: Completely disconnects the device from the network, preventing a potential threat from spreading to other systems.
Actions Managed by the BlackfishID Security Team
Security Monitoring and Management
Review and management of critical detections: Analysis and response to critical threats that were not automatically contained by the platform.
Cybersecurity incident support: Intervention in security incidents requiring advanced analysis or a customized response.
Security configuration evaluation: Ensuring endpoints comply with BlackfishID's best security practices.
Optimization of security policies: Adjusting configurations and security rules based on each client’s needs.
Analysis and Reporting
Security report generation: Detailed analysis of the security status of the organization and its devices.
Platform activity monitoring: Tracking platform usage and device behavior to detect potential anomalies.
Forensic analysis of major incidents: In-depth review of security events to identify the root cause of an incident and improve future prevention.
Conclusion
The BlackfishID agent allows administrators to manage endpoint security directly from the platform with the actions kill process, quarantine, and isolate device, while the BlackfishID security team oversees and responds to critical incidents to ensure comprehensive protection.