Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Visibility and response across your entire Microsoft security ecosystem.
XDR with Machine Learning that eliminates noise, enables real-time detection and response, and automatically blocks threats.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert threat hunting, original research, and proactive threat intelligence.
TRU is foundational to our MDR service. No add-ons or additional costs required.
Stop ransomware attacks before they disrupt your business.
Detect and respond to zero-day exploits.
Protect against third-party and supply chain risk.
Adopt a risk-based approach to cybersecurity.
Protect your most sensitive data.
Meet cybersecurity regulatory compliance mandates.
Eliminate misconfigurations and policy violations.
Prevent business disruption by outsourcing MDR.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and mediating threats to prevent lateral spread.
Enhance investigation and threat detection across multi-cloud or hybrid environments.
Remediate critical misconfigurations, security vulnerabilities and policy violations across cloud and containerized environments.
Detect malicious insider and identity-based behavior leveraging machine learning models.
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company's mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
We believe a multi-signal approach is paramount to protecting your complete attack surface. See why eSentire MDR means multi-signal telemetry and complete response.
See how our 24/7 SOC Cyber Analysts and Elite Threat Hunters stop even the most advanced cyberattacks before they disrupt your business.
Choose the right mix of Managed Detection and Response, Exposure Management, and Incident Response services to strengthen your cyber resilience.
Try our interactive tools including the MITRE ATT&CK Tool, the SOC Pricing Calculator, the Cybersecurity Maturity Assessment, and our MDR ROI Calculator.
Read the latest security advisories, blogs, reports, industry publications and webinars published by eSentire's Threat Response Unit (TRU).
See why 2000+ organizations count on eSentire to build resilience and prevent business disruption.
This blog was originally published on CyFIR.com and has been reposted as-is here following eSentire’s acquisition of CyFIR Inc. in June 2021. As of the date of the acquisition, no changes have been made to the content below.
Safeguarding digital infrastructure from cyber attacks is a challenge all enterprises face, and while defensive measures can reduce the risk of a data breach, that risk can’t be eliminated entirely. When a breach happens, the speed of a company’s Incident Response is critical to minimize its impact and cost. The following use case illustrates how CyFIR Incident Response Services can assist Information Technology Departments in the aftermath of a data breach.
Friday 7:27 p.m.
It was Friday night and Cesar was on his way to the parking lot when he received a call every Chief Information Security Officer fears: their network had been breached. A team of his security analysts was already on its way back to the office, but nobody knew the extent of the breach, when it occurred, how much data had been removed, or whether other systems had been compromised. Cesar hurried back to his office, shot off a few emails to notify the executive team, and settled back into his chair for what he knew was going to be a long night. Then, knowing his team needed help, he picked up the phone and began contacting cybersecurity consultants.
Friday 7:49 p.m.
Cesar’s first call was to a company that indicated it could have consultants arrive first thing Monday morning. He couldn’t wait that long. Cesar’s second call was to CyFIR where the CTO explained how CyFIR Incident Response Services could be initiated remotely. At 8:00 p.m. Cesar sent over a signed engagement letter, and by 8:30 p.m. CyFIR had remotely deployed its agents onto his network endpoints and begun analysis on all running processes to determine if any malware was still active. Incident Response had begun.
Friday 9:15 p.m.
After CyFIR analysts ran a snapshot of the running processes across all endpoints, they discovered 9 pieces of malicious malware that matched CyFIR’s database of over 1 billion known malware signatures. In addition, CyFIR identified several unknown processes running on the endpoints. Secondary analysis of these unknown processes determined there was a malicious piece of zero-day, or custom, malware in the network. CyFIR pulled the zero-day malware off the system for a more complete analysis.
Friday 9:45 p.m.
After 30 minutes, CyFIR finished analyzing the zero-day malware and identified its country of origin. Next, they ran a search on all endpoints and established that the malware was isolated to just one server. By midnight – four hours after the Incident Response began – CyFIR had deployed its agents, discovered malware running on the endpoints, determined its country origin, and eliminated it from the system. Now it was time to determine how much data had been lost.
Saturday 11:00 a.m.
Throughout the weekend, CyFIR analysts worked with Cesar’s security team to answer critical questions that would reveal the severity of the breach: How long had the intruder been in the system? How did the intruder gain access? What was the intruder’s origin? How much information was lost?
Saturday 3:45 p.m.
With CyFIR Incident Response Services, answers to these questions were quickly determined: Cesar now knew the intruder had been inside their system for about 45 days, he knew which systems had been accessed and how, and he could confidently report that no data had been removed from the network. Using this information and guidance from CyFIR analysts, Cesar’s team began implementing new security mechanisms that would prevent future compromises.
Monday 8:30 a.m.
By Monday morning Cesar had barely slept and he suspected he was in serious need of a shower, but first, he had to brief the Board on what happened and what management had learned from their investigation. Earlier that morning, he had emailed around CyFIR’s preliminary report detailing its findings, and now, he was preparing for what he feared would be a tense exchange.
Fortunately, after an extensive Q&A, the Board was satisfied with the steps he had taken and the findings that were presented. The Board was confident that management had the situation under control. Based on the report, their legal counsel concluded that the company had no responsibility to notify their customers of the breach. It was time for that shower.
All too often, responding to a security breach is a slow, expensive, and challenging exercise even for large enterprises. Cesar’s experience illustrates the power of the CyFIR Incident Response Services to dramatically improve an organization’s Incident Response capabilities.
eSentire, Inc., the Authority in Managed Detection and Response (MDR), protects the critical data and applications of 2000+ organizations in 80+ countries, across 35 industries from known and unknown cyber threats by providing Exposure Management, Managed Detection and Response and Incident Response services designed to build an organization’s cyber resilience & prevent business disruption. Founded in 2001, eSentire protects the world’s most targeted organizations with 65% of its global base recognized as critical infrastructure, vital to economic health and stability. By combining open XDR platform technology, 24/7 threat hunting, and proven security operations leadership, eSentire's award-winning MDR services and team of experts help organizations anticipate, withstand and recover from cyberattacks. For more information, visit: www.esentire.com and follow @eSentire.