Overview
NPAV EDR provides built-in Threat Hunting capabilities that enable security teams to proactively search for Indicators of Compromise (IOCs) across endpoint telemetry collected from managed devices. By leveraging the native endpoint telemetry repository, analysts can rapidly identify suspicious activities, investigate potential threats, and detect previously unknown attacks before they impact the organization.
IOC-Based Threat Hunting
NPAV EDR supports IOC-based searches, allowing administrators and security analysts to search endpoint telemetry using various indicators, including:
- File Hashes (MD5, SHA-1, SHA-256)
- File Names and File Paths
- Process Names
- Command-Line Arguments
- IP Addresses
- Domain Names and URLs
- Registry Entries
- User Accounts
- Endpoint Names
- Security Events and Alerts
These searches help identify compromised endpoints, trace attack activity, and investigate potential security incidents across the enterprise.
Endpoint Telemetry Analysis
NPAV EDR continuously collects and stores endpoint telemetry, providing valuable context for threat hunting and forensic investigations. Security analysts can review historical endpoint activities, correlate events, and analyze suspicious behavior to detect advanced threats and Indicators of Compromise (IOCs).
Centralized Investigation
Threat hunting is performed through the NPAV EDR Management Console, providing a centralized interface for:
- IOC-based searches across managed endpoints.
- Investigation of endpoint security events.
- Correlation of alerts and endpoint telemetry.
- Identification of suspicious processes and activities.
- Rapid incident investigation and response.
Key Benefits
- Native IOC-based threat hunting.
- Search across centralized endpoint telemetry.
- Faster identification of compromised endpoints.
- Improved visibility into endpoint activities.
- Accelerated incident investigation and response.
- Centralized threat hunting through the NPAV EDR Management Console.
