<p>enSilo only send the users an alert when it has successfully stopped something because too many alerts is a common problem, and with enSilo, the users are free from that problem. You can promptly know what process was misbehaving and what damade were going to happen before enSilo blocked them from communicating or tampering. Remember, the blocked communication happened in real time so there was no outbound connection established.</p>
<h3>FORENSICS HAS NEVER BEEN THIS STRESS FREE</h3>
<p>Traditionally forensics means something bad has happened. Someone snuck through your layers of defense and it&rsquo;s now your job to find out how bad it is. Did they get something? What did they get? How much did they take?</p>
<p>We believe your defense-in-depth will fail. We prevent the consequences when it does. They might be able to get in but they&rsquo;re not taking anything once they&rsquo;re in. So you already know the answer to the biggest question: What did they take? Nothing.</p>
<p>Now that&rsquo;s a pretty bold statement but it&rsquo;s what we do. And we do it very well.</p>
<h3>ONE ALERT PER STOPPED THREAT</h3>
<p>Alerts. Too many alerts is a common problem. We don&rsquo;t want to add to the problem so we only send you an alert when we&rsquo;ve stopped something. We&rsquo;ve caught someone red-handed and you need to know</p>
<p><img src="http://cobaweb.co/project/arimtechV2/contents/tinyMCE/forensics-events.png" alt="" /></p>
<p><strong>When you get an alert you get:</strong></p>
<ul class="list-style">
<li>The process that was stopped from communicating or encrypting</li>
<li>The endpoint that was infected</li>
<li>The specific violating process and path</li>
<li>Destination IP it was trying to communicate to.</li>
<li>Time of event</li>
<li>Why it was stopped</li>
</ul>
<h3>THIS IS AGAINST POLICIES.</h3>
<p>Policies are the set of rules used to determine when bad things are happening and when we stop them. For example, Dynamic Code can be used by malware to run their payload. See. Bad Things. How about an unmapped executable? Nope. Not a good idea to let it free to do what it wants.</p>
<p>Great so now you have some data. What do I do with it?</p>
<p>You want the memory from the endpoint directly? Click. The content on the memory is yours. Now you can inspect to understand what is does. If you want to take the file itself from the disk then you can get that too. Or take the entire memory. Then it&rsquo;s yours to deconstruct, sandbox or whatever.</p>
<h3>CLICK THE FORENSICS TAB</h3>
<p>You can quickly see what process was misbehaving and what bad things were going to happen before enSilo blocked them from communicating or tampering. This is helpful for a very high level view.</p>
<p><img src="http://cobaweb.co/project/arimtechV2/contents/tinyMCE/forensics-chain.png" alt="" /></p>
<h3>YOU&rsquo;VE GOT PLENTY OF TIME</h3>
<p>Note that the blocked communication happened in real time so there was no outbound connection established. You have time to get into the weeds if you want to. But if you take a look at our <a href="http://cobaweb.co/project/arimtechV2/myadmin/contents/contents-album-form/edit/5/remediation.html">Remediation</a> you&rsquo;ll see that you don&rsquo;t have to if you don&rsquo;t want to. No worries.</p>
<div class="cta-demo">
<div class="panel panel-blue">
<div class="panel-body">
<h4>See a Demo of enSilo's real-time data protection platform against advanced attacks</h4>
<a class="btn btn-primary">See a Demo</a></div>
</div>
</div>