4 ms·
> Thankfully we had Crowdstrike on it which blocked any real damage For someone not familiar with their products, what did they do for you specifically?
by vasco 5y ago
> Thankfully we had Crowdstrike on it which blocked any real damage
For someone not familiar with their products, what did they do for you specifically?
- wcchandler 5y agoFor us specifically they blocked the server from downloading more assumedly dangerous tools. Blocked more privilege escalation and blocked crypto mining software from running. Our teams were also able to do a “network isolation” and essentially bring the server offline quickly, without touching more pieces and possibly exposing our credentials or tokens. We also had the paid Overwatch protection which is Crowdstrikes 24/7 security monitoring solution which resulted in an actual person emailing half our team at 1am letting us know this was happening and their recommended remediation steps.
- deleted 5y ago[deleted]
- SV_BubbleTime 5y agoI would explain it as next gen antivirus. Looks closer at hashes and heuristics of all data in and out to a server. It seems crazy that everything that is read or written is hashed and compared to a db, but it works. FWIW, we dumped crowdstrike for Cisco AMP and have been happy.