Cybereason – Defense Platform

The Cybereason Defense Platform combines endpoint detection and response, extended detection and response, next-generation antivirus and proactive threat hunting to deliver context-rich analysis of malicious activity. Its organizing concept is the MalOp — short for malicious operation — which assembles every element of an attack into one correlated view spanning affected machines, users, processes and network connections, so an analyst investigates a single operation rather than reconstructing it from dozens of individual alerts. Cybereason argues this materially changes analyst workload, since the correlation work that normally consumes triage time is performed by the platform before a human sees it. The product runs from one agent and one console across all endpoints, and extends beyond the endpoint to ingest and correlate telemetry from identity, cloud, email and network sources for cross-domain detection. Response actions are available directly from the MalOp view, allowing analysts to isolate machines, kill processes and remediate persistence mechanisms across every affected asset in a single operation rather than host by host. The platform is aimed at teams that want prevention, detection and response consolidated with a strong emphasis on investigation speed and reduction of manual correlation.