Invinsense Digital Forensic and Incident Response (DFIR)

About

Invinsense DFIR covers both organizations under live attack (Reactive) and the organizations which want to know whether they are attacked or not (Proactive Approach).

It covers full life cycle of all types of incidents:

• Ransomware
• Data Breach
• Business Email Compromise (BEC)
• Covers attacks by all types of adversaries
• Hacktivists
• Insider Threat
• Organized Criminals

Not only does it contain, investigate, and remediate but prevents similar incidents from occuring in the near future

Our Approach

Not only does it contain, investigate, and remediate but prevents similar incidents from occuring in the near future

Sweep:

Analyze the behavior of endpoints and network traffic to identify malicious activity and known connections with bad actors to further identify whether the IT infrastructure is compromised or not.

• Host-based Compromise Assessment utilizing malware identification software
  Option 1 – selected critical endpoints
  Option 2 – all endpoints across the enterprise
• Log analysis on selected applications and endpoints utilizing data analytics techniques
• Network Deception with decoys across landscape

Analyze & Respond :

• Investigate endpoints and network traffic utilizing forensics and third-party analysis tools based on the results of sweep activities
• Malicious activities profiling based on selected log files (for example proxy logs)
• Malicious communication identification
• Command and control analysis
• Sandboxing on detected executables for Malware Analysis
• File processing (e.g. file uploads) analysis
• Create Indicators of Compromise (IOC) and perform enterprise-wide sweep for similar compromise
• Perform further analysis such as digital forensics investigations if required
• Provide recommendations for immediate containment and eradication
• Perform recovery of systems and network to bring back operation at normal capacity

Report :

• Executive Summary
• Detailed analysis
• Threat intelligence (If any malware is found)
• Recommendations on what further actions need to be taken in order to prevent similar attacks in the near future
• Conduct a briefing session to discuss the findings & results

Our Methodology

• Incident Discovery
• Response and Containment
• Investigation
• Remediation
• Prevention

Package

• 30 days
• Up to 1000 assets
• Unlimited Scans
• Remediation
• Prevention