RSA ECAT Agent - license - 1 host
Mfg # ECAT-SW-LIC-1000
CDW # 3223582
Know your gear
It is widely known that perimeter defenses are inadequate protection against today's advanced threats. There is an increasing gap in traditional signature-based defenses as attackers continuously use the hard-to-detect methods to compromise hosts, establish a hidden presence on target systems, and exfiiltrate sensitive data out of organizations.
Because attackers leverage several established, well exploited antivirus (AV) evasion techniques, the detection rate and effectiveness of traditional AV is significantly reduced and endpoints are left vulnerable to unpatched or unknown vulnerabilities. Upon detecting anomalous and malicious activity on the network with solutions such as RSA Net Witness, security teams must then assess what is happening on the endpoints, where the network traffic is originating or terminating, and capture additional host forensics data for deeper analysis of the attack.
RSA ECAT (Enterprise Compromise Assessment Tool) focuses on automating the detection of anomalies within applications and memory. ECAT first creates a baseline of intelligence based on 'known good' applications, which filters out the background noise, and then starts detecting and highlighting anomalies from compromised machines. Once a single malicious executable is identified, ECAT can scan across thousands of machines to identify other endpoints compromised or at risk.
Because attackers leverage several established, well exploited antivirus (AV) evasion techniques, the detection rate and effectiveness of traditional AV is significantly reduced and endpoints are left vulnerable to unpatched or unknown vulnerabilities. Upon detecting anomalous and malicious activity on the network with solutions such as RSA Net Witness, security teams must then assess what is happening on the endpoints, where the network traffic is originating or terminating, and capture additional host forensics data for deeper analysis of the attack.
RSA ECAT (Enterprise Compromise Assessment Tool) focuses on automating the detection of anomalies within applications and memory. ECAT first creates a baseline of intelligence based on 'known good' applications, which filters out the background noise, and then starts detecting and highlighting anomalies from compromised machines. Once a single malicious executable is identified, ECAT can scan across thousands of machines to identify other endpoints compromised or at risk.