Overview

Proofpoint Threat Response is a force multiplier for security operations that orchestrates and automates incident response. The platform surrounds security alerts with rich contextual data to help security teams prioritize and execute response actions. It collects and analyzes security event context around incidents and investigations, and it collects endpoint forensics to confirm system infections to create actionable profiles of incidents. Based upon the enhanced context, it enables enforcement and quarantine actions automatically or at the push of a button leveraging existing infrastructure.

Threat Response collects and analyzes endpoint forensics from targeted systems to yield a rich snapshot of indicators of compromise (IOC). This information is compared to changes reported by malware analysis tools and other systems to provide insight into the health of the client. In addition, user-designed Powershell scripts can also be pushed endpoints for custom data collection or other activities. Another key capability is checking attacked systems for past infections. When Threat Response performs an on-demand endpoint collection, it checks for IOCs not only from the current attack, but from past infections seen in an organization’s environment. This approach helps quickly and effectively verify whether past infections have spread to the system being targeted now.

Based on the context and forensics collected and analyzed by the system, Threat Response presents a context rich view of the threat. This view allows analysts to take push-button response actions, identify, areas for additional investigation, or turn on automated response such as retract delivered email from users’ mailboxes, add users to low permission groups, or update blocklists of firewalls and web filters.

In addition to the core capabilities, Threat Response includes key incident management functions that enable users and teams to investigate incidents without losing that context while jumping from system to system.