ManageEngine Endpoint Central’s Anti-Ransomware
A Holistic Ransomware Protection Software
Ransomware has evolved into a sneaky and expensive security threat that hangs over businesses. ManageEngine’s Anti-Ransomware is an out of the box solution that is geared to detect and resolve ransomware infections at an early stage while causing the least amount of disruption. The software’s intelligent behavior detection techniques swiftly detect anomalies in file activity with maximum accuracy and enables in putting up a proactive front against future attacks. It is also equipped with a fail-safe recovery feature that restores your data safely.
Highlights
-
Detect: Automatically detect unusual file alterations on your endpoints that resemble a ransomware attack.
-
Resolve: Analyze the incident and determine whether it was a real positive or a false positive.
-
Recover: Instantly obtain a non-erasable backup of all the files that were compromised in the attack.
An endpoint security solution armed to parry the blow of a ransomware attack
Machine learning-assisted behavior analysis
Anti-Ransomware uses machine learning-based behavior detection algorithms to broaden the scope and enhance the accuracy of detecting ransomware attacks, which is a considerable improvement over outdated signature-based approaches. When a process that resembles a ransomware pattern has browsed a file, encrypted it, and updated it, an alert is raised. Following that, the alerts are sorted and documented as incidents.
Single-step incident response technique
When an anomaly is discovered, it is resolved by examining the process and flagging it as a true positive or false positive incident. The file recovery process is initiated if it is a true positive. If the process is identified as a false positive, a similar one in the future will be automatically flagged as a false positive.
One-click recovery of protected file backups for a reliable rollback
Anti-Ransomware leverages Microsoft’s VSS service to obtain shadow copies of all the files on an endpoint every three hours. All infected files are reverted to the most recent copy of the file stored, on the confirmation, following a ransomware attack. The files are automatically restored if the same ransomware attack occurs again.
Trusted executables can be excluded for a smooth sailing workflow
When it comes to endpoint protection, Anti-Ransomware takes a zero-trust approach. Trusted executables that are known to be safe and benign can be excluded with the Exclusions feature and can be exempted from real-time behavior detection and incident notifications to preserve productivity. To prevent unintentional attacks through the Exclusions list, this exclusion list can be further limited by specifying Signed Certificates and Allowed Folders in which they are to be exempted.
Detect, mitigate and restore encrypted files post a ransomware attack using Endpoint Central