Laserfiche WebLink
01/12/2021 12.E.1. <br />,s�wv—� <br />� K What is Extended Detection and Response <br />• EDR is an integrated end point security solution that combines real-time <br />continuous monitoring and collection of endpoint data with rules -based <br />automated response and analysis capabilities to enable cyber security teams to <br />quickly identify and respond to threats. <br />• The primary functions of an EDR security system are to: <br />• Monitor and collect activity data from end points that could indicate a threat. <br />• Analyze that data to identify threat patterns. <br />• Automatically respond to identified threats to remove or contain them, and to notify <br />cybersecurity personnel. <br />• Provide forensics and analysis tools to search for/research suspicious activities. <br />• It is possible to automate the EDR system response to many, but not all, of the <br />alerts generated by end points. <br />• To ensure that all alerts are responded to appropriately the EDR system must be actively <br />monitored <br />1/12/2021 12.E.1. <br />0 EPP & EDR Upgrade Products Considered <br />• IRC IT staff reviewed a number of EPP and EDR tools from various suppliers <br />• The list software products considered for recommendation was reduced to the <br />list below because these particular products each met all of the criteria of an EDR <br />solution. <br />1. Sentinel One <br />2. Carbon Black <br />3. Crowdstrike <br />4. GreyMatter <br />5. Rapid? <br />6. Secureworks <br />• Of the products reviewed the Sentinel One product was deemed to best meet <br />the County's requirements based on a combination of functionality and price <br />1/12/2021 12.E.1. <br />