Verisys Integrity Suite is a next-generation file integrity monitoring (or FIM) and change control solution …
that detects changes across your organisation in real-time.
Verisys provides real-time notification, auditing, classification and approval of changes on endpoints …
with actionable forensic insights into unapproved changes and potential attacks.
Let's take a quick tour of the Verisys Console
The dashboard provides an overview of changes across your organisation.
Straight away, we can see an anomaly
changes made by a regular user account
and changes made from a suspicious process
We'll investigate these suspicious changes shortly, but first, let's take a look at how Verisys works
Verisys uses Agent-based file integrity monitoring
with a lightweight Agent deployed to each Endpoint to be monitored
This approach enables real-time change detection
and the capture of a wealth of change intelligence information
Policies define what files and registry objects should be monitored
and how they should be monitored
Verisys ships with carefully crafted Policy templates
based on industry best practices and compliance standards
such as PCI DSS
And of course, you can build your own Policies as needed
In most organisations, a high volume of changes are expected as part of normal day-to-day operations
which can make it difficult to discern the good changes from the bad
This "noise" has historically been a significant barrier for file integrity monitoring...
...but not anymore!
Verisys has incredible noise reduction capabilities
it's built-in rules can automatically assess and approve up to 99% of trusted changes
such as Windows updates
letting you focus on the changes that matter
With Planned Changes, you can also define periods where authorised changes are expected
and should be automatically approved
Once you've configured Policies and deployed the Verisys Agent to your Endpoints
change Events will start coming in
Now let's take a look at those suspicious changes we observed earlier.
First up is a Windows system file that has been overwritten.
Verisys Integrity Suite provides unparalleled visibility into changes across your entire organisation
You can see what was changed…
where…
and when these changes happened…
and even who made the change
Here we can clearly see that a Windows system file has been overwritten
and that the change came from a suspicious process
running from a user-writable location
Now let's look at the Registry change
It was made by the same suspicious process
and we can see a new Windows startup entry has been added
which will execute this obscure file on every boot
The evidence suggests that a user has been phished
they’ve been tricked into executing an Agent Tesla Remote Access Trojan (RAT)
which has evaded perimeter defences and antivirus
Left undetected, the trojan would persist inside the network
stealing and exfiltrating credentials and other sensitive information
But with Verisys deployed to your endpoints
when unapproved changes are made, they will be detected
allowing you to take action
File integrity monitoring and change control are simple and cost effective with Verisys Integrity Suite
To learn more, visit ionxsolutions.com