Session 03
Use Case Deep Dive
Your EDR Fired on an IP.
Here's How to Know if it's Part of Something Bigger.
In our upcoming session, Senior Solutions Engineer, Nick Roy, will demonstrate how to take a single IP alert from your EDR and figure out whether it is an isolated event or one piece of a larger campaign, using IP enrichment, Traffic Origin, and infrastructure clustering in Silent Push.
01
Enrich the IP in Total View
02
Check for proxied connections with Traffic Origin
03
Cluster the related C2 infrastructure
04
Determine campaign scope before you escalate
Nick Roy
Senior Solutions Engineer, Silent Push
