Category:Incident Response

The Tanium Incident Response Content Pack helps organizations assess and identify active endpoint threats in real time. Active threat analysis has traditionally been a game of whack a mole, with the threat always one step ahead of forensic and security analysts. A few of the capabilities available in the IR Content Pack include:

• Identify running processes and unique hash
• Pinpoint outlier running process files with hashes different than general population.
• Identify mutex of all currently running processes.
• Recently created executables.
• Collection of suspicious binaries or files.
• Explore semaphores on machines.

Please see the link below for more details on the Incident Response Content Pack.

For a demonstration please contact your TAM or have us contact you.