How Threats Are Managed in Dell Endpoint Security Suite Enterprise
Summary: How Threats Are Managed by Dell Endpoint Security Suite Enterprise.
Symptoms
- As of May 2022, Dell Endpoint Security Suite Enterprise has reached End of Maintenance. This article is no longer updated by Dell. For more information, reference the Product Life Cycle (End of Support / End of Life) Policy for Dell Data Security. If you have any questions on alternative articles, either reach out to your sales team or contact endpointsecurity@dell.com.
- Reference Endpoint Security for additional information about current products.
Affected Products:
- Dell Endpoint Security Suite Enterprise
The Advance Threat Protection Client component of Dell Endpoint Security Suite Enterprise uses three phases in threat mitigation:
- Detection: How a threat is located.
- Analysis: How a file is identified as a threat.
- Remediation: How threats are handled
- This article is meant as a high overview on the threat mitigation process.
- If the local model updates with an ATP client update, a background threat detection is initiated for Dell Endpoint Security Suite Enterprise, and a re-scoring of all threats may occur. For more information, reference Updates to Dell Endpoint Security Suite Enterprise Advanced Threat Protection detection method.
Cause
Not Applicable
Resolution
Figure 1: (English Only) Detection Phase
File Hash: The Advanced Threat Protection client initially checks if the file checksum (known as a hash) was previously identified as a threat. The hash can be set to:
- Safelist the file
- Quarantine the file
If a hash is not available, then Advanced Threat Protection detects threats by:
- Execution Control: Launched (run) files
- Process Scan: Processes running and configured for auto-start
- Memory Protection: Data in memory
- Background Threat Detection: Advanced Threat Protection runs in the background and scans all.
If a threat is detected, then Advanced Threat Protection moves into the Analysis Phase.
Figure 2: (English Only) Analysis Phase
Once a threat has been detected, Advanced Threat Protection classifies:
If a threat was found during the detection phase, then a local threat score is assigned.
If the endpoint is connected and online, the hash value of the threat is sent to the cloud. If the cloud threat score differs from the local threat score, the cloud threat score is relayed to the endpoint, and the cloud threat score overwrites the local threat score.
If the auto-upload policy is enabled, then the threat is uploaded to the Cylance Tenant.
Once a threat score is assigned, the data is given an unsafe or abnormal attribute and then Advanced Threat Protection moves into the Remediation Phase.
Figure 3: (English Only) Remediation Phase
Once a threat score and classification has been assigned, Advanced Threat Protection determines:
Should the threat be safe-listed? If so, the file hash is added to the endpoint and no further action is taken on the file.
If the threat is not safe-listed, then Advanced Threat Protection checks if the Auto Quarantined policy is enabled. If Auto Quarantine is enabled, then the threat is quarantined.
If auto quarantine is not enabled, then a check is done to determine if the file has been manually set to quarantine by the DDP Administrator. If the threat is set for quarantine, then file hash is added to endpoint's local database and then the file is quarantined.
If the threat is not safe-listed or quarantined, then an alert is sent to the console for DDP Administration visibility and potential action.
To contact support, reference Dell Data Security International Support Phone Numbers.
Go to TechDirect to generate a technical support request online.
For additional insights and resources, join the Dell Security Community Forum.