Advanced Persistent Threats
With Enginsight's Advanced Persistent Threats (APT) feature, you can scan all hosts on which a Pulsar was installed for sophisticated, persistent threats.
You can use more than 7,100 predefined rules managed by Enginsight, or create custom rules that are used by default for scanning for APTs.
Requirements
Enabling the APT Feature
To scan your hosts for active persistent threats, you must enable the Advanced Persistent Threats option in the settings of the individual hosts or under Hosts → Policies via a corresponding policy.
Important Notes
All rules managed by Enginsight are automatically updated and extended every 24 hours.
Running an APT Scan
Running a scan for APTs can take several hours, depending on how many files and directories are scanned.
When running an APT scan on a host, the maximum number of detected APTs is limited to 100. Once this limit is reached, the scan stops automatically. This measure allows us to ensure that only relevant detections are included in the analysis and that the database is not overloaded unnecessarily.
Because APT scans generate a high system load, we recommend that you run a scan of all files and directories on the hard drive no more than once per week.
APT: Menu Structure
Under Hosts → Advanced Persistent Threats, you will find various options for detecting and defending against sophisticated, persistent threats to your IT systems.
Click the Advanced Persistent Threats menu item to expand or collapse the corresponding submenu.
The following submenu items are available:
Click and hold the Advanced Persistent Threats menu item to move it, including all submenu items, within the menu tree using drag and drop.
Last updated
Was this helpful?