empayre/fleet
14
0
Fork 0
mirror of https://github.com/empayre/fleet.git synced 2024-11-06 08:55:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

🕳️👖 vs 🐍👖 (#16265)

Browse Source 
Malware detection is not exclusively "vuln management" (arguably not VM
at all)


like finding a snake in your pants vs a hole in your pants
This commit is contained in:
Mike McNeil 2024-01-22 18:28:56 -06:00 committed by GitHub
parent 0f245df4fe
commit a750a23b24
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
handbook/company/pricing-features-table.yml
View File

@ -187,7 +187,7 @@
# ╔╦╗╔═╗╦ ╦ ╦╔═╗╦═╗╔═╗ ╔╦╗╔═╗╔╦╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔ ┌─╦ ╦╔═╗╦═╗╔═╗─┐
# ║║║╠═╣║ ║║║╠═╣╠╦╝║╣ ║║║╣ ║ ║╣ ║ ║ ║║ ║║║║ │ ╚╦╝╠═╣╠╦╝╠═╣ │
# ╩ ╩╩ ╩╩═╝╚╩╝╩ ╩╩╚═╚═╝ ═╩╝╚═╝ ╩ ╚═╝╚═╝ ╩ ╩╚═╝╝╚╝ └─ ╩ ╩ ╩╩╚═╩ ╩─┘
- industryName: Malware detection (YARA) # TODO: consider: technically more than YARA, consider generalizing this and including the concept of comparing known binary hashes (either via live query or in the data lake to compare threat intel feed)
- industryName: Malware detection (YARA/custom IoCs) # TODO: consider: technically more than YARA, consider generalizing this and including the concept of comparing known binary hashes and other IoCs (either via live query or in the data lake to compare threat intel feed)
friendlyName: Scan files for malware signatures
description: Report and trigger automations when malware or other unexpected files are detected on a host using YARA signatures.
documentationUrl: https://fleetdm.com/tables/yara
@ -195,7 +195,7 @@
dri: mikermcneil
usualDepartment: Security
productCategories: [Endpoint operations,Vulnerability management]
pricingTableCategories: [Vulnerability management]
pricingTableCategories: [Endpoint operations,Vulnerability management]
buzzwords: [YARA scanning,Cyber Threat Intelligence (CTI),Indicators of compromise (IOCs),Antivirus (AV),Endpoint protection platform (EPP),Endpoint detection and response (EDR),Malware detection,Signature-based malware detection,Malware scanning,Malware analysis,Anomaly detection]
demos:
- description: A top media company used Fleet policies with YARA rules to continuously scan host filesystems for malware signatures provided by internal and external threat intelligence teams.