G DATA MXDR

Prevent → Minimize vulnerabilities and prevent incidents.

Stop malware → By default, malware is stopped and, if possible, moved to quarantine. If this function is disabled on a system, malware will continue to be logged and analyzed by our analysts.

Learning mode (applies to service level G7 and G5 over 50 seats) → "Stop malware" is disabled during the first two weeks. Potential false positives can be resolved during this period without negatively impacting production.

Risk: A previously known piece of malware or riskware can be executed on the system and thereby used for data exfiltration, abuse of access rights, or privilege escalation.

Detect → Make incidents visible using sensors and detection patterns.

Exclusions → Certain applications or folders are no longer monitored.

Risk: In the event of a vulnerability, software can be exploited, or a folder can be used to execute or distribute malicious content. Execution of the malicious content is then not prevented and, in addition, is not detected.

Respond → Respond to incidents and limit damage.

Response by analysts → On systems where remote analysis & response is disabled, no response actions such as network isolation or data collection may take place. Response by analysts is enabled by default (24/7).

Risk: At the relevant time, no decision can be made by G DATA, and therefore an incident cannot be stopped / contained at the time it is detected. In such a case, G DATA sends a response recommendation to the Customer, which can then only be implemented with a time delay.