VMware Carbon Black CB Response
Industry-Leading Incident Response and Threat Hunting

Overview:

Enterprise security teams struggle to get their hands on the endpoint data they need to properly investigate and proactively hunt for abnormal behavior. Security and IT professionals lack the ability to see beyond suspicious activity and need a way to dive deeper into the data to make their own judgments.

CB Response is an industry-leading incident response and threat hunting solution designed for security operations center (SOC) teams. CB Response continuously records and stores unfiltered endpoint data, so that security professionals can hunt threats in real time and visualize the complete attack kill chain. It leverages the CB Predictive Security Cloud’s aggregated threat intelligence, which is applied to the endpoint activity system of record for evidence and detection of these identified threats and patterns of behavior.

Top SOC teams, IR firms and MSSPs have adopted CB Response as a core component of their detection and response capability stack. Customers that augment or replace legacy antivirus solutions with CB Response do so because those legacy solutions lack visibility and context, leaving customers blind to attacks. CB Response is available via MSSP or directly via onpremises deployment, virtual private cloud or software as a service.

CB Response provides advanced tools enabling SOC teams to understand the current state of an endpoint, perform remote live investigations, intervene with ongoing attacks and promptly remediate endpoint threats. As new patterns and indicators emerge, they are assessed against historical endpoint data to identify previously unknown attacks.

The CB Predictive Security Cloud supports a variety of powerful next-generation endpoint security services, all of which are powered by the collective intelligence generated in the PSC. This collective intelligence is generated from data collected across millions of endpoints under management and enriched with threat intelligence from around the world in real-time.

Threat Hunting and IR, now on the CB Predictive Security Cloud

CB ThreatHunter is the latest addition to the CB Predictive Security Cloud. It delivers advanced threat hunting and IR capabilities to the same single agent that powers our breakthrough prevention and industry-leading detection and response.

Unfiltered Visibility

Investigations that typically take days or weeks can be completed in just minutes. CB Response captures comprehensive information about endpoint events, giving security professionals a clear understanding of what happened.

1. Access the complete activity record of every endpoint, even if it's offline
2. See what happened at every stage of an attack with intuitive attack chain visualizations
3. Uncover advanced threats and minimize attacker dwell time

---

Proactive Threat Hunting

CB Response's sophisticated detection combines custom and cloud-native threat intel, automated watchlists, and integrations with the rest of your security stack to efficiently scale your hunt across the enterprise.

1. Fast search, zoom, and visualization of process trees and timelines to pinpoint threats
2. Consolidate threat intelligence for your environment to automatically detect suspicious behavior
3. Correlate network, endpoint, and SIEM data through open APIs and out-of-the-box integrations

---

Respond Immediately

An attacker can compromise your environment in an hour or less. CB Response gives you the power to respond and remediate rapidly, stopping active attacks and repairing damage quickly.

1. Isolate infected systems and remove malicious files to prevent lateral movement
2. Secure shell access to any endpoint with Live Response
3. Automatically collect and store detailed forensic data for post-incident investigation