claudio
Across
- 1. A method of threat detection that monitors and scrutinizes processes, file system, registry, and network activities on an endpoint for suspicious patterns, often leveraging machine learning models.
- 7. An advanced policy setting in Nebula that tightens the threshold for flagging suspicious processes, increasing vigilance against unknown threats at the risk of more false positives.
- 9. A type of malware disguised as legitimate software, tricking users into installing it, after which it can gain unauthorized access or perform malicious actions.
- 17. Regular downloads containing the latest threat definitions, behavioral rules, and detection heuristics, essential for keeping endpoint agents up-to-date against emerging threats.
- 20. Configurable alerts within the Nebula console that inform administrators via email or other channels about critical security events or system status changes.
- 24. Acronym for Potentially Unwanted Program, software that may include adware, spyware, or other intrusive features, often bundled with legitimate downloads, as categorized by ThreatDown.
- 26. Logical collections of endpoints within Nebula that allow administrators to apply policies, schedules, and exclusions uniformly to a subset of devices.
- 27. A feature within Nebula that allows administrators to prevent the execution of specific unauthorized or unwanted applications on managed endpoints.
- 28. Network settings on an endpoint or within Nebula that direct outbound communications through an intermediary server, often requiring specific allowances for agent connectivity.
- 34. A latent weakness or flaw within a software application, operating system, or network configuration that could be leveraged by an attacker to compromise system integrity or confidentiality.
- 35. Software that, while not inherently malicious, may pose a security risk due to its functionality, such as remote administration tools that could be misused.
- 36. Specific numerical addresses used in network communication, which must often be explicitly opened or configured in firewalls to allow ThreatDown agents to communicate with the cloud console.
- 40. A statistically significant deviation from established baseline behavior patterns on an endpoint, frequently signaling potential stealthy compromise or advanced persistent threat activity.
- 43. A protection feature within Nebula that defends against repeated, systematic attempts to guess login credentials, often associated with Remote Desktop Protocol attacks.
- 45. A ThreatDown service or component primarily responsible for validating product licensing and subscription entitlements for deployed endpoint agents.
- 49. A ThreatDown backend server component or service responsible for checking and distributing updates for both product versions and protection databases to endpoint agents.
- 50. A specific rule configured within Nebula to bypass security scrutiny for a particular file, folder, process, or website, often used to prevent false positives or accommodate legitimate applications.
- 51. A module that intercepts and evaluates domain name system queries to block access to malicious websites, enforce content policies, and prevent communication with command-and-control servers.
- 54. The systematic process of orchestrating the installation and configuration of endpoint protection agents across a diverse organizational digital infrastructure.
- 55. An advanced endpoint security technology that provides continuous monitoring, deep visibility, and proactive response capabilities to detect and contain sophisticated threats that evade traditional prevention.
- 58. A specialized cybersecurity service providing 24/7 human-led threat hunting, monitoring, and incident response, extending an organization's security capabilities without requiring in-house staffing.
- 60. The proprietary cloud-native platform serving as the centralized command and control for ThreatDown's comprehensive suite of endpoint security solutions.
- 62. A module that systematically scans endpoints to identify software weaknesses and misconfigurations, often using CVSS scoring to prioritize discovered flaws.
- 64. An erroneous detection where legitimate activity or software is incorrectly identified as malicious, requiring administrative intervention or the creation of an exclusion.
- 65. An enhanced security measure that requires users to provide two different forms of verification to log into the Nebula console, beyond just a password.
- 66. Acronym for Content Delivery Network, a distributed network of servers used by ThreatDown to efficiently deliver product updates and protection definitions to global endpoints.
- 67. A type of malicious software that encrypts a victim's files and demands payment, typically cryptocurrency, in exchange for the decryption key, often with a time limit.
- 68. A sophisticated threat detection methodology employed by endpoint protection, which identifies unknown malicious activity by analyzing behavior patterns rather than relying solely on known signatures.
- 69. A stealthy type of malware designed to conceal its presence and activities on a compromised system, often by modifying operating system processes or kernel functions.
- 70. The lightweight client software component deployed on an endpoint, facilitating continuous telemetry and policy enforcement from the Nebula console.
Down
- 2. A category of potentially unwanted software that aggressively displays advertisements, often collecting user data without explicit consent.
- 3. A chronological sequence of records in the Detection Log, providing an unalterable history of security events, administrative actions, and system changes within the Nebula platform.
- 4. A core security feature of the endpoint agent that creates a "safe zone" to prevent unauthorized termination or manipulation of the ThreatDown application itself by other processes.
- 5. A Nebula user role with full view and edit access restricted to specific assigned customer locations or organizational units.
- 6. A security policy setting that requires a password or specific credentials to prevent unauthorized removal of the ThreatDown agent from an endpoint.
- 8. A specific piece of code or a meticulously crafted sequence of commands designed to capitalize on a known software vulnerability, often leading to privilege escalation or remote code execution.
- 10. A specific action taken on a compromised endpoint to prevent it from communicating with other devices on the internal network, containing the spread of threats.
- 11. A discrete cybersecurity event, potentially signifying a breach or compromise, requiring immediate investigation, containment, and root cause analysis.
- 12. A module that enables centralized control over endpoint firewall rules, augmenting network security by regulating incoming and outgoing traffic.
- 13. A broad category encompassing any software intentionally designed to cause disruption, damage, or unauthorized access to a computer system, including viruses, worms, and Trojans.
- 14. An alphanumeric string or digital credential required to activate and validate the legitimate use of ThreatDown products and services, defining features and expiration.
- 15. A comprehensive cybersecurity service that integrates and correlates security telemetry across multiple domains—including endpoints, networks, cloud, and email—with human expertise for proactive threat hunting and rapid incident response.
- 16. The strategic linking of the Nebula platform with external security orchestration, automation, and response (SOAR) or Security Information and Event Management (SIEM) systems for a unified security posture.
- 18. A report within Nebula providing a consolidated view of all initiated actions, such as scans or remediations, along with their current status and completion details.
- 19. The lowest access level within the Nebula console, allowing users to view data and generate reports but without the ability to make any system changes.
- 21. A configuration option for forwarding Nebula's event and detection data to an external security information and event management (SIEM) system for centralized logging and analysis.
- 22. A security feature focusing on preventing threats like phishing, malware, and spam that are delivered via electronic messages, often through attachment scanning and link analysis.
- 23. The highest-level user role in the Nebula console, possessing unrestricted access to platform configurations, user management, and sensitive policy data.
- 25. A granular set of configurable rules within Nebula, dictating the precise operational parameters and security responses of endpoint agents across various organizational groups.
- 29. Malicious software designed to secretly gather information about a user's activities and transmit it to an external entity, often without their knowledge.
- 30. A forensic capability within Nebula that collects and stores extensive endpoint event data, enabling administrators to investigate past activities and reconstruct attack sequences. (Abbr. FRS)
- 31. A historical name for a previous generation of ThreatDown's cloud-based management console, now largely superseded by Nebula but still referenced in documentation for network access.
- 32. Specialized data files generated by the endpoint agent or console, essential for technical support to troubleshoot complex issues like connectivity problems or unexpected behaviors.
- 33. A self-replicating standalone malware that spreads via network connections to infect other computers, often without human interaction.
- 37. A security feature of the endpoint agent designed to prevent unauthorized modification, disablement, or uninstallation of the ThreatDown software by malicious actors or unprivileged users.
- 38. An isolated, virtualized environment utilized for detonating and meticulously observing suspicious files or code in a controlled manner, preventing any impact on the live operating system.
- 39. A powerful command-line interface feature within Nebula that allows administrators to remotely execute commands on isolated endpoints for forensic investigation and advanced remediation.
- 41. Granular system data continuously streamed from protected endpoints, crucial for advanced threat hunting and behavioral anomaly detection within the platform.
- 42. An isolation protocol for detected malicious executables or processes, designed to neutralize immediate threat by preventing further interaction with the host system.
- 44. A Nebula user role providing view access and limited editing capabilities, typically restricted to managing specific sites or entities within a larger organizational structure.
- 46. An action where malicious software or an attacker gains unauthorized control over a system, browser, or network session.
- 47. A feature, often browser-based, specifically designed to identify and block access to fraudulent websites that attempt to steal sensitive user information through deceptive means.
- 48. The precise sequence of automated or manual actions executed to eradicate or neutralize a detected threat, often involving deletion, isolation, or rollback of malicious changes.
- 52. An indicator, often monitored during troubleshooting, reflecting the operational state of the MBEndpointAgent or other core ThreatDown processes on a managed device.
- 53. A module designed to automate the deployment of software updates and security fixes across operating systems and third-party applications, thereby addressing identified vulnerabilities.
- 56. A critical remediation capability in ThreatDown EDR that reverses malicious changes caused by ransomware, restoring affected files to their pre-infection state.
- 57. A deceptive application or program designed to trick users into believing their system has problems, often for financial gain or to install further malicious software.
- 59. A product module extending ThreatDown protection to mobile devices, safeguarding them against malware, risky apps, and network threats.
- 61. A policy-driven feature that regulates the use of removable media and peripheral devices on endpoints to prevent data exfiltration and malware introduction.
- 63. A security directive comprising a pre-approved inventory of applications, executables, or network connections permitted to operate, thereby bypassing standard security checks.