安恒国际集团有限公司 | DBAPP-EDR
Introduction of 安恒国际集团有限公司
DBAPP-EDR
EDR is a host security product that integrates rich system reinforcement and protection, network reinforcement and protection, and other functions Defense against known and unknown types of ransomware EDR can not only prevent the execution of known ransomware, but also use a bait engine to detect and block the encryption behavior of unknown types of ransomware that traditional antivirus software is powerless against, effectively safeguarding host security. Defense against advanced threats and full process attacks Based on the ATT&CK theory, EDR provides protection for various stages of offensive and defensive confrontation, including single machine expansion, tunnel construction, intranet detection, remote control persistence, and trace removal. Not only can it achieve threat attack auditing, but it can also prevent hackers from conducting penetration attacks, achieving 360 degree defense against attack and defense. Simple configuration, offline upgrade, patch management EDR supports users in making independent security configurations, enabling clear and effective host protection.

Asset Inventory

  1. Host Discovery‌: Real-time detection of unmanaged assets or assets without security software installed, eliminating network blind spots.
  2. Application-Based Inventory‌: Precise identification and dynamic monitoring of asset information with clear, intuitive visualization.
  3. Comprehensive OS Support‌: Full compatibility with mainstream Windows, Linux, and Xinchuang operating systems. Supports inventory management for PCs, servers, virtual machines, cloud desktops, and cloud platforms.

Baseline Inspection
Customizable inspection tasks covering asset scope, baseline policies, and scheduling. Baseline checks for mainstream operating systems (Windows, Linux, SUSE, etc.) aligned with Level 1 to Level 4 compliance baselines (per China's classified cybersecurity standards).

Malware Detection and Removal

  1. Multi-Layer Protection‌: Combines local engine scanning, central engine detection, and cloud engine analysis for 360° protection, resolving delays in threat detection.
  2. AI-Powered Threat Intelligence‌: Leverages world-leading antivirus engines, AI behavior analysis, and cloud threat intelligence to expose hidden threats.
  3. Proactive Defense‌: Proprietary engines (e.g., ‌Immune Engine‌, ‌Decoy Engine‌) break the cycle of reactive antivirus responses, drastically reducing protection response times.

Ransomware Defense
Kernel-level multi-dimensional defense engines:

  1. Ransomware Decoy Engine‌: Deploys decoy files in critical directories. Terminates ransomware processes when encryption attempts are detected, blocking further file encryption and spread.
  2. Ransomware Behavior Engine‌: Analyzes system APIs and common ransomware traits from a behavior library to counter unknown ransomware.
    Dual engines ensure real-time, accurate protection of critical data by intercepting ransomware activities.

Micro-Segmentation
Isolates traffic between services, blocks unauthorized traffic, and enables one-click port blocking or risk host isolation to halt lateral threat movement.

Traffic Profiling
Captures endpoint traffic to map communication relationships between hosts via a panoramic traffic view, enabling full-scenario security visualization.

Environmental Awareness
Five core awareness capabilities:

  • Vulnerability risk
  • Malware risk
  • Network risk
  • Application compliance
  • Endpoint health

Network Zoning and Isolation
Divides networks into access zones. Assets can switch zones based on business needs to enable "multi-purpose usage on a single device" while preventing cross-network threat propagation.

File Vault
Secures critical data files in real-time by defining access policies and allowing only legitimate processes to access data, blocking all unauthorized attempts.

CLICK HERE to view the detailed user guide for more information. For more information about the product, please visit the Product Page.