OpenText Endpoint Forensics & Response
实时发现、控制和修复威胁
评估您的 DFIR 就绪度进行快速测验
当精确取证与实时响应相结合
您的安全团队面临着迅速调查和响应网络威胁的紧迫需求，以最大限度减少损害、保存证据并恢复信任。将混乱局面转化为实用洞察。
为什么选择 OpenText Endpoint Forensics & Response？
通过近乎实时的威胁遏制和深度取证可见性，增强 SOC 的能力。快速调查攻击、隔离端点并修复威胁，从而缩短停留时间、保留证据并提高网络弹性。
- 75%
缩短威胁应对时间
通过集成的终端隔离功能，团队可以在不离开调查工作流程的情况下立即遏制威胁，从而缩短响应时间。 - 4 倍
更快缓解威胁
直接从取证工作流程中中和恶意或未经授权的文件，消除威胁，同时保持证据的完整性。 - 100%
控制威胁环境
确保风险活动的持续可见性和可操作性，无需等待其他团队、工具或物理访问权限。
用例
我们的 DFIR 解决方案对于漏洞调查、内部威胁检测、法规遵从、勒索软件响应、威胁猎取和电子取证至关重要。它使 SOC 团队有能力发现根本原因、遏制威胁，并确保可防御的报告。
-
发现员工或承包商的可疑行为，例如数据盗窃、破坏或不当访问。利用终端证据、文件访问日志、注册表分析和行为取证来构建可辩护的案件。
-
识别遭到入侵的系统，隔离受影响的端点，终止恶意进程，删除或隔离感染文件——所有操作都不会中断运营。
-
主动利用文件哈希值、域名、IP 地址和自定义 YARA 规则搜索入侵迹象 (IoC)。检测传统工具可能遗漏的隐蔽威胁。
-
追踪感染载体，确定影响范围，识别勒索软件变种，并支持恢复工作。重建攻击时间线，以了解漏洞是如何发生的。
-
通过提供防篡改的证据收集、证据链完整性和完整的取证文档，满足 GDPR、HIPAA、PCI-DSS 和 SOX 的要求。
-
调查国家级或高技能行为者的活动。重建跨越时间范围的攻击者行为、注册表操作和工具使用情况。
关键功能
从隔离受到攻击的端点到消除主动威胁并找出根本原因，OpenText Endpoint Forensics & Response 使安全团队能够缩短停留时间、控制风险并精确地保护企业运营。
企业级端点可扩展性，支持扩展到超过 1,000,000 个端点
支持企业级调查，而无需牺牲性能，适用于全球环境。
以成果物为驱动的工作流程
允许分析人员快速分流端点，而不是对整个系统进行成像，这是在分秒必争的实时事件响应中的关键优势。
综合威胁分析
使 DFIR 团队能够标记已知的恶意指标，例如正在运行的进程、IP 地址、文件哈希或 DNS 缓存。这种早期预警有助于在威胁升级前识别并消除。
零信任自动化框架
支持零信任环境下的集合。它每五分钟检查一次，提供对端点状态和活动的近乎实时的可见性，无论端点是在 VPN 上还是不在 VPN 上。
终端隔离
即时遏制威胁，同时保留取证访问权限，在不丢失上下文的情况下阻止横向移动。
文件和流程补救
在不中断运行的情况下清除恶意文件，同时立即阻止活动威胁，这对最大限度地降低攻击影响至关重要。
支持 YARA 的 IoC 扫描
通过自定义规则主动检测威胁，提高检测精确度和广度。
注册表搜索和实时修复
实时识别并禁用持久性机制，这是彻底消除威胁的关键。
加速提升 OpenText Endpoint Forensics & Response 的价值
Add-ons
探索 OpenText DFIR 解决方案的完整产品组合，旨在通过收集和分析数字证据来检测、调查和响应网络安全事件，使组织能够了解攻击的性质、范围和影响。
-
谨慎收集、保存和控制电子存储信息 (ESI)，用于诉讼、调查、监管响应和电子取证
OpenText™ Information Assurance
-
更快地捕获、收集和分析关键移动设备证据
OpenText™ Mobile Investigator
-
高性能便携式解决方案可捕获和分析数字证据，确保远程调查和实验室调查的速度、完整性和可靠性
OpenText™ Forensic Equipment
专业服务
OpenText 专业服务将端到端解决方案的实施与全面技术服务相结合，以优化系统。
-
让值得信赖的合作伙伴为您指引信息管理之路
您的成功之路
-
加快您的信息管理之旅
咨询服务
-
利用现代解决方案，推动您的业务迈向未来
NextGen Services
-
释放信息管理解决方案的全部潜力
客户成功服务
合作伙伴
OpenText 帮助客户找到合适的方案、恰当的支持与理想的结果。
-
搜索 OpenText 合作伙伴目录
寻找合作伙伴
-
浏览 OpenText 的合作伙伴解决方案目录
应用程序市场
-
增强 OpenText 产品和解决方案的行业领先组织
战略合作伙伴
培训
OpenText 学习服务提供全面的赋能和学习项目，加速提升知识和技能水平。
-
了解如何使用 OpenText 软件对嫌疑人的数字足迹进行快速且可靠的调查
OpenText Learning Services
OpenText Endpoint Forensics & Response resources
-
It’s a unified platform that combines deep digital forensics investigation with near real-time incident response, allowing SOC teams to investigate, isolate, and remediate threats all from a single platform.
-
OpenText Endpoint Investigator performs remote, forensically sound evidence collection at scale (on- or off-VPN) to help investigators see what happened. OpenText Endpoint Forensics & Response adds incident response capabilities, enabling SOC personnel to act on what happened by containing impacted endpoints faster and accelerating recovery. OpenText Endpoint Forensics & Response provides complete DFIR capabilities in a single platform and is the unsung hero of cybersecurity. Customers who already have OpenText Endpoint Investigator (the DF part of DFIR) can add incident response (the IR part of DFIR) functionality simply by purchasing an add-on to their existing deployment.
-
EDR tools focus on detection and alerts. SIEMs aggregate data. OpenText Endpoint Forensics & Response is designed for action, offering built-in forensic capabilities and response workflows, including endpoint isolation, file deletion, registry remediation, and memory analysis. It also facilitates SOC workflows by offering robust APIs that connect with existing SIEM, SOAR, and threat intelligence tools, enabling automation of response workflows, contextual enrichment, and playbook orchestration across your security ecosystem. SOC professionals can dig deep into forensic evidence and take direct response actions all in a single interface, resulting in faster decision-making.
-
Term licenses are available in one-, two-, or three-year terms. Pricing is based on a per-node model in which each license permits deployment on a specified number of endpoint “nodes” within your network. Once a node is covered, you gain unlimited usage of key components on that node.
-
OpenText Forensic is a digital forensics tool that has no response capabilities. It is designed for lab-based forensic analysis of seized or powered-off devices. OpenText Endpoint Forensics & Response is a complete DFIR solution designed for enterprise SOC teams, internal investigators, and incident responders needing to conduct remote, live endpoint data collection and triage.
-
Yes. Analysts can isolate Windows endpoints, terminate malicious processes, and securely delete files in near-real time, without disrupting forensic access or switching to another tool. These capabilities are natively integrated into the investigation workflow.
-
The platform is designed to operate under zero-trust principles, with secure, off-VPN data collection, robust access controls, and centralized command. It ensures no data is exposed during investigations, even in compromised environments.
-
It’s optimized for insider threat investigations, ransomware response, APT detection, endpoint triage, and compliance-driven audits. Use cases range from real-time breach containment to HR investigations and regulatory response. Built to support over one million endpoints, it offers automated agent deployment, real-time check-ins, and scalable collections across global environments, making it the ideal digital forensics and incident response solution for large SOCs managing thousands of endpoints.
Why DFIR is the missing piece in your Zero-Trust strategy
Digital forensics and incident response closes security gaps and aligns with zero‑trust architecture.
Read the blog
DFIR: The unsung hero of cybersecurity
Learn how integrating DFIR into your security strategy transforms a reactive posture into a resilient one.
Read the blog
Deliver faster, deeper, and more defensible digital investigations
OpenText DFIR tools bring speed, depth, clarity, and legal defensibility to digital investigations.
Read the blog
Enhance secure information management with DFIR
DFIR and information management unite to protect data, boost compliance, efficiency, and resilience.
Read the blogOpenText Endpoint Forensics & Response
Read the product overviewA day in the life of a SOC analyst with DFIR
View the infographicWhy it pays to act fast with OpenText Endpoint Forensics & Response
View the infographicOpenText Endpoint Forensics & Response
Read the product overviewA day in the life of a SOC analyst with DFIR
View the infographicWhy it pays to act fast with OpenText Endpoint Forensics & Response
View the infographicSee what others miss: OpenText Endpoint Forensics & Response in action
Watch the video
Precision under pressure: Investigate fast and respond faster
Watch the video
迈出下一步
回复和保存
