advanced modules faq

No. Verodin SIP’s Actor software can be installed on any production host to test endpoint controls without needing the Protected Theater module. Any Endpoint Actor can test “non-destructive” behaviors, which include things like privilege escalation from mimikatz, data exfiltration and much of the content derived from the MITRE ATT&CK framework. Only potentially destructive use cases require Protected Theater.

SOCs have a basic challenge of being ultimately responsible for defense, but needing to rely on the broader IT team for many tasks. This challenge often impacts the SOC’s visibility into how endpoint defenses are ultimately configured. As executives ask questions like, “Will we block ransomware 123 or attack XYZ?”, analysts are not always sure how the endpoint defenses are configured and if they are even up-to-date.

The Protected Theater enables SOCs to quickly test their endpoint defensive gold images against REAL malware to determine if the defenses are configured to detect and block the threat at the endpoint. Protected Theater enables analysts to quickly answer questions about what will and what will not be blocked on endpoints.

The primary difference is that “continuous” simply implies that an action can be run over and over again – whether this is manually or on a schedule. There is nothing intelligent about “continuous”.

What customers want is to understand if the environment has changed and broken their defenses. Customers want to continuously compare to a known-good baseline and intelligently understand if something has changed in controls visibility, prevention configuration, detection events generated, event flow and configuration and, ultimately, if an alert will fire at the event’s final destination.

Verodin SIP’s Advanced Environment Drift Analysis (AEDA) module is like a "team of engineers in a box", continuously comparing your control environment against your known-good baseline and alerting if any aspect of the Effectiveness Validation Process breaks down. AEDA is critical in combating environmental drift.

Yes. Any email system supporting POP3 or IMAP for receiving and SMTP for sending can leverage Verodin SIP’s Email Theater module. SSL and/or TLS are both supported for sending or receiving.