Health Services Provider Thwarts Ransomware Attack with RevealX

Real-time insight from the network to the machine

• Using ExtraHop to monitor and analyze east-west traffic, the IT team was able to monitor the client machine and watch, in real-time, each file that the ransomware was reading before quickly isolating impacted assets and stopping the attack from progressing.
  
  

The organization was already using RevealX for network performance monitoring

Smarter investigations uncover root cause

• Using the look-back functionality in the ExtraHop Discover appliance, the security team was able to investigate the employee's activity on his machine, determining that the ransomware came not from a PDF or executable file the user had intentionally downloaded, but from a URI on which the employee had clicked.
  
  

Security inside the perimeter

• Real-time insight into east-west traffic empowers IT and security to detect and track anomalous behavior—like unusual NAS activity—through the entire application delivery chain so they can stop potential breaches in their tracks.
  

Proactive quarantine and alerting

• Using the ExtraHop ransomware bundle, the organization's information security team identified that the malicious file had an unexpected extension and searched for it across the entire infrastructure. This allowed them to quickly identify and isolate compromised systems, as well as create alerts for instances of that file extension moving forward.