Hello everyone here’s Andreano Lanusse End-User-Computing staff architect at vmware Thanks for joining
today on the technical overview I'm here today to show you how the integration between Workspace
one intelligence and carbon black cloud can be leveraged to external Endpoint protection
and threat remediation to get started let me give you an overview on how the integration
works and how you can achieve that let's start with Workspace one uem which managed the device
and security policies to increase security of the Endpoint next uem manages the deployment
of carbon black cloud sensor to ensure that extend protection against attacks on every
managed device as the user starts using the device threats can be identified by carbon
black cloud sensor and immediately remediated based on the carbon black policies supplied
to the device
those identified threats are sent to carbon black cloud for advanced analysis and to provide
administrators visibility on what's going on the environment the reported threats generates
notifications that are continuously stored by Workspace one intelligent and stored as
part of the intelligence Cloud service
intelligence has a built-in automation engine that evaluate incoming threat data against
defined rules to take automatic actions on security issues as an example you can define
an automation action that will remove a per app profile from the device that type of action will call
UEM API to achieve the result on the device also you can take other types of actions like
put the device in quarantine which isolates a vulnerable device from the corporate network
and limit the communication only with carbon black cloud this type of action leverages
the automation custom connector from Workspace one intelligence and enables actions against
Solutions that provide rest API interface
let me show you a real demo where the device is under attack and how the Workspace one
intelligence and carbon black integration help to quickly remediate the threat automatically
isolated a device from the network notifying infosec and IT team about the attack enable
quickly investigation let's start with my Windows 10 machine when I'm connected via
a remote desktop I'm going to simulate two attacks on this machine and the first one
you can see that carbon black is already detected I'm simulating here 15 ransomware and 1 cryptomining
infection and that simulator will show if the device is vulnerable or not in addition
to that I'm going to be performing suspicious activity on this device where I'm going to
be unregister a DLL and at the same time execute a remote code for URL
I’m leveraging regsvr32 windows too that can be used with bad intentions to harm the
device and execute malicious code on your machine the result of the integration between
Workspace one intelligence and carbon black automation will kick in and notify IT security team
via slack about the ongoing attack that is happening on their environment the IT team
will be able to quickly identify that notification what devices be impacted and also what are
the details about the attack thats ongoing a second action where is secured by Workspace
ONE intelligence that results on the loss of connectivity with this device Workspace
one intelligence call the carbon black quarantine API that restrict any communication of this
device with only carbon black cloud since I’m no longer able to communicate with that
machine I switch to another one and on the slack notification I have a direct link to
the carbon black alert that was generated by their attack I go on that link and that
direct me to the carbon black console where I can see a list of events that has been generated
since the attack starting from the bottom you can see the list of events that happened
on this attack the ransomware try to initiate another executable and that action was terminated
by carbon black following actions were denied access to the executable and that were protecting
the Endpoint since the device later were in quarantine other software on these endpoints
try to communicate externally and that communication was blocked you can see that slack here that
were trying to communicate externally and that was not possible on the alerts page you can see aggregation
of our events that happened for the specific attack you can see the severity of the device
impacted and then you can initiate an investigation which helps you to perform a triage of the
attack that just happened that nice visualisation show the sequence of events and now the software
there were involved into the attack you can see here from the visualization that from
the top I have the initial events that were initiated by the ransomware and later the
device went in quarantine in other applications on my device were trying to access internet
like this slack and we are not able to do because of the device being quarantined
on the endpoint you can see that my device is under quarantine after my initial investigation
based around events I now need to connect to the device and have live view of what's
going on there I can use the Live response to connect to the device and perform remote
commands on that device for example I can search for specific DLL and a specific directory
and see if that is available there or not I can also query for specific keys on the
registry and also modify add or delete the ones I need to on the UEM console you can
see that the device under attack were tagged as quarantined devices that were part of their
automation and security by Workspace one intelligence and that helps the IT administrator to understand
why this device will not be reported status under that tag
also it helps to improve the communication between security and the IT switching now
into the Workspace one intelligence we can take a look and automation and see all the
details that were secured behind the scenes here this automation is looking for new
incoming events from carbon black as part of the condition is established here only look
for events coming from Windows platform and I'm looking for events threats severity medium
and high in the past the generated 24 events and if it's change that threat severity add
low you can see that in the past that generated 227 events as part of the action we are leveraging
here custom connector to call carbon black rest API and put device in quarantine the
device ID is specified by lookup value that is available Workspace one intelligence
All the other actions sending mail tag the device create a ticket in servicenow in slack are using
the out of the box connector and you can see that you can customize the message and add
Specific information about the threat the device using the lookup values
After the security team finalize the investigation and concluded that the device is no longer
compromise the device can be unquarantine through the carbon black console after the
un quarantine process the device is able to communicate externally and I am now able to
perform a remote desktop on this device I'm going to be returned to the latest stage where
I left the device and with that you can see that the simulator finalise their execution
and none of their ransomware and cryptomine were able to compromise the device because
carbon black remediate all of them and that's it for today if you want to learn more about
this integration between intelligence and carbon black check it out techzone.vmware.com
we provide the full tutorial and step-by-step guidance for you to perform all the integrations
and achieve the same results on your environment thanks for watching and see you next time