Netwrix Threat Prevention

Send contextual alerts showing what was blocked and why

Alert security teams to policy violations and potentially malicious behavior

Real-time alerts and immediate enforcement on policy violations

Feed real-time event data to SIEM platforms

Continuously monitor changes, authentications and access attempts at the point of origin without relying on native logs

Detect attempts to inject malicious code into LSASS (such as Skeleton Key malware), Windows SSP injection attacks and DCSync attacks

Identify authentication-based and file system attacks and intruder reconnaissance activity

Automatically block unauthorized or suspicious actions such as group membership changes, GPO modifications and logon attempts from compromised accounts

Enforce custom security policies with automated responses

Identify risky authentication patterns and unusual user activity that signal insider threats

Monitor behavior patterns and access anomalies

Record contextual event details including pre- and post-change values showing what happened, when and by whom to speed up investigations

Restrict access and enforce access controls by blocking unauthorized changes to Tier Zero assets such as privileged groups, domain controllers and GPOs

Role-based access control for platform users