Does Broadcom Enterprise Security Group Support assist in Incident Response?

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black App Control
• Carbon Black EDR
• Carbon Black Cloud Enterprise EDR
• Endpoint Security
• Endpoint Security Complete
• Endpoint Protection
• CBX Complete
• CBX Essentials
• Data Center Security Server
• Data Center Security Server Advanced
• Protection Engine for Cloud Services
• Protection Engine for NAS

Issue/Introduction

Can the Broadcom Enterprise Security Group support team help when performing incident response investigations?

Resolution

Technical Support can help determine if one of it's security tools failed to detect or block a specific threat, but they cannot assist with active threat hunting and/or determine how the threat actor infiltrated the environment. We recommend contacting an Incident Response provider if you suspect a breach.

Additional Information

• For reputation false positives and negatives, see Using SymSubmit for Symantec and Carbon Black Products
• For Carbon Black Cloud, the MDR team may update alerts in the console and this process can be used to respond to those alerts