How long would Field Effect take to notice an end point was infected with RansomWare?

Field Effect handles a lot of incident response cases for organizations that don't have effective monitoring and are dealing with a ransomware scenario. We believe that in each of those cases, had Field Effect monitoring been active, there would have been indicators of the threat well before it reached an encryption stage.

Field Effect actively looks for the indications of threat actor activity and will create ARO notifications should these indications be triggered. Should these go unactioned and a threat actor gain access to an End Point the Active Response policy will take action.

The typical Balanced option would guide our analysts to weigh the business impact of taking action, and respond appropriately.

If Field Effect sees indications of a potential breach on your network and a threat actor having command and control, it would immediately isolate the implicated hosts from all network communications. You would get an ARO of the activity and we would also attempt to call out to all contacts listed in the Portal via telephone.

Please read more on Active Response and Active Protection and consider using them if you are not.