With antivirus products, it depends on the features available. Does it protect the hypervisor and the Hyper-V VMs? Do we need to install agents in the VMs, or will the entire solution manage the VMs itself? Depending on that, we configure it and even help the customer accordingly. Moreover, real-time threat intelligence and adaptive capabilities benefit our organization. For example, if someone is trying to access our server with stolen credentials. So, as far as the sign-in logging is enabled and analyzed by the threat intelligence, it will identify that. It will recognize the pattern of the requests. So, it may try multiple times within a specific timeframe. It can discern the behavior of the user request and create an alert indicating there is a possibility of a credential test and generate an alert. The system can identify the pattern. It identifies a pattern of a person, the request, where it's coming from, and what location. Is it a blocked IP address if the request is coming from there? Or is it a suspected IP address range the request is coming from? The sign-in request is just one example. There can be any other kind of request. So, there may be many patterns that it will identify, assess, and decide on whether it is a critical, medium, or low critical event. Based on that, the event management by the threat intelligence is automated. The human is not involved there. The engine itself makes those decisions by assessing the data, the pattern, the behavior, the location, and all those parameters.
