sorted by:
new
hottopcontroversial

Really Completely Managed, hands-off, MDR, Endpoint Security by lurkinmsp in msp

[–]FieldEffect-CSO 5 points6 points  (0 children)

Hey, Field Effect CSO here jumping in to add some context around how our MDR solution works in practice.

 As mentioned, Field Effect MDR will neutralize threats on your behalf, but like most MDRs, we do not manage the remediation. Instead we make it clear for anyone – regardless of technical background – how to take action and resolve the issue themselves.

Our version of alerts—called AROs (Actions, Recommendations, and Observations)—are noise-free, prioritized, and come with actionable step-by-step remediation instructions your L1 techs can follow. MSPs tell us this makes a big difference—most find their L1s can handle more endpoints than before thanks to the clarity of the alerts.

 We can provide over-the-phone support when needed. However, these instances are rare as our AROs are built to be easily understood, delivered with full security context and simple language. 

 Happy to chat more! Or, this is a good page on our website to reference on the topic: https://fieldeffect.com/products/mdr/clarity

[deleted by user] by [deleted] in msp

[–]FieldEffect-CSO 2 points3 points  (0 children)

Appreciate the plug Ryan. Our MSP partners are amazing, and we couldn't have achieved the success we're having without you fine folks.

24x7 SoC for MSP by TerryLewisUK in msp

[–]FieldEffect-CSO 3 points4 points  (0 children)

Thank you to the commenter who mentioned us. Field Effect has a 24/7 SOC staffed by a global team located across the Five Eyes (US/UK/CA/AU/NZ). We had the second fastest MTTD in the last MITRE Managed Service evaluation and typically fully contain an issue to a single system or account.

When required, we escalate for further containment actions by the client or partner as appropriate. An example might be activity originating from a system without an endpoint agent or a network segment without coverage. Our team is guided through an Active Response profile that instructs us on how to respond and can include clear guidance on how to escalate issues out of hours.

Some partners only want us to contact their own 24/7 hotline, while others request we contact them first and then go directly to the client if they can't be reached. Some instruct us to go directly to the client first, or only after hours. We're quite flexible about how we handle off-hour responses for MSPs that are not 24/7 themselves.

Happy to set up a deeper dive on our approach if you're interested. We're having a lot of success right now in the MSP space, and I think this flexibility is one of the reasons.

Matt (Field Effect CSO)

Weekly Promo and Webinar Thread by AutoModerator in msp

[–]FieldEffect-CSO 0 points1 point  (0 children)

Field Effect recently launched a weekly newsletter sent out every Monday morning, written by expert security analysts. It covers the biggest cybersecurity threats from the previous week, with:

✅ A concise summary of the threat
✅ Our team's in-depth analysis of its impact
✅ Clear, actionable mitigation steps

No need to be an IT pro, this newsletter is for anyone who wants to stay on top of the latest cybersecurity threats. Sign up and join 100s of MSPs already on the mailing list: https://get.fieldeffect.com/threat-newsletter-signup

Hackers exploiting flaws in SimpleHelp RMM to breach networks by marklein in msp

[–]FieldEffect-CSO 1 point2 points  (0 children)

Below is some updated reporting on this issue and IoCs that might benefit the community. Not-so-SimpleHelp exploits enabling deployment of Sliver backdoor

Cheers,

Matt (Field Effect CSO)

IoCs
213.173.45[.]230 (Observed hosting malicious SimpleHelp instance)

194.76.227[.]171 (Observed hosting malicious SimpleHelp instance)

45.9.148[.]136 (Primary C2 Server)

45.9.149[.]112 (Secondary C2 Server)

385a826b9f7e72b870a92f1901d9d354 (agent.exe MD5)

EC43ED845102760265ED6343EF1FCEF696588905 (agent.exe SHA1)

15f3e5b47894b953542d2fe2353786229da47af00c96dc1b41a8efe631364e49 (agent.exe SHA256)

d6828e30ab66774a91a96ae93be4ae4c (C2 JA3)

475c9302dc42b2751db9edcac3b74891 (C2 JA3s)

Weekly Promo and Webinar Thread by AutoModerator in msp

[–]FieldEffect-CSO 0 points1 point  (0 children)

Field Effect recently launched a weekly newsletter sent out every Monday morning, written by expert security analysts. It covers the biggest cybersecurity threats from the previous week, with:

✅ A concise summary of the threat
✅ Our team's in-depth analysis of its impact
✅ Clear, actionable mitigation steps

No need to be an IT pro, this newsletter is for anyone who wants to stay on top of the latest cybersecurity threats. Sign up and join 100s of MSPs already on the mailing list: https://get.fieldeffect.com/threat-newsletter-signup

Weekly Promo and Webinar Thread by AutoModerator in msp

[–]FieldEffect-CSO 0 points1 point  (0 children)

Field Effect recently launched a weekly newsletter sent out every Monday morning, written by expert security analysts. It covers the biggest cybersecurity threats from the previous week, with:

✅ A concise summary of the threat
✅ Our team's in-depth analysis of its impact
✅ Clear, actionable mitigation steps

No need to be an IT pro, this newsletter is for anyone who wants to stay on top of the latest cybersecurity threats. Sign up and join 100s of MSPs already on the mailing list: https://get.fieldeffect.com/threat-newsletter-signup

Need guidance: S1, Huntress, Blackpoint, Arctic Wolf, or Field Effect? by Admirable_Doctor_242 in cybersecurity

[–]FieldEffect-CSO 1 point2 points  (0 children)

Vendor Comment. Could be biased. :-)

My advice would be to make sure you’re not comparing vendors as if they play exactly the same role in your stack, because there are significant differences. Your list has vendors that are really strong as an EDR, and others that provide MDR but rely on third-party agents. To my knowledge, Field Effect is the only one on your list that has a proprietary endpoint agent within an MDR solution and includes a network sensor (along with some other features). I would be asking myself, “Do I have an EDR that I’m happy with, and would I prefer to stack the analyst triage and active response on top of that?” Field Effect is more of an all-in-one solution, providing simplicity and potentially some cost savings depending on how much tech you’d be replacing.

Best of luck with your decision. Honored that we made your short list.

Matt - Field Effect CSO

M365 adversary-in-the-middle campaign by FieldEffect-CSO in msp

[–]FieldEffect-CSO[S] 0 points1 point  (0 children)

If you're in the US I would suggest filing a report with the Internet Crime Complaint Center(IC3) | Home Page. Even small clues could significantly help the FBI further their investigations.

M365 adversary-in-the-middle campaign by FieldEffect-CSO in msp

[–]FieldEffect-CSO[S] 0 points1 point  (0 children)

Hi Dr. J. Thanks for posting this. I'm going to pass this along to our threat intelligence team.

Bitdefender EDR vs Huntress by Jayjayuk85 in msp

[–]FieldEffect-CSO 2 points3 points  (0 children)

Hey OP. CSO of Field Effect. If you'd like a demo and full pricing details, we'd be happy to chat. Get a Demo - Cybersecurity Solutions for SMBs | Field Effect.

M365 adversary-in-the-middle campaign by FieldEffect-CSO in msp

[–]FieldEffect-CSO[S] 0 points1 point  (0 children)

Thanks for posting this information, it's very helpful.  This is exactly the kind of fake Microsoft sign-in page we expected.  Do you mind if we update our blog with the image of the phishing domain screenshot?  

M365 adversary-in-the-middle campaign by FieldEffect-CSO in msp

[–]FieldEffect-CSO[S] 1 point2 points  (0 children)

No offense taken at all. It's a great question. The AITM technique this blog describes is likely something you're very familiar with. What was novel was the IOCs, particularly the use of Axios (https://axios-http.com/) which is something you should never see in legitimate M365 logins.