Malware analysis tools that are used to isolate and investigate malware as it is detected on a company’s IT resources, endpoints, and applications. They typically work by detecting malware and then moving infected resources to an isolated environment. In this secure, sandboxed environment, security professionals examine the malware’s code and behaviors to learn more about how it works, what it has done, and how to protect against it in the future.
Security teams and other IT staff involved in incident response, risk analysis, and security operations may all use these tools. They collect data from malware that is detected and use it to bolster security and prevent similar malware from compromising their system by integrating it with their existing threat intelligence systems. They may also use the information gathered to examine larger portions of their IT systems to ensure the malware is not present elsewhere.
Many malware analysis solutions provide features of network sandboxing software for secure analysis. Not all network sandboxing tools have the same ability to automatically detect malware nor the tools necessary for in-depth forensic investigation.
To qualify for inclusion in the Malware Analysis category, a product must:
- Detect zero-day threats and other unknown malware using contextual threat data
- Isolate threats in a secure environment
- Provide tools for forensic investigation and risk analysis
