NHIDR (Non-Human Identity Detection & Response)
Entro’s Non-Human Identity (NHI) Detection and Response technology goes beyond straight-forward monitoring
Entro Security
NHIDR (Non-Human Identity Detection & Response)
Entro’s platform goes beyond straight-forward monitoring. Entro’s Non-Human Identity (NHI) Detection and Response technology allows organizations to detect and respond to:
Compromised NHIs: By establishing behavioral models and tracking secret utilization in real-time, NHIDR instantly detects when secrets are being misused or Non Human Identities (NHI’s) are being abused.
Unauthorized access attempts: detect interactions involving NHIs and vaults from suspicious geolocations
Vault Dumps: to immediately stop mass downloads of secrets
Human interactions with vaulted secrets: to stop secret exposure at the source
Examples of risks Entro Detects and Responds to:
MongoDB token is used from a suspicious source IP address
Ex-employee token is used by suspicious actor IP
Secret was retrieved by a suspicious actor
Sensitive secret revealed by a human action
production secret fetched by human outside reasonable work hours
Idle identity fetched a production secret
Previously disabled token has been reactivated
Previously inactive token is now active again
Production token is used by IDE client
Secret was fetched by a new workload
Too many entities are fetching the same secret
In order to accomplish all these goals, Entro’s NHIDR technology reviews all past context and logging to:
Establish a baseline of typical behaviors of each NHI with historical behavioral context in order to identify anything out of the ordinary. Anomalies are then highlighted with context for investigation purposes.
Detect day 0 threats and anomalies, going beyond a simple inventory to real-time, continuous analysis of secrets behavior.
Respond immediately to isolate and mitigate anomalous behavior.
Integrate effectively with your existing task management, automation, and alerting solutions
24/7/365 monitoring of future interactions with NHIs, Secrets, and Vaults.
This proactive approach ensures that security incidents are addressed in real-time, reducing potential breaches before they occur. Entro also automates the remediation process by rotating or revoking compromised tokens, thus minimizing the manual effort needed to secure environments.