in your system tray, which normally appears in the right bottom corner of your
screen. Click on "Restore" from the menu that appears to launch
the InSight Administrator console. Anti-virus and Intrusion
Detection Systems are good at matching network traffic or host data to known
signatures that are updated by those products’ vendors. Today, however, that is
not enough to protect your network completely. Computer
worms
like Sasser infected thousands before AV and IDS vendors were able to produce a
signature. Companies had no signs that they were infected until they had
critical network saturation and significant outage.
InSight can fill in the
gaps that traditional signature based Anti-virus and IDS cannot fill by finding the
new, unknown or previously hard to detect behaviors that can cause significant impact to your network. InSight is a
complement to existing security solutions that allows you to not only be aware
of known exploits but new or unknown ones as well.
I
already have forensics software to investigate compromises.
Why would I need InSight?
Traditional forensics software allows you to take an after-the-fact snapshot of a machine that you wish to investigate at a given point in time. However, the history of events is spotty at best and is highly dependent on what type of logging was turned on on the machine before the compromise took place.
With InSight running on
your system, not only are you alerted on when to investigate a system but you
can see, from the InSight Enterprise Edition Administrator console, a history of key important
events that occurred on the system before or after an InSight notable event as
well how the system looked in terms of critical statistics at a given point in
time, regardless of what level of logging was on the machine.
This can be extremely valuable information to determine whether to move
forward with forensics, which can be expensive and time consuming, without
compromising or tampering with the data on the system.
The PassProtect InSight Home Edition Administrator can be used to view the risk level of your system and take actions to investigate and remedy any potentially suspicious behavior, as well as configure how you get alerted on InSight notable events, or alerts, that can require further investigation.
Will
InSight prevent attacks on my network?
InSight does not prevent any processes from executing on a system, but does alert you to some of the first signs of compromises resulting from virus infections, worms and other unauthorized uses of your system - thereby empowering you to make critical decisions as soon as possible to stop any unwanted activity as quickly as possible.
How
can I see what InSight is doing?
The InSight Agent runs in the background of your computer, recording, collecting and analyzing behavior. The InSight Administrator console can be used to view InSight's collected data and investigate any InSight notable events.
You may launch the
InSight Administrator console by right-clicking on the InSight icon shown here
in your system tray, which normally appears in the right bottom corner of your
screen. Click on "Restore" from the menu that appears to launch
the InSight Administrator console.
If the icon shown above for InSight does not appear in your system tray, click on the "InSight Administrator" option from the Start menu, (All) Programs, PassProtect InSight program group.
What should I do when I receive alerts from InSight?
InSight alerts on system behavior that approximates viruses, worms and other unauthorized behavior. If you have configured InSight to do so, relevant alerts will also be emailed to you.
InSight alerts should be investigated via the InSight Administrator. With the Enterprise Edition, the Administrator can be used to reconstruct system events to determine if a security breach may have occurred. With the Home Edition, events that led to an alert can be investigated, with helpful advice on how to determine if a security breach may have occurred. See the Getting Started guide to familiarize yourself with the product, and for details on how to use the various features of the InSight Administrator console to investigate suspicious events and intrusions.
I am receiving lots of alerts. What should I do?
From the moment you install the product, InSight undergoes a continuous training process, designed to "learn" your habits. Over a short period of time after initial installation, the number of false alerts should decrease significantly.
If after a few days you are receiving a large number of alerts that you feel are false positives, please use the product's support feature to report the issue.
How do
I get a copy of InSight?
InSight can be downloaded from here.
Licenses can be purchased from here.
How
do I get help and support on InSight?
InSight Getting Started Guide is accessible from the product itself unde the Help menu.
If you cannot find the answer to your question in the aforementioned documentation or through other documentation on our web site, please send your question or feedback to PassProtect via our support page.
What
is the impact of running InSight on my system?
InSight should have have no noticeable impact on the performance of a system that meets the InSight system requirements. InSight runs in the background recording, collecting and analyzing behavior, not interfering with your normal day-to-day desktop usage.
If you feel that InSight is having any undesirable impact on your system, please let us know via our InSight Feedback page.
InSight is an automatically-updating product, so you will be notified when a new version is available for download.
You can also check to see which version of InSight you have on your system by following these steps:
Launch the InSight Administrator by following the steps here.
Click on the Help menu item and select "About PassProtect InSight Administrator".
The version number is displayed on the center pane of the window.
You can see if this is the latest version of InSight by clicking on the the What's New In InSight page which lists out the latest features in the newest versions of InSight.
After you download a copy of InSight (or after you purchase an InSight license), InSight will automatically download a subscription license. If automatic download of the license fails, you may force a download of the license via the InSight Administrator. If this fails, or if license creation fails, you may be contacted via email and/or sent your license via email for manual import into the Administrator.
Subscriptions can be purchased by clicking on the "Purchase Subscription" button from the center pane of the Subscriptions view of the InSight Administrator.