EDR - How to perform a test rollback

[HCHTech]

I've been lucky and have not had to actually perform a rollback for a client yet, but I'd like to test the process on a sacrificial workstation.  For one, we can review our SOP, and perhaps most-importantly, we can see that this process actually works so we're not trying to figure it all out in a time of crisis.  The documentation appears to say that the software needs to have detected suspicious activity for a rollback to be available.   I'd like to setup quarterly testing of this process for clients - How can I do this?

[AdvancedSetup]

Hello @HCHTech

I actually don't believe it is possible to do without real malware which is never recommended. I would open a support ticket and work with them for further information about this.

 

Business Support
https://service.malwarebytes.com/hc/en-us/requests/new

 

Thank you

 

[HCHTech]

That is.....disappointing.  I did open a ticket, and guess what, support cannot help - they sent me to SALES who want to do a demo.   Yeah, no - that's not what I'm interested in.  I want to see the thing work with my own eyes on a real machine that I control.  I don't think that's too much to ask.   This is no different than restoring a file or directory from backup to prove it works, IMO.

[AdvancedSetup]

Sorry, but it really is too much to ask. If we provided malware that escaped for some reason and caused issues, that would leave us liable for possible negligence

Thank you again

 

[HCHTech]

I'm not asking you to provide malware.  I'm asking to open up the rollback feature so that it can be utilized without a current detection.

[AdvancedSetup]

It's not that simple and the architecture of how it works is quite specific in supporting it during a real attack.

It's not like simply just enabling a switch

 

 

[HCHTech]

I can appreciate that However, consider the following:  This was a major feature that sold us on the product.  Not being able to test it, or prove that it works makes it vaporware.  I'm depending on it being there and working in a time of crisis when I cannot ascertain that beforehand.  If I had been more unlucky and actually HAD an infection among my client base where it saved the day, then this would be less of an issue.

I guess it occurs to me that the company is asking a lot for its users to trust that this feature will work when needed -- without providing the any ability (other than checking the box in the policy setup) to prove that it will be ready and waiting when you really need it.  If you will put yourself in my shoes for a moment, I think you will see my concern.  Help me sleep a little better at night by throwing me a breadcrumb here...

[AdvancedSetup]

You can contact your sales person or open a support ticket to discuss in more details. I simply don't have a solution for your request.

I do understand your concerns. Thank you for the feedback

 

Business Support
https://service.malwarebytes.com/hc/en-us/requests/new

 

 

[HCHTech]

Thank you - it's kind of a frustrating corner to be in.  I got a video of the process being done from support.  That will have to do, I suspect.

[TonyCummins]

@HCHTech  I too recently got sold the EDR, can you share the video please?