Menlo Browsing Forensics

Menlo Security Browsing Forensics records policy-defined browser sessions to support customer teams with the investigation of security, audit / compliance, HR and other necessary events. The recordings are based on policy triggers, such as Heat Shield detections or users accessing private or sensitive applications.

Each recorded session has a Menlo Forensics Log entry that includes supporting data of the event and one-click access to the recording. The Forensics log data, available in near real time, includes a link to the associated recording. The recorded sessions are transferred to a customer’s defined location for secure, access-controlled storage. Browsing Forensics supports both AWS and Azure storage options.

The Menlo Security Browsing Forensics Viewer presents the rich content of the recording, enabling analysts to reach substantiated conclusions more quickly and easily. 4 Data Sheet Menlo Security Menlo Logs provide customers with all the traditional details of the user sessions, including actions such as DLP or Copy/Paste and the results of virus scanning and sandboxes. Additionally, Menlo Browsing Forensics Logs adds a summary of the critical events and any corresponding logs that may be of interest. For example, the researcher may be investigating an internal threat and the Browsing Forensics Logs contain the link to DLP Log for a complete picture of the exposure and intent.

A summary of the Browsing Forensics recording is included in logs with a link to the recording. With one click the researcher is viewing the browsing session data, significantly reducing the time required to complete an investigation.

Some of the use cases for Browsing Forensics include:

• Phishing Incident Response
• Data Security
• Threat Hunting
• Generative AI sites & ChatGPT
• Copy/Paste
• Security Research
• Insider threat
• Audit and compliance