Every attachment arrives clean.
Email is the primary attack vector. CDR sits at the mail gateway and rebuilds every attachment before it reaches an inbox.
See HookMeshFollow one message in.
The message stops at the gateway while its attachment takes the route set for its type. Documents are rebuilt. Anything that runs is run first, somewhere safe. The mail arrives either way.
- InboxWhere every message ends.
- QuarantineHolds the file, never the mail.
-
At the gateway
HookMesh sits on SMTP beside the mail server you already run. The message waits there while its attachment is lifted out and sent on.
HookMesh -
Sandbox
What cannot be rebuilt is run on the system it targets, Windows, macOS, Linux or Android, and watched from outside. A clean verdict puts the file back; anything else keeps it out of the inbox.
Sandbox -
CDR
Documents are taken apart, stripped of macros, scripts and embedded objects, and rebuilt. The copy is back on the message in milliseconds.
CDR
The problem
Email is the primary attack vector. It reaches everyone in the company, and it reaches them with a file attached.
The people targeted are often the ones with the least experience of a suspicious attachment. One open is enough.
Detection asks a question about every file. Some answers come late, and some come wrong.
The answer
CDR is a shield against harmful attachments. Every file that passes the mail gateway is taken apart, stripped of anything active, and rebuilt as a clean copy.
It is proactive defense: the attachment is safe whether or not anything was known about it. More than 50 file types are rebuilt in milliseconds.
The integration with the mail gateway is seamless. Mail keeps flowing, and security is bolstered without a change in how anyone works.
In practice.
- Where it sits
At the mail gateway, inline. Every inbound attachment passes through before delivery.
- What happens to the file
CDR rebuilds it as a clean copy. HookMesh can route it through static and dynamic analysis as well, in the order you set, and send the verdict to your SIEM, SOAR or ticketing.
Put a shield on the gateway.
Tell us which mail gateway you run. We will show you a real attachment going through.
Contact us