Deploying the sensor, enrolment, behavioural detections, incidents and process trees, threat hunting and response actions.
31 articles
Endpoints and response
How endpoint detection works when there is no hash to match, what a rule actually contains, the ATT&CK techniques covered, the three detections riding sensor 1.7.0's new telemetry, and the five gaps we publish.
Endpoints and response
Authoring process, file, network and domain indicator-of-attack rules with typed conditions and MITRE tags — how testing against recent telemetry works today, and why every action is effectively detect from the endpoint's point of view.
Endpoints and response
The per-host modal reached from the endpoint list: whether a machine actually applied the policy the server built for it, its package inventory and KEV-flagged findings, and the quick actions available from there.
Endpoints and response
What an enrolment token is, how long it lasts, where the installer reads it from, how to tell an install worked, and every failure message you might see.
Endpoints and response
Real per-host package inventory matched against OSV, a CISA Known Exploited Vulnerabilities cross-reference, CSV export, and a tenant posture score that is a single number today, not yet a trend.
Endpoints and response
Configuring watch paths on a fim-kind policy, reading the change-feed panel, and every real limitation of the sensor-side watcher: a bounded poller, no who-data, no Windows owner resolution, no diffing past 64 MB.
Endpoints and response
How separate endpoint alerts become one story, how the process tree is rebuilt, which fields it carries, how to read one — and where to open it in the console.
Endpoints and response
Importing and managing your own file-hash, domain, IP, URL, email, mutex, registry-key and YARA-rule indicators — action, severity, host-group scope, hit counting, and what bulk import actually accepts today.
Endpoints and response
The GPG-signed deb and rpm packages, the exact install commands, the systemd unit and its paths, and what the sensor needs from the kernel to see anything useful.
Endpoints and response
There is no installer, only raw unsigned binaries. Gatekeeper blocks a real package deployment until Apple Developer ID signing lands. What exists today, what it means, and what to do meanwhile.
Endpoints and response
The self-signed MSI and thumbprint pinning, the exact silent install command, where the service and its files live, how to confirm it is reporting, and how to remove it.
Endpoints and response
Cutting a computer off the network is the most disruptive thing we can do. What it stops, who is allowed to start one, and how you reverse it.
Endpoints and response
The auto-update mechanism exists but stays dormant, so upgrades mean re-running the installer. How to plan and run that across a fleet, and how to tell which machines took it.
Endpoints and response
The most powerful thing in the product: what a live-response ticket can do to a machine, who has to approve it, how it is signed, and what is recorded.
Endpoints and response
How Defender's alerts become Qorionix incidents, how isolate and antivirus scan run through Defender after approval, the four permissions, and what leaves the EU.
Endpoints and response
How host groups and the five policy kinds work, how precedence is resolved when more than one assignment matches a host, and why they all live on one console page today.
Endpoints and response
Every action the platform can take on a machine, which are reversible, which may run unattended, who is allowed to raise one, and the approval flow.
Endpoints and response
A per-tenant allowlist of named scripts, run through the same human-approval queue every other response action uses — and why, without a way to get a script onto a sensor first, a run-script ticket has nothing to execute yet.
Endpoints and response
Editing a feed and typing a new key does replace it — leave the field blank and the old one is kept. It is stored as plain text on the feed record, not in the vault.
Endpoints and response
Delete on a saved hunt removes it immediately, with no confirmation dialog and no undo. What Save current query keeps, and how to protect a hunt worth keeping.
Endpoints and response
The three seed policies and authoring your own, how a check actually evaluates — pass, fail, not applicable, or not checked — and every real limitation: no per-host-group toggle, no CSV export, and unverified CIS citations.
Endpoints and response
Why Windows shows an unknown-publisher warning, what the Linux GPG signature actually proves, why macOS has no installer package at all, how to confirm you are installing a genuine Qorionix build, and what 1.7.0 adds over 1.6.0.
Endpoints and response
Creating a staged rollout ring on a host group, target percentage, pause and resume, the adoption bar — and the one thing to know before you rely on it: nothing in update delivery reads a ring's decision yet.
Endpoints and response
The per-tenant switch that stops Sentinel-Q acting on its own: where it lives, what it does and does not halt, why it fails closed, and what gets audited.
Endpoints and response
What the endpoint list shows, the exact status values, what stale means at fifteen minutes, and the ordinary reasons a machine goes quiet before you worry.
Endpoints and response
One host, seven tabs. What each of the sensor 1.7.0 telemetry channels actually reports on Windows, Linux and macOS, and where each one reports nothing at all.
Endpoints and response
The server half is built and verified: three channels, Ed25519 signatures, a 5% cohort and automatic rollback. The sensor half does not poll, because no build stamps its keys.
Endpoints and response
The signed, cached, offline-safe manifest a sensor checks in for roughly every four hours — what it actually carries and enforces today, and what it carries but does not yet enforce.
Endpoints and response
The query interface, the six datasets and what each one holds, every bound that applies, the errors you will hit, and five hunts a non-specialist can run today.
Endpoints and response
Which feeds you can subscribe to, how often they refresh, what the licences allow — and the one thing you must know: only file hashes are ever matched.
Endpoints and response
Exactly what the endpoint sensor gathers on each platform, what it deliberately does not, and how those gaps bound which detections can ever fire.