XDR
Endpoint detection and response
What the suspicious process actually did, and a response you can take back.
The measure of an endpoint product for a company without an analyst is not how many things it detects — it is whether a non-expert can understand one finding and act on it without breaking the business. Every response action here is reversible by construction, and the undo path is recorded before the action is taken rather than reconstructed afterwards.
Included from Core · see the tiers
What it does
Capabilities, with their real status
Process-tree correlation
ShippingA storyline reconstructing what a process did, what it spawned and what it touched, rather than a list of isolated events with the same timestamp.
Behavioural detection, not hash matching
ShippingCredential dumping, remote services abuse, command interpreter abuse and ransomware behaviour, with a lexicon, time windowing and suppression, so a match rests on what happened rather than on a file being on a list.
Reversible response actions
ShippingQuarantine moves the file into a vault named by its SHA-256 digest. Isolation snapshots the host firewall rules before changing them. Every action records an undo handle in a hash-chained audit row, so reversing it is a control rather than an incident.
A queryable ATT&CK coverage map
ShippingCoverage is in the database and answerable in SQL, which is how an auditor or a buyer actually asks the question.
Cross-platform sensor
ShippingWindows and Linux (eBPF) ship today: a code-signed, timestamped MSI and deb/rpm packages. The macOS sensor builds for Intel and Apple silicon, but the installer is not yet signed or notarised by Apple, so it is not distributed — Macs are outside endpoint coverage until it is.
Bounded threat-hunting queries
ShippingFrom Protect upward. A query API that is injection-safe by construction rather than by sanitisation, because a hunting interface that can be talked into arbitrary SQL is a vulnerability with a search box on it.
Cross-module identity risk
ShippingEndpoint findings raise the risk score of the identity involved, without either module reaching into the other's tables.
The limits
What this module does not do
Every module on this site carries this section. A product page without one is a product nobody has run against a real customer.
- Isolating an endpoint is only ever automated for a single host, under an eight-condition envelope, and never for a machine you have marked business-critical or left unassessed.
- No device control. There is no removable-media or peripheral policy: nothing blocks a USB mass-storage device, and there is no screen to express such a rule. If device control is a requirement, this module does not meet it.
- No vulnerability management. We do not maintain an asset software inventory or match CVE identifiers against it, and we deliberately refuse to import the CISA exploited-vulnerabilities catalogue as an indicator feed because a CVE is not something telemetry can observe. Patch prioritisation is a different product.
- No sensor tamper protection. The sensor does not defend itself from being stopped or uninstalled by a local administrator. What exists is a detection that fires after a security control has been switched off, which is a different and weaker thing — it tells you it happened rather than preventing it.
- Sensor auto-update verifies a signed manifest and an artefact hash before it applies anything, and will refuse an update rather than install one it cannot verify. macOS is excluded from the channel because the package is not yet notarised.
The rest of the platform
Also included
Identity and access
Every sign-in decided by a rule you can read, and a trace showing which one won.
ReadPAMPrivileged access
Administrators do the work without ever holding the password.
ReadSIEMLog collection and detection
Your logs in one place, matched against detections that carry their own false-positive guidance.
ReadFind out what an attacker would see
Connect Microsoft 365 and read your own posture report. 82 checks against your real tenant, naming your real administrators, applications and devices. Free, complete, and yours to keep — not a sample with the findings blurred.
No card. No sales call before you have read the report.