Optimized single-agent architecture using targeted collection to minimize resource usage.

Optimized single-agent architecture using targeted collection to minimize resource usage.

Seamless integration and management of Windows Defender AV and Microsoft Anti-Malware Scanning Interface (AMSI).

Seamless integration and management of Windows Defender AV and Microsoft Anti-Malware Scanning Interface (AMSI).

Support for Windows, Linux and macOS desktops, servers and cloud workloads.

Support for Windows, Linux and macOS desktops, servers and cloud workloads.

Simplify endpoint investigations with easy-to-use ... Read more

Simplify endpoint investigations with easy-to-use SQL-based live and scheduled queries.

Access to historical and in-memory forensic artifacts and unmatched breath of telemetry with fine-grained control for targeted ... Read more

Access to historical and in-memory forensic artifacts and unmatched breath of telemetry with fine-grained control for targeted collection.

Reduce time to response and remediation with direct access to the endpoint live terminal.

Reduce time to response and remediation with direct access to the endpoint live terminal.

Multi-variate detection capabilities based engine with anti-malware integration, rules, MITRE ATT&CK, IOC and YARA.

Multi-variate detection capabilities based engine with anti-malware integration, rules, MITRE ATT&CK, IOC and YARA.

Rule-based pre-emptive threat prevention and application control.

Rule-based pre-emptive threat prevention and application control.

Pre-built and customizable response actions that work even during an active attack.

Pre-built and customizable response actions that work even during an active attack.

Enterprise-level endpoint management and configuration capabilities.

Enterprise-level endpoint management and configuration capabilities.

Configurable for optimized local or cloud storage of telemetry data to prevent duplication.

Configurable for optimized local or cloud storage of telemetry data to prevent duplication.

Reduced time for incident triage with access to contextual telemetry enrichment.

Reduced time for incident triage with access to contextual telemetry enrichment.

Support for standard detection formats including commercial threat feeds, YARA, ... Read more

Support for standard detection formats including commercial threat feeds, YARA, osquery Rules, and atomic Indicators (IOCs).

Hunt for knowns and unknowns through predefined and customizable Live and Saved Queries.

Hunt for knowns and unknowns through predefined and customizable Live and Saved Queries.

Detection engine aligned with the MITRE ATT&CK matrix for rapid response to varied attack ... Read more

Detection engine aligned with the MITRE ATT&CK matrix for rapid response to varied attack techniques.

Flexible deployment options available to support Docker, Virtual Machines, and Cloud environments.

Flexible deployment options available to support Docker, Virtual Machines, and Cloud environments.

Seamlessly manage and collaborate on detection content through the open and shareable osquery Pack format.

Seamlessly manage and collaborate on detection content through the open and shareable osquery Pack format.

Large detection library for immediate identification of known malicious and suspicious behavior across the enterprise.

Large detection library for immediate identification of known malicious and suspicious behavior across the enterprise.

Forward alerts and telemetry data to industry leading SIEM providers.

Forward alerts and telemetry data to industry leading SIEM providers.

Connect with commonly used commercial intelligence feeds to expand rapid and impactful use of CTI.

Connect with commonly used commercial intelligence feeds to expand rapid and impactful use of CTI.

Extend capabilities beyond Endpoint Response with feature rich API and documented SDK.

Extend capabilities beyond Endpoint Response with feature rich API and documented SDK.