Managed security
Renamed malware
still acts like malware.
Continuous monitoring of every laptop, desktop and server for behavior that looks like an attack, whether anyone’s seen that particular malware before or not. It’s the sensor the rest of your security runs on.
- Windows, macOS and LinuxWhat endpoint detection coversWatching
- Behavior over signaturesWhat endpoint detection coversWatching
- The whole process treeWhat endpoint detection coversWatching
- Isolate from anywhereWhat endpoint detection coversWatching
- Evidence that outlives the machineWhat endpoint detection coversWatching
- The sensor everything else readsWhat endpoint detection coversWatching
Foothills Digital—Sentrello Premier Partner
- AWS
- Azure
- Google Cloud
- DigitalOcean
- On-premises Linux
- On-premises Windows
Every one of our people holds active certifications on the platforms they work on.
Sentrello is our only partnership. On the clouds, it's our people who hold the certifications. We don't claim a partner tier, and we'll keep saying so until that changes.
Where this usually starts
Antivirus only knows what it’s already met
A signature list is a record of things that happened to somebody else. Whatever’s happening to you tonight isn’t on it yet.
- Last month’s malware got renamed, recompiled and strolled past the scanner that would have caught the old version.
- There wasn’t any malware, in fact. They used PowerShell, which was already installed and already allowed.
- A laptop is acting strangely, and your only investigative tool is calling its owner to ask what they clicked.
- Someone reimaged the infected server before anybody took a copy, so how it happened is gone for good.
- The Macs run one agent, the Windows machines run another, and the Linux servers run nothing.
What we do instead
Watch what a process does, not what it’s called
Every machine runs an agent that records behavior. What launched what, what it touched, where it connected, what it wrote to disk or the registry. A detection is a pattern in that record, so a renamed file or a script that shipped with the operating system gets caught all the same. The behavior gives it away. And the agent doesn’t just report: it can cut the machine off the network and stop the process where it stands.
How it works
How endpoint detection runs
Most fleets have never finished step one, which is exactly why it’s step one.
An agent on every machine
Windows, macOS and Linux, on desktops, laptops and the servers behind them. The machine list comes from your inventory, and the gap between that list and the number of working agents is the first report you’ll get from us.
Record the process tree
Every process, its parent, its command line, its network connections and its file and registry writes, recorded around the clock on every machine. The record is only useful if it was already running when something happened, so it always is.
Detect on behavior
Word opening a command shell. A script fetching a payload from a domain registered yesterday. Passwords read straight out of memory. Rules describe what an attack does rather than the fingerprint of one file, so the recompiled version trips them just the same.
Act on the machine
Cut it off the network while keeping our line to the agent, stop the process, quarantine the file, undo the change. Which of those happen automatically and which wait for an engineer is already settled in your containment policy.
Keep the evidence
The record from a compromised machine is held off that machine for as long as we agree, so reimaging it doesn’t erase the story. When your insurer asks for a timeline, there is one.
What endpoint detection covers
Windows, macOS and Linux
Full EDR on all three, laptops, desktops and servers alike, in one console. Not a tool per platform that can’t see the others.
Behavior over signatures
Detections describe what an attack does, like the shell that shouldn’t have spawned or the memory that shouldn’t have been read. Renamed binaries and built-in tools get caught the same way.
The whole process tree
Parent, child, command line, connection, write. When an alert fires, you see the chain that led to it on that machine, in order, rather than one event with no history.
Isolate from anywhere
A machine can be cut from the network in software while its agent stays reachable, so we can investigate something that can’t hurt anyone anymore. Its user sees a message, not a dead screen.
Evidence that outlives the machine
Records are held off the host for an agreed period. Rebuilding a laptop doesn’t end the investigation.
The sensor everything else reads
Our SOC watches the alerts it raises. MDR hunts through what it records. XDR joins it to email, cloud and network. None of them can see what EDR didn’t capture, which is why it goes in first.
Related
Managed Detection & Response (MDR)
Active threat hunting through your endpoint data for the intruder no alert caught, and a fast response the moment we find one. The SOC watches what fires. MDR goes looking, with your written permission to act.
Extended Detection & Response (XDR)
XDR correlates what your endpoints, email, cloud workloads and network each see, so signals that look harmless alone get read together. Think of it as the layer above EDR, joining its dots to everyone else’s.
Asset Management
Hardware inventory, software licenses and lifecycle replacements, kept honest by automatic discovery instead of a spreadsheet. Every device found and every seat counted, with each warranty date known before it bites.
How many machines do you have, honestly?
Your split across Windows, macOS and Linux, the servers, and the ones nobody’s quite sure about.
With that, we can tell you what getting an agent onto all of them involves, what a first week of behavior data tends to turn up, and which managed service you’d want running on top.
- What we arePlan, create, launch, maintain
- What we areSentrello Premier Partner
- What we areEvery quote written for you