Overview

What the agent does on endpoints — protection, agent and content updates, firewall, device control, and response — applied to host groups by precedence. Includes behavior rule groups.

Sigma-style analytics that turn telemetry into alerts, with their own allowlist, suppression, and exceptions.

Real-time behavioral rules (image, command line, parent/grandparent, domain, registry) grouped by platform and severity — your own detections beyond the built-ins.

Known-bad and known-good file hashes from feeds like VirusTotal and abuse.ch, driving block and allow decisions.