Collect
The agent reads what Windows already records and sends it out over its own channel.
A Windows agent collects what the operating system already knows — processes and their command lines, logons, DNS, network connections, registry, PowerShell — and the console evaluates it against detection rules. When something is wrong, the analyst can act on the machine from the same screen.
The agent reads what Windows already records and sends it out over its own channel.
The console evaluates telemetry against the rule set and correlates across a host.
Severity and technique drive either an automatic action or a one-click recommendation.
Isolate, kill, quarantine or disable — recorded and reversible.
Process start and stop with command line, integrity and parent, image loads, logons with their source address, DNS, network connections resolved back to a domain, registry, PowerShell script blocks, service and task creation. Each collector is governed by policy.
Native rules alongside SigmaHQ, plus Wazuh and Elastic rules translated by our own parsers into the same engine. Two-step correlation across a host, threshold rules, an open/acknowledged/closed workflow, and a MITRE technique on every rule.
We write no antivirus engine. Microsoft Defender's real detections are ingested as EDR detections, a vendor-agnostic check answers whether any live antivirus is present at all, and ClamAV findings are bridged in.
Kill a process or its tree, isolate the network and release it, block a single connection, disable a user, revoke administrative rights, quarantine a file. Policy decides which detections act on their own and which wait for an analyst's click.
The agent connects outward and nothing connects in. Remote control and file transfer travel that same channel, so they keep working on a host that has just been isolated — transfers up to 100 GiB, resumable, hashed as they go.
An Atomic Red Team by MITRE scorecard shows what is actually detected. Authorized test windows suppress the response action only — never the detection, never the log.
The process, its command line, the parent that started it, the user, and the rule and MITRE technique that fired.
Every action, automatic or manual, is attributed and audited, and network isolation can be released as deliberately as it was applied.
Which techniques are actually detected in your environment, measured rather than asserted.
One policy sets which telemetry the agent collects, which response commands are permitted on the endpoints it covers, and whether a matching detection acts on its own or waits for an analyst. The most specific assignment wins: agent, then group, then global, then the built-in default.
The shipped console with default settings. No endpoint data is shown.
The agent runs in user mode and connects outward only, so the console never needs a route into the endpoint. That is also why remote control and file transfer keep working on a machine that has just been cut off from the network.
Windows endpoints and servers. Detections arrive from our own rules, from SigmaHQ, and from Wazuh and Elastic content translated into the same engine, so the library grows without hand-porting each rule.
The agent is a Windows agent. Other operating systems are not covered by it.
Detections from Microsoft Defender and ClamAV are read and normalised. We do not claim to replace an antivirus product.
The agent does not install a kernel driver. That bounds what it can see, and it is why an agent failure cannot take the machine with it.
Install on a few machines, confirm the telemetry and detections look right, then widen.
A signed installer from the console, or a push over WinRM.
Watch telemetry and detections before enabling any automatic response.
Set policy per group: what is collected, what fires automatically, what waits for an analyst.
Run with automatic response where it is warranted, and one click where it is not.
Choose one product, one environment and one measurable outcome. We define success criteria before the engagement begins.
Tell us a bit about your environment and we'll get back to you shortly.
Your message has reached us; a member of the SDefender team will be in touch shortly. You're always welcome to reach us directly at info@sdefender.com.