Sense · Endpoint Intelligence
Your indicators, matched on the host. Response on a separate wire.
Stock osquery on Linux and Windows, and the Wahukeza agent on Android phones, all on one gateway. Endpoint observables are matched against your indicators and recorded as sightings; new credentials, listeners and persistence are baselined at enrolment so a fresh server is quiet. Containment is a separate, signed, four-eyes channel. By construction, not by policy.
Telemetry
No forked binary. No command channel.
osquery · TLS remote API
Stock collector
The platform implements osquery’s TLS API itself; installers for Linux and Windows render the enrolment secret and the tenant into the flags file.
android
Phones on the same gateway
The Android agent speaks the same protocol, so phones appear in the same endpoint list, under the same rules. See Mobile protection.
indicator matching
Your indicators, on the host
Processes, connections, DNS lookups and file hashes seen on the host are matched against your indicators; a match is a sighting that moves confidence.
first-seen
Enrolment baseline
Credentials, services and persistence entries fold into inventories. What a host carried at enrolment is inventory, not a page.
set-based ingest
Built for volume
Events are deduplicated by content and rules are evaluated in a background job, never inline on the agent’s request.
EDR + AV
Complements, does not replace
This is intelligence on the endpoint: your own indicators and state changes. It sits beside your EDR and anti-virus, not instead of them.
Mobile protection: the Android agent and phone notifications →
Query library
Ask your fleet a question. Read-only, provably.
Analysts author their own osquery queries in a tenant library: Draft → Published → Retired. Run one ad hoc against a host, a set of hosts or an asset group, or put it on a schedule (no more often than every 300 seconds, up to 25 per tenant, pausing itself if it floods rows). Every query passes a fail-closed validator first: one SELECT, no write keywords, and the tables that could reach out or pull files (curl, carves) refused. Eight system queries ship locked.
query · unsigned-binaries-in-tmp · draft
SELECT p.pid, p.name, p.path FROM processes p WHERE p.path LIKE '/tmp/%';
# valid · one statement · read-only → publish
query · fetch-check · draft
SELECT * FROM curl WHERE url = 'http://203.0.113.9/';
# refused · table curl is not allowed
Patch compliance & vulnerable packages
Are your hosts where you said they would be?
Compliance, never patch management: the platform tells you which hosts are behind; your patch tooling does the patching.
daily inventory
Packages and hotfixes
Installed packages and Windows hotfixes, collected daily from every host.
5 rule kinds
Your patch rules
Windows build, KB hotfix, minimum package version (deb, rpm, Windows programs), minimum kernel, minimum OS. Version comparison follows dpkg and rpm rules, not string order.
closes itself
Findings that resolve
A missing-patch finding closes when the host reports the fix. Nobody has to remember to.
Red Hat · MSRC · Debian · Alpine
Vulnerable packages
Matched against vendor advisories, which understand backported fixes. Confirmed or Potential, and one click suggests the patch rule that would track it.
East-west
Alert on what a host never did before.
Admin-port connections between your own hosts (SSH, SMB, RDP, WinRM) are learned per host over its first 24 hours. After that, five or more new internal peers on admin ports within 60 minutes is a High detection. And any host that contacts a decoy address from the Deception Fabric is named: the decoy tells you who.
- rule
- lateral fan-out · 7 new internal peers on 445 / 3389 in 41 min
- baseline
- learned 2026-03-02 · no admin-port peers before
- also
- contacted decoy address 10.20.4.17 (sql-server · decoy group finance)
- analyst
- open case · propose isolate host
Illustrative.
Endpoint Response · its own module
Five verbs. Every one signed and approved; all but kill can be reverted.
Endpoint Response is its own module (in Complete, or licensed on its own) with its own agent, its own credential and its own controller, so a compromised telemetry key can never become a command channel. It runs on Linux and Windows. It is built and gated, and the gates are the point.
isolate host
Deny-all except an allow list that always includes the platform, so the host can still report and receive its revert. nftables on Linux, Windows Firewall on Windows.
kill process
The process is matched by its executable’s hash before it is killed, so a recycled process id is never the target.
quarantine file
Hash-verified first, moved to a quarantine store, restorable from it.
disable local account
Local accounts only. A domain-qualified name is refused outright; domain accounts belong to your directory.
revert
Undoes an applied action. Isolation and account disables also carry a deadline after which they revert themselves.
Separate agent, separate credential
Response runs in its own agent with its own key. It never rides the telemetry gateway, and a test suite proves osquery’s query path cannot carry a response document.
Signed, host-bound, time-limited
Every action is an Ed25519-signed document naming one host and expiring. The agent verifies before it acts.
Dry run first
The first action proposed against any host defaults to a dry run, so you see what would happen before anything does.
Four-eyes
An admin who did not propose the action approves it. Actions on critical assets also need a platform operator.
Fresh sign-in to approve
Approval needs a sign-in within the last 15 minutes, on a desk or from a phone.
Ceilings
A daily cap per tenant (default 20), and no more than 10 % of the fleet isolated at once.
Kill switches
A fleet kill switch stops new actions and queues reverts for everything applied. Per-host exclusions, and a local disable file on the host itself.
No general-purpose verbs
No run-script, no exec, no push-file. Adding a verb is an architecture decision, not a configuration change.
Playbooks can propose a response action; they cannot approve one. Approvals can be given from a phone through Mobile Notifications, under the same four-eyes and fresh-sign-in rules. Android devices take no response actions: on a phone, enforcement is the blocklist.
Enrol one server.
An installer, a tenant id and an enrolment secret. You see its inventory as soon as the first scheduled queries report, and over the following days what changed. Endpoint Intelligence and Endpoint Response are in the Complete package or licensed individually; endpoints are agreed per quote.