# Endpoint Intelligence & Response

> Endpoint threat intelligence with managed osquery on Linux and Windows plus an Android agent: indicator matching, patch compliance, four-eyes response.

Source: https://wahukeza.com/platform/endpoint-intelligence

Sense · Endpoint Intelligence

## Your indicators, matched on the host. Response on a separate wire.

Stock osquery on Linux and Windows, and the Wahukeza agent on Android phones, all on one gateway. Endpoint observables are matched against your indicators and recorded as sightings; new credentials, listeners and persistence are baselined at enrolment so a fresh server is quiet. Containment is a separate, signed, four-eyes channel. By construction, not by policy.

Telemetry

## No forked binary. No command channel.

-   osquery · TLS remote API
    
    ### Stock collector
    
    The platform implements osquery’s TLS API itself; installers for Linux and Windows render the enrolment secret and the tenant into the flags file.
    
-   android
    
    ### Phones on the same gateway
    
    The Android agent speaks the same protocol, so phones appear in the same endpoint list, under the same rules. See Mobile protection.
    
-   indicator matching
    
    ### Your indicators, on the host
    
    Processes, connections, DNS lookups and file hashes seen on the host are matched against your indicators; a match is a sighting that moves confidence.
    
-   first-seen
    
    ### Enrolment baseline
    
    Credentials, services and persistence entries fold into inventories. What a host carried at enrolment is inventory, not a page.
    
-   set-based ingest
    
    ### Built for volume
    
    Events are deduplicated by content and rules are evaluated in a background job, never inline on the agent’s request.
    
-   EDR + AV
    
    ### Complements, does not replace
    
    This is intelligence on the endpoint: your own indicators and state changes. It sits beside your EDR and anti-virus, not instead of them.
    

[Mobile protection: the Android agent and phone notifications →](https://wahukeza.com/platform/mobile)

Query library

## Ask your fleet a question. Read-only, provably.

Analysts author their own osquery queries in a tenant library: Draft → Published → Retired. Run one ad hoc against a host, a set of hosts or an asset group, or put it on a schedule (no more often than every 300 seconds, up to 25 per tenant, pausing itself if it floods rows). Every query passes a fail-closed validator first: one SELECT, no write keywords, and the tables that could reach out or pull files (curl, carves) refused. Eight system queries ship locked.

query · unsigned-binaries-in-tmp · draft

SELECT p.pid, p.name, p.path FROM processes p WHERE p.path LIKE '/tmp/%';

\# valid · one statement · read-only → publish

query · fetch-check · draft

SELECT \* FROM curl WHERE url = 'http://203.0.113.9/';

\# refused · table curl is not allowed

Patch compliance & vulnerable packages

## Are your hosts where you said they would be?

Compliance, never patch management: the platform tells you which hosts are behind; your patch tooling does the patching.

-   daily inventory
    
    ### Packages and hotfixes
    
    Installed packages and Windows hotfixes, collected daily from every host.
    
-   5 rule kinds
    
    ### Your patch rules
    
    Windows build, KB hotfix, minimum package version (deb, rpm, Windows programs), minimum kernel, minimum OS. Version comparison follows dpkg and rpm rules, not string order.
    
-   closes itself
    
    ### Findings that resolve
    
    A missing-patch finding closes when the host reports the fix. Nobody has to remember to.
    
-   Red Hat · MSRC · Debian · Alpine
    
    ### Vulnerable packages
    
    Matched against vendor advisories, which understand backported fixes. Confirmed or Potential, and one click suggests the patch rule that would track it.
    

East-west

## Alert on what a host never did before.

Admin-port connections between your own hosts (SSH, SMB, RDP, WinRM) are learned per host over its first 24 hours. After that, five or more new internal peers on admin ports within 60 minutes is a High detection. And any host that contacts a decoy address from the Deception Fabric is named: the decoy tells you who.

[Decoy groups](https://wahukeza.com/platform/sensors#internal)

detection · ws-fin-14 · windowshigh

rule

lateral fan-out · 7 new internal peers on 445 / 3389 in 41 min

baseline

learned 2026-03-02 · no admin-port peers before

also

contacted decoy address 10.20.4.17 (sql-server · decoy group finance)

analyst

open case · propose isolate host

Illustrative.

Endpoint Response · its own module

## Five verbs. Every one signed and approved; all but kill can be reverted.

Endpoint Response is its own module (in Complete, or licensed on its own) with its own agent, its own credential and its own controller, so a compromised telemetry key can never become a command channel. It runs on Linux and Windows. It is built and gated, and the gates are the point.

-   isolate host
    
    Deny-all except an allow list that always includes the platform, so the host can still report and receive its revert. nftables on Linux, Windows Firewall on Windows.
    
-   kill process
    
    The process is matched by its executable’s hash before it is killed, so a recycled process id is never the target.
    
-   quarantine file
    
    Hash-verified first, moved to a quarantine store, restorable from it.
    
-   disable local account
    
    Local accounts only. A domain-qualified name is refused outright; domain accounts belong to your directory.
    
-   revert
    
    Undoes an applied action. Isolation and account disables also carry a deadline after which they revert themselves.
    

-   Separate agent, separate credential
    
    Response runs in its own agent with its own key. It never rides the telemetry gateway, and a test suite proves osquery’s query path cannot carry a response document.
    
-   Signed, host-bound, time-limited
    
    Every action is an Ed25519-signed document naming one host and expiring. The agent verifies before it acts.
    
-   Dry run first
    
    The first action proposed against any host defaults to a dry run, so you see what would happen before anything does.
    
-   Four-eyes
    
    An admin who did not propose the action approves it. Actions on critical assets also need a platform operator.
    
-   Fresh sign-in to approve
    
    Approval needs a sign-in within the last 15 minutes, on a desk or from a phone.
    
-   Ceilings
    
    A daily cap per tenant (default 20), and no more than 10 % of the fleet isolated at once.
    
-   Kill switches
    
    A fleet kill switch stops new actions and queues reverts for everything applied. Per-host exclusions, and a local disable file on the host itself.
    
-   No general-purpose verbs
    
    No run-script, no exec, no push-file. Adding a verb is an architecture decision, not a configuration change.
    

Playbooks can propose a response action; they cannot approve one. Approvals can be given from a phone through [Mobile Notifications](https://wahukeza.com/platform/mobile), under the same four-eyes and fresh-sign-in rules. Android devices take no response actions: on a phone, enforcement is the blocklist.

## Enrol one server.

An installer, a tenant id and an enrolment secret. You see its inventory as soon as the first scheduled queries report, and over the following days what changed. Endpoint Intelligence and Endpoint Response are in the Complete package or licensed individually; endpoints are agreed per quote.

[Book a demo](https://wahukeza.com/contact?intent=demo)

[See the packages](https://wahukeza.com/pricing)