Host containment
On a host you enrolled for ransomware detection, the agent can kill the process it attributed to its own critical alert and isolate that host's network — once you have armed it, in two separate places.
What people come here for
Ransomware Detection
Calibrated combinations of file entropy, mass renaming and decoy files, rather than any one of them alone. Backup-deletion detection is Linux-only: the Windows equivalent is invisible to a file watcher, and this says so instead of implying coverage.
Full definition →Armed twice, or not at all
Containment fires only when you have armed it by command AND the host operator has set the literal in the agent's own environment. Either one missing and the agent notifies instead of acting.
Full definition →EDR
When an incident opens, reads the process tree, injection signals and persistence. Memory maps the host refuses to expose are reported as not examined — never as clean.
Full definition →File Integrity
Fingerprints the files you put under watch and raises an alert the moment one of them is modified.
Full definition →Everything else in this surface
Each name opens its own one-line definition in the capability catalogue.
What this does not do
Killing a process on a production host can cost you more than the attack did. Every outcome, including no observed effect, is written to the evidence ledger.
Everything this product does not do →