SCIAT EDR
Full process-level telemetry from every endpoint, so you can hunt for an adversary already inside, and reconstruct exactly what they touched.
Endpoint detection, investigation and response.
What SCIAT EDR
Actually Does
Prevention stops most attacks. EDR is for the ones it does not. SCIAT EDR records process execution, network connections, file changes and credential use across your endpoints, and keeps that history long enough to be useful when you find out weeks later that something happened. When an investigation starts, you can follow the whole chain rather than guessing from what survived.
Everything Included
in SCIAT EDR
Process trees, command lines, network connections, file writes and registry changes, recorded continuously and retained.
Query your estate for indicators and behaviours directly, rather than waiting for a rule to fire.
Follow an incident from first execution to lateral movement, with the full chain laid out rather than isolated alerts.
Isolate a host, kill a process, collect an artefact or run a remediation script from the console, without visiting the desk.
Detections are mapped to ATT&CK techniques so you can see coverage gaps rather than just alert counts.
Export evidence in a form our forensics practice can take straight into a formal investigation.
The Detail
You Asked For
- Platforms
- Windows 10/11, Windows Server 2016+, macOS 12+, major Linux distributions
- Telemetry retention
- Configurable, 30 days minimum
- Response actions
- Host isolation, process termination, artefact collection, script execution
- Framework mapping
- MITRE ATT&CK
- Minimum seats
- 25
