Falcon — Endpoint Detection & Response

What the product does

Falcon installs a single sensor on the workstation or server, which continuously reports every execution event: processes launched, command lines, file writes, network connections, module loads, registry changes. That stream is analysed on the platform and matched against known adversary behaviour.

The four capabilities that matter

• Prevention

  Malicious executions blocked before launch — signatures, local machine learning and behavioural indicators of attack that keep working offline.

• Behavioural detection

  The analysis looks at the sequence of actions, not the file hash. That is what catches attacks using nothing but legitimate system binaries.

• Remote response

  Network isolation of the endpoint, process termination, file deletion, and a remote shell to investigate without travelling or cutting the user off from everything.

• Retrospective investigation

  The full process tree is retained: you trace back from the alert to the first click, and you know what to look for on the rest of the estate.

Why an EDR is not enough on its own

An EDR produces alerts. Without someone to read them at three in the morning, qualify them and decide to isolate a machine, it produces nothing but a dashboard. That is precisely what we operate: the tool stays yours, the watch is ours.