SecTepe Endpoint– EDR that protects your company devices

A small program on each device reports program starts, file changes and network connections. On Windows, it also records logins and access to shared folders.

Example: An attacker logs in at night with a stolen account and jumps from one computer to the next. Basic monitoring makes this trail visible.

It checks new files. First it asks our threat intelligence if the file is already known as good or bad. If not, it checks the file with a virus scanner and its own search patterns. On Linux, it stops harmful programs before they start. On Windows, it moves them to quarantine right after they are saved.

Example: An employee downloads a fake invoice that hides malware. The antivirus spots the file and locks it away.

Good to know: It starts in “report only” mode. This way you first see what it would block.

If nobody knows a new program file, SecTepe Endpoint sends it to our sandbox. This is a sealed-off test computer. The file runs there and shows what it does. The device does not wait for this. If the verdict is “harmful”, the antivirus acts at once the next time.

Example: Brand-new malware that no virus scanner knows yet is still caught this way.

It places hidden decoy files, known as canary files. If a program changes one, it raises an alarm at once. It also notices when a program encrypts many files in a short time. Then it stops the program. Every 30 minutes and with every alarm, it takes a snapshot. This is a backup copy of your files. On Windows, it also blocks commands that try to delete these copies.

Example: Malware starts to encrypt your contracts folder at night. The guard stops it, and you bring the files back.

Good to know: It may act at once, without a second approval. You can also set it to “report only”. On Linux, snapshots depend on the file system. If needed, there is an optional copy mode.

It blocks known dangerous web addresses right on the device. The list comes from our threat intelligence and is updated every hour. The block works for all programs, including the browser. It also works outside the company network.

Example: An employee working from home clicks a link to a fake login page. The page does not open.

It blocks USB sticks and external hard drives. Devices you approve still work. Keyboard, mouse and other devices are never affected.

Example: Someone plugs in a USB stick they found. The computer does not accept it, and you get a report.

You decide which programs must not start. On Windows, it can also block programs from the downloads folder. It starts in “report only” mode. Once all is well, you switch the block on.

Example: A program that your company does not allow simply does not start.

Good to know: On Windows, the block is only reliable in the Enterprise and Education editions. On Windows Pro, only the reports are reliable.

Only trusted programs may write to protected folders. Windows enforces this block itself. By default, it only logs what would be blocked.

Example: An unknown program tries to overwrite your documents. Windows does not allow it.

Good to know: It needs the built-in Windows antivirus to be active. If it is not, SecTepe Endpoint raises its own alert.

It guards the files where browsers store passwords and login data. If an unknown program reads them, it raises an alert. If you wish, it stops the program.

Example: Malware tries to steal the passwords saved in the browser and send them out.

Good to know: It steps in after the first read. The data may already be read by then, but it is usually not yet sent.

It spots unknown malware by what it does. One example is reading login data from the memory of Windows. Another is slipping code into other programs. It watches programs from user folders that lack a known publisher. If you wish, it stops them.

Example: A program from the downloads folder tries to grab the Windows login data.

Attackers often try to switch off security first. This module remembers the correct state of all protection parts. If someone changes something, it restores the old state and reports it. Changes are only allowed in a maintenance window that you approve in the console.

Example: An attacker stops the antivirus. Shortly after, it runs again, and you have an alert.

Good to know: Anyone with full admin rights can stop this guard too. But each of these steps raises an alert.

You set the rules once, in one place. All devices fetch them every 15 minutes. If you wish, new rules go to a few test devices first. Each rule set is digitally signed and only applies to the right device. If a device is offline, the last rules stay active.

Example: You want to block USB sticks across the whole company. One change in the console is enough.

Good to know: You can also choose one of three levels: only watch, stop malware, or also isolate the device.

On Linux, SecTepe Endpoint can stop certain attacks right in the core of the operating system. This is off by default. So far it ships with one narrow rule. It blocks a known trick that lets malware hook into every program start.

Example: An attacker tries to settle in for good on your web server. The kernel refuses the step.

Good to know: Test each new rule on a test server first.

You can isolate a device, stop a program or put a file in quarantine. You can bring files back from a snapshot and secure evidence. Each action needs a second approval.

Example: A laptop is infected. You take it off the network before the attack spreads.

Good to know: After setup, everything runs as a dry run first. More on this in the next section.

The protection is built into the SecTepe app. You invite devices through your mobile device management (MDM). The app checks the state of the phone on a regular basis. It spots rooted or jailbroken phones, where the built-in security has been broken open. It finds spy apps, known as stalkerware. On Android, it also reports known malicious apps.

Example: An app on a work phone secretly reads messages. The app reports the find.

Good to know: On iOS, the app cannot see the list of installed apps. Apple does not allow this.

On Macs from macOS 13, SecTepe Endpoint reports which programs start. Suspicious patterns show up in a regular search, not in real time. There are no protection modules or responses for macOS yet.

Example: A script turns off the built-in protection on a Mac. The search finds the command.