Respond to attacks, fast and under control
Spotting an attack is not enough. You need to step in before it spreads. This is the response part of endpoint detection and response. With SecTepe Endpoint, you isolate a device from the console. You stop programs and bring files back. Every action needs a second person.
Request a demoFive actions for Windows and Linux
You start every action from the console. The device carries it out and reports the result back.
Isolate the device
The device loses its network connection. Only the link to the platform and a few basic services stay open. So you can keep examining the device. The isolation holds even after a restart. If the platform cannot be reached, SecTepe Endpoint does not isolate, on purpose. Otherwise you would lose remote access to the device.
Stop a process
A running program is stopped. You pick it by its number or its exact name. Key parts of the operating system and SecTepe Endpoint itself are protected from this.
Quarantine a file
The file is moved, not deleted. It goes to a secured folder. If the file has changed since the alert, SecTepe Endpoint refuses. It also refuses in system and program folders. So nobody breaks Windows by accident.
Restore from a snapshot
If ransomware protection took a snapshot, you can bring files back from it. They go to a separate folder first. Your current files are only overwritten if you clearly ask for it.
Collect evidence
Traces from the device are collected for later analysis. This needs an extra program. If an alert turns into a real incident, ourincident response teamcan help.
Four-eyes approval: nobody acts alone
During an attack, people are under pressure. Still, nobody should take the accounting server offline by mistake. So the rule is: one person asks for the action. Another person approves it. Only then does SecTepe Endpoint carry it out. The same applies to lifting an isolation.
There is one exception. Ransomware protection may act at once if you set it up that way for a device. While files are being encrypted, any wait would be too long.
Start with a dry run
After setup, everything runs as a dry run. The whole chain is checked, from the request to the result. But nothing is carried out. So you see whether everything fits. Only then do you switch it on for real.
A log of every action
Every action is logged on the device and reported back to the console. There you see whether it is done or has failed. If part of the system breaks down, the action shows up as failed. It does not get lost without a trace. This also helps you with proof, for example for NIS2 or ISO 27001.
Learn the basics in our glossary entries onendpoint detection & responseand ransomware.
FAQ on endpoint response
- Can I turn off the second approval for emergencies?
- Not for actions from the console. The one exception is ransomware protection. It may act at once if you set it up that way for a device. Lifting an isolation still needs approval, even then.
- What happens if an isolated device restarts?
- The isolation stays in place. SecTepe Endpoint applies it again after the restart. Only an approved release lifts it.
- Is a quarantined file deleted?
- No. It is moved to a secured folder. Only the system and administrators can reach it there. If it was a false alarm, the file is still there.
- Do these actions work on smartphones too?
- Partly. On Android and iOS devices, isolation locks the company data in the SecTepe app. Stopping processes, quarantine and snapshots do not exist there. The platform rejects these actions for mobile devices.
See the approval flow for yourself
In a demo, we isolate a test device, with request, approval and log.
Request a demoHow we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.