How is EDR software different from an antivirus scanner?

An antivirus scanner checks files. An EDR solution also records what happens on the device: process starts, file access, network connections. This produces alerts, and from the console you can respond, for example by isolating a computer. SecTepe Endpoint covers both. The on-access scanner is an optional module in the agent bundle.

Does SecTepe Endpoint protect against ransomware?

The ransomware guard detects typical behavior: writes to decoy files and many files that look encrypted within a short time. It kills the process and takes a snapshot you can restore files from. The guard is opt-in. There is no guarantee: on Windows it reacts after the write, not before it.

Who approves a response such as isolation?

One person requests the action in SecTepe.Core, a second person approves it. Only then does SecTepe.Comm run it on the device. The one exception is the ransomware guard: it may kill a process right away if you configure it that way per host. Lifting an isolation needs another approval.

Is SecTepe Endpoint available as managed EDR?

You can run the platform yourself or combine it with our Security Operations Center. The SOC then reviews the alerts and responds within the scope set in your contract. The SOC is vendor-neutral, so it does not require SecTepe Endpoint.

Which operating systems are supported?

Windows and Linux (Debian, Ubuntu, RHEL family, SLES; x86_64 and aarch64) get the full agent bundle. For macOS 13 and later there is only process telemetry so far. Android and iOS are covered by a sensor in the SecTepe app, and responses there run as MDM commands.

Where does the data live?

The agents send their telemetry over mTLS to the Wazuh manager in your SecTepe.Comm environment. From there, alerts go to SecTepe.Core. Mobile devices only send device and app metadata, no emails, messages, photos or location data.

SecTepe.Comm

Endpoint Detection & Response

SecTepe Endpoint– EDR you run yourself

SecTepe Endpoint shows what happens on your computers and servers. It reports suspicious behavior and helps you step in: isolate a device, kill a process, quarantine a file. Each of these actions needs approval from a second person.

Request a demo

At a glance

Wazuh-Agent, Sysmon, Tetragon (eBPF), auditd
Ransomware guard with rollback snapshots (opt-in)
On-access scanner with CTI reputation (opt-in)
Windows, Linux, Android and iOS
Responses only after four-eyes approval
Telemetry stays in your environment

What SecTepe Endpoint is

SecTepe Endpoint is the EDR solution in SecTepe.Comm. It is not a new agent but a bundle. It installs proven open-source tools on each device and configures them so that together they deliver telemetry and can carry out responses.

The data goes to the Wazuh manager in your SecTepe.Comm environment. Rules check every event there. Serious hits show up in SecTepe.Core as detections, where analysts work on them. The rules map hits to MITRE ATT&CK techniques.

Our glossary explains howendpoint detection and response works in general.

What the agent bundle contains

The first four parts are the base setup. You add the scanner and the ransomware guard per device.

Wazuh-Agent

Carries events to the manager. It also handles file integrity monitoring, configuration checks and running responses.

Sysmon (Windows)

Reports processes, file and registry changes, network connections and DNS queries. PowerShell script blocks are logged too.

Tetragon with eBPF (Linux)

Sees program starts, access to sensitive files, privilege changes, kernel modules and outbound connections. Needs kernel 5.4 or later.

auditd (Linux)

Keeps program calls and connections as an audit trail. The rules are locked and can only change after a reboot.

On-access scanner (opt-in)

Looks up a file hash in SecTepe.Core.CTI and checks the file with ClamAV and YARA. On Linux before it runs, on Windows right after it is written.

Ransomware guard (opt-in)

Spots encryption through decoy files and write patterns, kills the process and takes a snapshot.

More optional modules: a URL guard with a domain blocklist from CTI, USB device control, app control with AppLocker or AppArmor, a tamper guard that protects the sensors, and a signed fleet policy from SecTepe.Core. On Windows you can add Controlled Folder Access (default: audit). On Linux, Tetragon can block in the kernel. For this we ship a single, narrow rule, and it is off by default.

Ransomware protection: decoys, entropy, rollback

Ransomwareencrypts many files in a short time. That is what the ransomware guard watches for. It uses two signals:

Canary files: The guard places hidden decoy documents. Any write to them triggers at once.
Mass-write heuristic: For each process it counts how many files are written within a few seconds and how many look encrypted (high entropy). Typical file extensions and ransom notes count as well.

You choose the mode per host: report only, kill the process, or kill and isolate the host. The guard takes a snapshot on every hit and also every 30 minutes. On Windows it uses shadow copies (VSS), on Linux btrfs or ZFS. For ext4 and xfs there is a copy-based option that you turn on separately.

On Windows the guard also stops commands that delete shadow copies. We are open about the limits: on Windows the guard reacts after the write, not before it. A process with admin rights can still destroy shadow copies. On hosts with backup or sync software, we recommend starting in report-only mode.

Supported platforms

All devices appear in the same console in SecTepe.Core, separated by tenant.

Windows

Full bundle with Wazuh, Sysmon and PowerShell logging. Install with PowerShell or as an MDM job. The installer stops if the checksums for the binaries are missing.

Linux

Debian, Ubuntu, the RHEL family and SLES on x86_64 and aarch64. Roll out with a script or as a deb or rpm package.

macOS

From macOS 13, the agent only delivers process telemetry so far. Prevention and the tamper guard are not yet available there.

Android and iOS

A sensor in the SecTepe app detects root, jailbreak, hooking and stalkerware. Devices are invited through the MDM. On iOS there is no app inventory and no remote lock.

Responding with four-eyes approval

One person requests the action in SecTepe.Core, a second person approves it. SecTepe.Comm then runs it and reports the result back.

• Isolate: The host loses network access. The manager, Core, DNS and DHCP stay reachable, even after a reboot.
• Kill process: by PID or name; core processes and the agent are protected.
• File quarantine: The file is moved, not deleted. The script refuses system and program paths.
• Snapshot restore: restores files to a separate folder first. It only overwrites the originals if you ask for it.
• Triage collection: gathers forensic artifacts through Velociraptor. The client is optional.

Good to know

After setup, execution runs in dry-run mode. This lets you test the whole flow before you switch it on.
The only exception to the four-eyes rule: the ransomware guard may act at once if you set it up that way per host.
On mobile devices, actions become MDM commands: lock company data, lost mode, wipe the app data. A factory reset is deliberately not possible.

Connected to SIEM, threat intelligence and SOC

SecTepe Endpoint uses the same Wazuh manager as theWazuh SIEM in SecTepe.Comm. Endpoint alerts sit next to all your other logs. They also feed into correlation and case handling.

The scanner and the URL guard look up hashes and domains inSecTepe.Core.CTI. If you want, the scanner sends unknown programs to a sandbox after its decision. The sandbox verdict then applies the next time the same file starts. This is opt-in as well.

If an alert turns into a real incident, ourincident response team can help.

Data control and managed EDR

The agents connect over mTLS to the Wazuh manager in your SecTepe.Comm environment. Telemetry does not go to a third-party cloud service. One manager can serve several tenants, and each agent belongs to exactly one.

An EDR solution raises alerts around the clock. If you do not have your own team for that, you can combine SecTepe Endpoint with our Security Operations Center. The SOC reviews the alerts and responds within the scope you set in advance.

Frequently asked questions about SecTepe Endpoint

How is EDR software different from an antivirus scanner?: An antivirus scanner checks files. An EDR solution also records what happens on the device: process starts, file access, network connections. This produces alerts, and from the console you can respond, for example by isolating a computer. SecTepe Endpoint covers both. The on-access scanner is an optional module in the agent bundle.
Does SecTepe Endpoint protect against ransomware?: The ransomware guard detects typical behavior: writes to decoy files and many files that look encrypted within a short time. It kills the process and takes a snapshot you can restore files from. The guard is opt-in. There is no guarantee: on Windows it reacts after the write, not before it.
Who approves a response such as isolation?: One person requests the action in SecTepe.Core, a second person approves it. Only then does SecTepe.Comm run it on the device. The one exception is the ransomware guard: it may kill a process right away if you configure it that way per host. Lifting an isolation needs another approval.
Is SecTepe Endpoint available as managed EDR?: You can run the platform yourself or combine it with our Security Operations Center. The SOC then reviews the alerts and responds within the scope set in your contract. The SOC is vendor-neutral, so it does not require SecTepe Endpoint.
Which operating systems are supported?: Windows and Linux (Debian, Ubuntu, RHEL family, SLES; x86_64 and aarch64) get the full agent bundle. For macOS 13 and later there is only process telemetry so far. Android and iOS are covered by a sensor in the SecTepe app, and responses there run as MDM commands.
Where does the data live?: The agents send their telemetry over mTLS to the Wazuh manager in your SecTepe.Comm environment. From there, alerts go to SecTepe.Core. Mobile devices only send device and app metadata, no emails, messages, photos or location data.

Try SecTepe Endpoint in your environment

In a demo we show you telemetry, detections and the approval flow.

Request a demo Back to SecTepe.Comm

How we work with you

We see every project as a long-term partnership, not a one-off delivery. Our approach has four clear phases. So you always know what happens next, who is in charge of what and which results to expect.

1. Free initial conversation

We learn about your starting point, your goals and your constraints. In 30 to 45 minutes we check whether our offer fits your situation. We outline possible paths and answer your questions, with no obligation.

2. Structured assessment

We record the current state: technical, organizational and regulatory. You get a prioritized assessment that names strengths, gaps and areas for action. It is the basis for a reliable offer.

3. Delivery with a dedicated lead

An experienced lead guides you through the delivery. You get clear milestones, transparent planning of effort and cost, and a weekly status. All results are documented and belong to you.

4. Continuous operations & review

After the project, we stay with you in operations. This includes managed services, regular reviews and tracking of open actions. We also reach out when new threats, new rules or technology changes come up.