ComodoSecurity/openedr

Features

• Endpoint Detection and Response - Provides a comprehensive endpoint detection and response platform for monitoring system activity and detecting security breaches.
• Intrusion Detection Systems - Implements a host-based intrusion detection system that monitors system activity and applies alerting policies to detect security breaches.
• Telemetry Collection and Aggregation - Gathers detailed file, device, and system activity data to provide granular visibility into environment behavior.
• Intrusion Detection Systems - Functions as a host-based intrusion detection system by tracking API calls and kernel activity on Windows endpoints.
• Event Callbacks - Implements kernel-level callbacks to intercept process and thread lifecycle changes for security telemetry collection.
• User-Mode API Hooking Frameworks - Implements user-mode API hooking to intercept function calls in running processes for activity tracking.
• Process Hierarchy Tracking - Tracks parent-child process relationships and lineage within the kernel to reconstruct attack timelines.
• Attack Root Cause Analysis - Provides a security event visualizer that maps process lineage to facilitate the root-cause analysis of system compromises.
• Runtime Threat Detection - Evaluates real-time system activity against security rules to identify malicious patterns and breach indicators.
• Endpoint Activity Monitoring - Tracks process creation, deletion, and API calls via kernel callbacks and library injection to detect malicious behavior.
• System Registry Monitoring - Provides hooks to record modifications and unauthorized changes to both the file system and system registries.
• Log Aggregation Pipelines - Includes a log aggregation pipeline that indexes raw endpoint telemetry for rapid querying and root-cause analysis.
• Telemetry Collectors - Gathers detailed process, network, and file activity data via kernel drivers and API hooking for security analysis.
• Process Lineage Visualizers - Provides a visualizer to map process lineage and parent-child relationships for performing root-cause analysis of attacks.
• System Call Monitors - Instruments and tracks system calls on Windows to detect suspicious behavior or unauthorized activity.
• Root Cause Analysis - Parses and indexes endpoint data using a log-aggregation stack to enable breach detection and root-cause analysis.
• Telemetry Querying - Provides the ability to query collected telemetry and alerts to identify patterns of compromise across the environment.
• Security Event Monitoring - Includes a graphical interface and dashboards for monitoring logs, metrics, and security events.
• System Activity Monitoring - Tracks process creation, registry access, and network activity through kernel drivers and API hooking.
• Network Traffic Monitors - Filters and records network activity to identify communication with malicious domains or unusual data transfers.
• Docker Container Deployments - Packages the security platform into Docker images to simplify installation and ensure consistent runtime environments.
• Multi-Container Stacks - Provides a multi-container Docker stack that bundles search, logging, and visualization tools for telemetry analysis.
• Event Filtering Rules - Processes endpoint telemetry through customizable rule-based filtering to trigger security alerts.
• Infrastructure Deployment - Enables the deployment of a search, logging, and visualization stack to collect and analyze telemetry from endpoints.
• Integrity Protection Managers - Uses a dedicated self-protection provider to prevent unauthorized changes to security components and configurations.
• Agent Self-Protection - Implements a dedicated provider to protect monitoring agents and configurations from unauthorized modifications.
• Self-Protection Mechanisms - Implements a dedicated self-protection provider to prevent unauthorized modifications to monitoring agents and configurations.
• Threat Hunting Workflows - Provides workflows for querying indexed security logs and telemetry to proactively identify patterns of compromise.
• Security Alert Triggers - Defines custom rule sets and policies that trigger security alerts when suspicious activities are detected.
• Telemetry Filters - Implements customizable rule sets to filter telemetry and security events before they are forwarded to the server.

Star history