Ransomware behavior detection
Monitors canary file changes, unusual file entropy and rename patterns that may indicate ransomware activity.
Defendria
Endpoint security.
Evidence you can act on.
Sentinel is Defendria’s endpoint detection and response (EDR) platform for IT teams in small and midsize organizations. Monitor endpoints, investigate alerts and manage response in one console.
Information for your security review
Detection and protection
Detect suspicious
endpoint activity.
Review process, file and network activity from enrolled endpoints. Sentinel combines detection layers with the evidence needed to investigate a finding.
How detection fits the workflowDocument analysis
Examines document text and page images for phishing cues. The resulting verdict and analysis context can be reviewed with the file evidence.
Suspicious execution and evasion
Looks for suspicious PowerShell activity, abuse of Windows utilities, AMSI bypass indicators and reflective loading patterns.
An investigation in practice
Why did
PowerShell start?
Follow the parent process, associated file and outbound connection to understand what led to the alert.
See the investigation viewDefendria Sentinel.
Our endpoint security platform.
See the screens your team uses to review alerts, manage devices and follow up on actions.
Product detailsOpen the investigation.
Inspect the source process and command line, follow the activity timeline, and review related entities.
Choose a response.
Available controls depend on permissions, policy and device state. Check the reported result after requesting an action.
- Device isolation and file quarantine
- Playbooks with approvals and cooldowns
- Action history for follow-up
Know which devices need attention.
Check last-seen times and reporting gaps. Group devices to manage policy assignments.
- Device health and reporting gaps
- Device groups and policy settings
- Organization roles and access controls
Prepare for the next review.
Use detection trends, severity breakdowns and response-time reports for team and management reviews.
Sentinel threat coverage
Beyond the
suspicious file.
Review credential access, redirected traffic and exploitation signals.
- Browser credential theft
- Look for unexpected access to saved passwords and browser cookies, helping your team investigate risks to accounts and sessions.
- Network impersonation
- Investigate signs of traffic interception or redirection, using endpoint checks for ARP spoofing and DNS anomalies.
- Exploitation chains
- See how an inbound connection, a spawned shell and outbound traffic relate when investigating an exploited service.
Working as a team
Keep the
investigation moving.
Give the work an owner.
Keep assignment, status and related alerts together so colleagues can see who is handling the investigation.
Hand over the context.
Give the next person the case history and supporting evidence when they pick up the work.
Follow the action through.
Check response status and action history. A request is distinct from its reported result.
Cross-device correlation
Is this happening
on other devices?
Find devices and incidents linked by a shared hash, source IP or process activity. Review each link before drawing conclusions.
- File hashes
- Source IPs
- Process activity
Threat intelligence
What else do we know
about this indicator?
Look up indicators in workspace intelligence and connected reputation services, then return to the original finding.
- File hashes
- IPs & domains
- URLs
Threat-intelligence access depends on your plan and the reputation services connected to Sentinel.
Security, privacy
and support.
Review Defendria’s data handling, processing terms and support commitments before choosing a provider.
Explore security & trustContact Defendria
Security disclosuressecurity@defendria.com
Privacy questionsprivacy@defendria.com
Product supportsupport@defendria.com
Plan your
Sentinel evaluation.
Start with a walkthrough, review licensing and prepare a rollout that fits your environment.
Deployment & evaluationCan I see Sentinel before deploying?
Book a guided console walkthrough before installing an agent.
Book a demoHow is Sentinel licensed?
Compare per-endpoint plans, billing options and included capabilities.
Pricing & licensingWhere can my team find setup guidance?
Use the practical guides for enrollment, reporting, policies and everyday tasks.
Documentation & helpSee how Sentinel
fits your team.
Tell us how you manage endpoints and where security work gets stuck. We’ll focus the demo on those tasks.
Request a demo