HarfangLab EDR/EPP Platform

Captures and analyzes in-memory process state to detect fileless malware, injected shellcode, and credential material that leaves no disk artifacts. Requires kernel-level agent access.

Ingests events from non-endpoint sources (firewall, identity, email, cloud) into the EDR platform for cross-signal correlation, enabling XDR-style detection without a separate XDR product.

Detects threats by modeling process behavior, memory access patterns, and inter-process relationships rather than matching file signatures. Catches novel malware and LOLBin-based attacks that have no signature.

Maintains local detection and prevention capability when the endpoint cannot reach the management console, relevant for air-gapped, traveling, or connectivity-impaired devices.

Provides a query interface over telemetry (process tree, network connections, registry events, file events), for analyst-led investigation independent of alert workflows. Differentiation is query language expressiveness and historical data retention.

Delivers detection, behavioral analysis, and response across Windows, macOS, and Linux agents, with non-Windows coverage depth a common evaluation point.

Runs all detection and response logic locally on the endpoint without requiring a connection to the vendor cloud, preserving full detection capability in air-gapped networks, regulated environments, and high-latency conditions.

Executes isolation, process kill, or persistence removal actions automatically upon detection without waiting for analyst approval. Speed of automated response directly affects breakout time mitigation.

Maps detections and alerts to MITRE ATT&CK with severity ratings and a process tree to aid root cause analysis and remediation.

Executes endpoint response actions automatically upon confirmed detection (process termination, file quarantine, registry key removal, and ransomware rollback), without waiting for analyst approval. Scope of automated actions and rollback fidelity are the primary quality differentiators.

Centrally manages the endpoint host firewall, controlling inbound and outbound network connections per policy to reduce the endpoint's network attack surface alongside device and application controls.

Detects and blocks malware using behavioral analysis and ML models rather than signature matching. Prevents execution of known and novel malware including script-based and fileless attacks.

Enforces policies on USB storage, Bluetooth, and peripheral device connections, blocking, allowing, or auditing data transfer based on device type and user identity.

Scans endpoints for missing OS and application patches, surfacing vulnerability exposure without requiring a separate vulnerability management scanner.

Executes unknown files in an isolated VM before allowing them to run on the endpoint, enabling detection of zero-day and evasive malware through behavioral observation.

Detects and blocks endpoint threats using behavioral analysis of endpoint, application and user activity.

Provides an embedded AI assistant for alert summarization, investigation and response guidance.

Identifies cloud resources, SaaS applications, and exposed services deployed by business units without IT or security team visibility or approval.

Identifies software stacks, versions, and components running on discovered assets through passive banner analysis and active probing, mapping CVE exposure without authenticated scanning.

Continuously enumerates internet-exposed assets (domains, IPs, subdomains, certificates, cloud storage, APIs) using passive DNS, certificate transparency logs, and active probing, including assets outside the official inventory.

Ranks discovered exposures by combining exploitability signals, asset business context, and active threat intelligence to produce an actionable remediation queue.