EDR / EPPDetect & Respond

One agent. Thirteen modules. Every platform.

Netgraph's Unified Endpoint Agent is a single cross-platform Rust binary for macOS, Linux and Windows, built from 13 composable modules — telemetry, netcollect, osquery-bridge, dspm, uem, yara and more. It streams rich open-schema OCSF telemetry, scores behaviour on-host with an ONNX model, runs EPP anti-malware and YARA scans locally, and inventories the whole machine — while its detections land in the same central alert queue the rest of the platform triages.

macOSLinuxWindows13 Rust modules2,600+ YARA rulesOCSF open telemetryOn-host ONNX scoringEDR + EPP + UEM in one

Book a demo →Why Netgraph →

What is EDR (Endpoint Detection & Response)?

EDR continuously records what happens on laptops, servers, and workloads — processes, network connections, file and registry changes — detects malicious behaviour on-host, and gives responders remote containment: isolate the machine, kill the process, quarantine the file. Netgraph's unified agent combines EDR telemetry, on-host behavioural scoring, and EPP anti-malware in one install, and streams everything into the same knowledge graph the rest of the SOC queries — so an endpoint alert arrives already connected to the identity, network, and vulnerability context around it.

What ships in the module

EDR, EPP and UEM — one binary, no agent sprawl.

Open-schema telemetry

Process, file, network, audit and file-integrity monitoring (FIM) events, normalised to OCSF — plus local user-account discovery that feeds the identity registry. Your endpoint data, in an open schema you can query anywhere.

Behavioural scoring on-host

An ONNX behavioural model scores endpoint activity locally, with the runtime auto-provisioned via brew, apt or winget — no manual dependency chase per platform.

EPP anti-malware

ClamAV integration with auto-install and signature-DB management, optional Bitdefender alongside. Scan detections flow to central Alerts as source “EPP Scan”, and quarantined files sit in a 30-day-TTL queue managed from the Fleet Manager Quarantine tab.

2,600+ YARA rules

Rules imported from elastic/protections-artifacts are compiled and tested server-side, deployed to endpoints over a dedicated yara channel, and scanned on-host with yara-x — content-managed, not hard-coded.

OSQuery, for real

Real osqueryi execution with query packs — results come back as task rows and fold into the security knowledge graph, so a fleet-wide SQL question becomes graph context.

On-host DSPM

Path-scoped sensitive-data discovery runs on the endpoint itself — only classification labels leave the host, never the data. Out-of-box recognizers cover Aadhaar, PAN, bank, passport and health identifiers.

Full UEM inventory

Hardware, software, patch, kernel, application, plug-ins, dependencies and licenses — per-asset profiles reused by the Asset Register (incremental 30-minute sync) and as a UEBA posture risk factor.

Process-tree forensics

Reconstruct the full parent–child process tree behind any detection, with ATT&CK technique tagging — so triage starts from lineage, not a lone event.

Fleet management

Enrollment tokens, policy, tasking and stale-endpoint lifecycle, plus ad-hoc actions — scan · isolate · inventory · live response — all from the Endpoint Fleet Manager.

Signal quality, engineered

Detections that survive restarts, upgrades — and Monday morning.

EDR detections write straight into the central alerts table and get auto-triaged by the L1 autopilot. Before they ever reach an analyst, the EDR Rules & Suppression console shapes the volume: per-rule enable / aggregate / threshold / suppress config, with alerts aggregated per (rule, window) and unique hosts tracked — one aggregate alert instead of a flood.

Per-rule config that survives upgrades — enable, aggregate, threshold, suppress.
Aggregation per (rule, window) keeps unique-host context in a single alert.
Resilient comms: heartbeat with timeout and pool hygiene self-heals after manager restarts; an offline spool covers the gaps.
Upgrade-in-place preserves endpoint identity — no re-enrollment churn.

Functionality map

Module functions at a glance

Function	What it does	Where it lives
Endpoint telemetry	OCSF process / file / network / audit / FIM streams plus local user-account discovery	EDR ▸ Telemetry
Analysis & forensics	Process-tree reconstruction with ATT&CK technique tagging and behavioural verdicts	EDR ▸ Analysis
Visibility	Fleet-wide endpoint visibility over the same open telemetry	EDR ▸ Visibility
Rules & Suppression	Per-rule enable / aggregate / threshold / suppress; aggregation per (rule, window) with unique-host tracking	EDR ▸ Rules & Suppression
YARA rules	2,600+ rules compiled and tested server-side, deployed over the yara channel, scanned on-host with yara-x	EDR ▸ YARA Rules
Fleet Manager	Enrollment tokens, policy, tasking, stale lifecycle, ad-hoc actions (scan · isolate · inventory · live response), Quarantine tab	Fleet ▸ Endpoint Fleet Manager
EPP anti-malware	ClamAV auto-install + signature-DB management, optional Bitdefender; detections → central Alerts (“EPP Scan”)	Agent EPP module + central Alerts
UEM inventory	Hardware / software / patch / kernel / app / plug-in / dependency / license profiles, synced to the Asset Register every 30 minutes	Agent UEM module → Asset Register

Common questions

EDR / EPP — asked and answered

Does the Netgraph EDR agent cover Windows, Linux, and macOS?+

Yes — one cross-platform agent for all three, shipping rich telemetry, on-host behavioural scoring, AV/EPP with quarantine, 2,600+ YARA rules, OSQuery, file-integrity monitoring, live response, and centralised fleet management.

Can I use Netgraph EDR without the full SIEM?+

Netgraph modules are licensed individually with module-level gating, but they gain the most value together: EDR detections land in the same alert queue and knowledge graph that the agentic SOC, NDR, and UEBA read, which is what makes cross-domain correlation automatic.

How does EDR data feed incident response?+

Every endpoint event becomes a node with edges on the security knowledge graph. When an alert fires, the L1/L2 SOC agents traverse from the alert to the host, the identity, the CVE, and the technique in one query — and containment actions (isolate host, kill process) run as gated playbooks with human-in-the-loop approval.

See it live

Enroll one endpoint. Retire three agents.

Book a demo →Browse all modules