XCITIUM / EDR
Endpoint telemetry, behavioural analysis and response actions give your team context for investigation.
Inside the architecture
The agent captures system activity for continuous visibility.
Endpoint telemetryVirusScope behavioural analysis, threat intelligence and forensic evidence clarify the event.
VirusScope™Containment and automated response follow policy; reporting preserves investigation findings.
Containment · ResponseXcitium’s next-generation antivirus approach uses behavioral analysis, machine learning and threat intelligence. NGAV identifies malicious signals, ZeroDwell contains unknown execution, and EDR retains event context for investigation and response.
The agent collects system activity on enrolled devices, giving the security team process, file and event context to investigate. Coverage is limited to endpoints with a supported agent installed.
VirusScope combines event sequences, behavioural patterns and available telemetry for threat investigation.
Analytics relates threat indicators and behavioural context to endpoint events. External feeds and integrations depend on the selected configuration.
Unknown or suspicious execution can be contained under policy. The goal is to limit impact while it is investigated; rules, exceptions and release decisions should match the system owner’s risk model.
Approved workflows can automate endpoint isolation and selected remediation steps. Decide in advance which actions are automatic and which need approval; validate recovery and rollback behaviour in the pilot.
Incident telemetry, investigation findings and audit records explain events and track remediation. Central policies manage endpoint groups, and records support compliance work.
Compare approaches
| Consideration | EDR: detection and investigation | Containment: limiting impact |
|---|---|---|
| Primary purpose | Collect, analyse and investigate endpoint events. | Limit the impact of suspicious or unknown execution under policy. |
| Main input | Agent telemetry, behavioural signals and configured threat intelligence. | An execution event and the endpoint policy defined for it. |
| Operational action | Investigate context, classify the event and choose a response. | Restrict unknown execution in a virtual environment; endpoint network isolation is a separate EDR response action. |
| Control boundary | EDR provides event visibility and investigation context; containment is governed by response policies and actions. | Containment decisions require defined authority, exceptions and recovery steps. |
Before you start
EDR coverage is set by supported operating systems, integrations and response policies. A pilot on representative devices helps assess daily operations, resource impact and response authority.
Which Windows, macOS, Linux and server versions must be covered, and what agent constraints apply?
Which endpoints are critical, which groups are safe for a pilot, and which applications must be validated?
Who may authorize automatic isolation and remediation, and which exceptions and rollback steps are required?
Which SIEM, SOAR and threat-intelligence integrations are required and available in the chosen configuration?
Before you decide
EDR monitors activity on enrolled endpoints, helps investigate suspicious behaviour and can take response actions under policy. Visibility is limited to devices covered by a supported agent.
Xcitium EDR combines Auto-Containment™ and isolation of unknown execution with response capabilities. Policies define automated isolation and remediation actions.
EDR can help detect ransomware behaviour and initiate containment. Response depends on endpoint coverage, policy, team authority and recovery readiness.
SIEM, SOAR and threat-intelligence integrations depend on available connectors and licensing; each integration determines which event fields are transferred.
EDR serves small and large environments. Plan scale around endpoint count, OS mix, data retention, licensing and the operating model.
Xcitium
